fix(package): commit pinned HardeningKitty assets
This commit is contained in:
PierreCsn committed
1 parent
18c8954edd
commit
11f3cb0c8b
149 files changed
+37282
-14
No files matched your search
+419
@@ -0,0 +1,419 @@
|
||||
ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter
|
||||
1000,Features,"SMBv1 Support",WindowsOptionalFeature,smb1protocol,,,,,,,,,Disabled,,Disabled,,contains,,High,
|
||||
1103,"Account Policies","Store passwords using reversible encryption",secedit,"System Access\ClearTextPassword",,,,,,,,,0,,0,,=,,High,
|
||||
1101,"Account Policies","Account lockout duration",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,
|
||||
1100,"Account Policies","Account lockout threshold",accountpolicy,,,,,,,,,,Never,,10,,<=,,Low,
|
||||
1104,"Account Policies","Allow Administrator account lockout",secedit,"System Access\AllowAdministratorLockout",,,,,,,,,1,,1,,=,,Medium,
|
||||
1102,"Account Policies","Reset account lockout counter",accountpolicy,,,,,,,,,,30,,15,,>=,,Low,
|
||||
1200,"User Rights Assignment","Access this computer from the network",accesschk,SeNetworkLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone",,BUILTIN\Administrators,,=,,Medium,
|
||||
1201,"User Rights Assignment","Allow log on locally",accesschk,SeInteractiveLogonRight,,,,,,,,,"BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest",,BUILTIN\Users;BUILTIN\Administrators,,=,,Medium,
|
||||
1202,"User Rights Assignment","Debug programs",accesschk,SeDebugPrivilege,,,,,,,,,BUILTIN\Administrators,,,,=,,Medium,
|
||||
1203,"User Rights Assignment","Deny access to this computer from the network",accesschk,SeDenyNetworkLogonRight,,,,,,,,,COMPUTERNAME\Guest,,"BUILTIN\Guests;NT AUTHORITY\Local account",,contains,,Medium,
|
||||
1204,"User Rights Assignment","Deny log on as a batch job",accesschk,SeDenyBatchLogonRight,,,,,,,,,,,BUILTIN\Guests,,contains,,Medium,
|
||||
1205,"User Rights Assignment","Deny log on as a service",accesschk,SeDenyServiceLogonRight,,,,,,,,,,,BUILTIN\Guests,,contains,,Medium,
|
||||
1206,"User Rights Assignment","Deny log on through Remote Desktop Services",accesschk,SeDenyRemoteInteractiveLogonRight,,,,,,,,,,,"BUILTIN\Guests;NT AUTHORITY\Local account",,contains,,Medium,
|
||||
1300,"Security Options","Accounts: Block Microsoft accounts",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,NoConnectedUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Accounts_BlockMicrosoftAccounts,,,,0,,3,,=,,Low,
|
||||
1301,"Security Options","Audit: Force audit policy subcategory settings to override audit policy category settings",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings,,,,1,,1,,=,,Low,
|
||||
1328,"Security Options","Devices: Prevent users from installing printer drivers",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers",AddPrinterDrivers,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters,,,,0,,1,,=,,Medium,
|
||||
1302,"Security Options","Interactive logon: Do not require CTRL+ALT+DEL",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableCAD,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotRequireCTRLALTDEL,,,,1,,0,,=,,Low,
|
||||
1303,"Security Options","Interactive logon: Don't display last signed-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayLastUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayLastSignedIn,,,,0,,1,,=,,Low,
|
||||
1304,"Security Options","Interactive logon: Don't display username at sign-in",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,DontDisplayUserName,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,InteractiveLogon_DoNotDisplayUsernameAtSignIn,,,,0,,1,,=,,Low,
|
||||
1305,"Security Options","Microsoft network client: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,
|
||||
1306,"Security Options","Microsoft network client: Digitally sign communications (if server agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees,,,,1,,1,,=,,Medium,
|
||||
1329,"Security Options","Microsoft network client: Send unencrypted password to third-party SMB servers",Registry,,HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters,EnablePlainTextPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers,,,,0,,0,,=,,Medium,
|
||||
1307,"Security Options","Microsoft network server: Digitally sign communications (always)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsAlways,,,,0,,1,,=,,Medium,
|
||||
1308,"Security Options","Microsoft network server: Digitally sign communications (if client agrees)",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,EnableSecuritySignature,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees,,,,0,,1,,=,,Medium,
|
||||
1309,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts,,,,1,,1,,=,,Medium,
|
||||
1310,"Security Options","Network access: Do not allow anonymous enumeration of SAM accounts and shares",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictAnonymous,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares,,,,0,,1,,=,,Medium,
|
||||
1311,"Security Options","Network access: Do not allow storage of passwords and credentials for network authentication",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,DisableDomainCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication,,,,0,,1,,=,,Medium,
|
||||
1324,"Security Options","Network access: Restrict anonymous access to Named Pipes and Shares",Registry,,HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters,RestrictNullSessAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares,,,,1,,1,,=,,Medium,
|
||||
1325,"Security Options","Network access: Restrict clients allowed to make remote calls to SAM",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RestrictRemoteSAM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM,,,,,,O:BAG:BAD:(A;;RC;;;BA),,=,,Medium,
|
||||
1312,"Security Options","Network security: Allow LocalSystem NULL session fallback",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,allownullsessionfallback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_AllowLocalSystemNULLSessionFallback,,,,0,,0,,=,,Medium,
|
||||
1326,"Security Options","Network security: Do not store LAN Manager hash value on next password change",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,NoLMHash,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange,,,,1,,1,,=,,High,
|
||||
1313,"Security Options","Network security: LAN Manager authentication level",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,LmCompatibilityLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LANManagerAuthenticationLevel,,,,3,,5,,=,,Medium,
|
||||
1330,"Security Options","Network security: LDAP client encryption requirements",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LDAP,LDAPClientConfidentiality,,,,,,,1,,1,,=,,Medium,
|
||||
1314,"Security Options","Network security: LDAP client signing requirements",Registry,,HKLM:\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_LDAPClientSigningRequirements,,,,1,,1,,>=,,Medium,
|
||||
1315,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients,,,,536870912,,537395200,,=,,Medium,
|
||||
1316,"Security Options","Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinServerSec,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers,,,,536870912,,537395200,,=,,Medium,
|
||||
1317,"Security Options","Network security: Restrict NTLM: Audit Incoming NTLM Traffic",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,AuditReceivingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic,,,,0,,2,,=,,Medium,
|
||||
1318,"Security Options","Network security: Restrict NTLM: Audit NTLM authentication in this domain",Registry,,HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters,AuditNTLMInDomain,,,,,,,0,,7,,=,,Medium,
|
||||
1319,"Security Options","Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0,RestrictSendingNTLMTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers,,,,0,,1,,>=,,Medium,
|
||||
1320,"Security Options","Shutdown: Allow system to be shut down without having to log on",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,ShutdownWithoutLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn,,,,1,,0,,=,,Medium,
|
||||
1321,"Security Options","User Account Control: Admin Approval Mode for the Built-in Administrator account",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_UseAdminApprovalMode,,,,0,,1,,=,,Medium,
|
||||
1322,"Security Options","User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForAdministrators,,,,5,,2,,=,,Medium,
|
||||
1323,"Security Options","User Account Control: Behavior of the elevation prompt for standard users",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorUser,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions,UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers,,,,0,,1,,<=,,Medium,
|
||||
1400,"Windows Firewall","EnableFirewall (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableFirewall,,,,0,,1,,=,,Medium,
|
||||
1418,"Windows Firewall","EnableFirewall (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium,
|
||||
1401,"Windows Firewall","Inbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,
|
||||
1419,"Windows Firewall","Inbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium,
|
||||
1402,"Windows Firewall","Outbound Connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,
|
||||
1420,"Windows Firewall","Outbound Connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium,
|
||||
1403,"Windows Firewall","Log size limit (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,
|
||||
1421,"Windows Firewall","Log size limit (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium,
|
||||
1404,"Windows Firewall","Log dropped packets (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,
|
||||
1422,"Windows Firewall","Log dropped packets (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium,
|
||||
1405,"Windows Firewall","Log successful connections (Domain Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,
|
||||
1423,"Windows Firewall","Log successful connections (Domain Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low,
|
||||
1406,"Windows Firewall","EnableFirewall (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableFirewall,,,,0,,1,,=,,Medium,
|
||||
1424,"Windows Firewall","EnableFirewall (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium,
|
||||
1407,"Windows Firewall","Inbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,
|
||||
1425,"Windows Firewall","Inbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium,
|
||||
1408,"Windows Firewall","Outbound Connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,
|
||||
1426,"Windows Firewall","Outbound Connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium,
|
||||
1409,"Windows Firewall","Log size limit (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,
|
||||
1427,"Windows Firewall","Log size limit (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium,
|
||||
1410,"Windows Firewall","Log dropped packets (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,
|
||||
1428,"Windows Firewall","Log dropped packets (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium,
|
||||
1411,"Windows Firewall","Log successful connections (Private Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,
|
||||
1429,"Windows Firewall","Log successful connections (Private Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low,
|
||||
1412,"Windows Firewall","EnableFirewall (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,EnableFirewall,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableFirewall,,,,0,,1,,=,,Medium,
|
||||
1430,"Windows Firewall","EnableFirewall (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,EnableFirewall,,,,,,,1,,1,,=,,Medium,
|
||||
1413,"Windows Firewall","Inbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultInboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultInboundAction,,,,1,,1,,=,,Medium,
|
||||
1431,"Windows Firewall","Inbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultInboundAction,,,,,,,1,,1,,=,,Medium,
|
||||
1414,"Windows Firewall","Outbound Connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile,DefaultOutboundAction,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,DefaultOutboundAction,,,,0,,0,,=,,Medium,
|
||||
1432,"Windows Firewall","Outbound Connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile,DefaultOutboundAction,,,,,,,0,,0,,=,,Medium,
|
||||
1415,"Windows Firewall","Log size limit (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogFileSize,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,LogMaxFileSize,,,,4096,,16384,,>=,,Medium,
|
||||
1433,"Windows Firewall","Log size limit (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogFileSize,,,,,,,4096,,16384,,>=,,Medium,
|
||||
1416,"Windows Firewall","Log dropped packets (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogDroppedPackets,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogDroppedPackets,,,,0,,1,,=,,Medium,
|
||||
1434,"Windows Firewall","Log dropped packets (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogDroppedPackets,,,,,,,0,,1,,=,,Medium,
|
||||
1417,"Windows Firewall","Log successful connections (Public Profile, Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging,LogSuccessfulConnections,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile,,EnableLogSuccessConnections,,,,0,,1,,=,,Low,
|
||||
1435,"Windows Firewall","Log successful connections (Public Profile)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging,LogSuccessfulConnections,,,,,,,0,,1,,=,,Low,
|
||||
1500,"Advanced Audit Policy Configuration","Credential Validation",auditpol,{0CCE923F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1501,"Advanced Audit Policy Configuration","Security Group Management",auditpol,{0CCE9237-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,
|
||||
1502,"Advanced Audit Policy Configuration","User Account Management",auditpol,{0CCE9235-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,"Success and Failure",,=,,Low,
|
||||
1503,"Advanced Audit Policy Configuration","DPAPI Activity",auditpol,{0CCE922D-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1504,"Advanced Audit Policy Configuration","Plug and Play Events",auditpol,{0cce9248-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,
|
||||
1505,"Advanced Audit Policy Configuration","Process Creation",auditpol,{0CCE922B-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,
|
||||
1506,"Advanced Audit Policy Configuration","Account Lockout",auditpol,{0CCE9217-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Failure,,contains,,Low,
|
||||
1507,"Advanced Audit Policy Configuration","Group Membership",auditpol,{0cce9249-69ae-11d9-bed3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,
|
||||
1508,"Advanced Audit Policy Configuration",Logon,auditpol,{0CCE9215-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,
|
||||
1509,"Advanced Audit Policy Configuration","Other Logon/Logoff Events",auditpol,{0CCE921C-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1510,"Advanced Audit Policy Configuration","Special Logon",auditpol,{0CCE921B-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,
|
||||
1511,"Advanced Audit Policy Configuration","Detailed File Share",auditpol,{0CCE9244-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,
|
||||
1512,"Advanced Audit Policy Configuration","File Share",auditpol,{0CCE9224-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1513,"Advanced Audit Policy Configuration","Kernel Object",auditpol,{0CCE921F-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1514,"Advanced Audit Policy Configuration","Other Object Access Events",auditpol,{0CCE9227-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1515,"Advanced Audit Policy Configuration","Removable Storage",auditpol,{0CCE9245-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1516,"Advanced Audit Policy Configuration",SAM,auditpol,{0CCE9220-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1517,"Advanced Audit Policy Configuration","Audit Policy Change",auditpol,{0CCE922F-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,
|
||||
1518,"Advanced Audit Policy Configuration","Authentication Policy Change",auditpol,{0CCE9230-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,
|
||||
1519,"Advanced Audit Policy Configuration","MPSSVC Rule-Level Policy Change",auditpol,{0CCE9232-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1520,"Advanced Audit Policy Configuration","Other Policy Change Events",auditpol,{0CCE9234-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Failure,,contains,,Low,
|
||||
1521,"Advanced Audit Policy Configuration","Sensitive Privilege Use",auditpol,{0CCE9228-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,"Success and Failure",,=,,Low,
|
||||
1522,"Advanced Audit Policy Configuration","Other System Events",auditpol,{0CCE9214-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,
|
||||
1523,"Advanced Audit Policy Configuration","Security State Change",auditpol,{0CCE9210-69AE-11D9-BED3-505054503030},,,,,,,,,Success,,Success,,contains,,Low,
|
||||
1524,"Advanced Audit Policy Configuration","Security System Extension",auditpol,{0CCE9211-69AE-11D9-BED3-505054503030},,,,,,,,,"No Auditing",,Success,,contains,,Low,
|
||||
1525,"Advanced Audit Policy Configuration","System Integrity",auditpol,{0CCE9212-69AE-11D9-BED3-505054503030},,,,,,,,,"Success and Failure",,"Success and Failure",,=,,Low,
|
||||
1828,"Administrative Templates: Control Panel","Allow Online Tips",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,AllowOnlineTips,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings,AllowOnlineTips,,,,1,,0,,=,,Medium,
|
||||
1600,"Administrative Templates: Control Panel","Personalization: Prevent enabling lock screen camera",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Personalization,NoLockScreenCamera,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock,PreventLockScreenCamera,,,,0,,1,,=,,Low,
|
||||
1829,"Administrative Templates: Control Panel","Regional and Language Options: Allow users to enable online speech recognition services",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization,AllowInputPersonalization,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowInputPersonalization,,,,1,,0,,=,,Medium,
|
||||
1830,"Administrative Templates: Network","DNS Client: Configure NetBIOS settings",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableNetbios,,,,,,,,,0,,=,,Medium,
|
||||
1601,"Administrative Templates: Network","DNS Client: Turn off multicast name resolution (LLMNR)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient",EnableMulticast,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient,Turn_Off_Multicast,,,,1,,0,,=,,Medium,
|
||||
1831,"Administrative Templates: Network","Lanman Server: Audit client does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,
|
||||
1832,"Administrative Templates: Network","Lanman Server: Audit client does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditClientDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,
|
||||
1833,"Administrative Templates: Network","Lanman Server: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,
|
||||
1834,"Administrative Templates: Network","Lanman Server: Enable authentication rate limiter",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,EnableAuthRateLimiter,,,,,,,1,,1,,=,,Medium,
|
||||
1835,"Administrative Templates: Network","Lanman Server: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Bowser,EnableMailslots,,,,,,,1,,0,,=,,Medium,
|
||||
1836,"Administrative Templates: Network","Lanman Server: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,
|
||||
1837,"Administrative Templates: Network","Lanman Server: Set authentication rate limiter delay (milliseconds)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanServer,InvalidAuthenticationDelayTimeInMs,,,,,,,,,2000,,>=,,Medium,
|
||||
1838,"Administrative Templates: Network","Lanman Workstation: Audit insecure guest logon",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditInsecureGuestLogon,,,,,,,0,,1,,=,,Medium,
|
||||
1839,"Administrative Templates: Network","Lanman Workstation: Audit server does not support encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportEncryption,,,,,,,0,,1,,=,,Medium,
|
||||
1840,"Administrative Templates: Network","Lanman Workstation: Audit server does not support signing",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AuditServerDoesNotSupportSigning,,,,,,,0,,1,,=,,Medium,
|
||||
1602,"Administrative Templates: Network","Lanman Workstation: Enable insecure guest logons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,AllowInsecureGuestAuth,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation,EnableInsecureGuestLogons,,,,1,,0,,=,,Medium,
|
||||
1841,"Administrative Templates: Network","Lanman Workstation: Enable remote mailslots",Registry,,HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider,EnableMailslots,,,,,,,1,,0,,=,,Medium,
|
||||
1842,"Administrative Templates: Network","Lanman Workstation: Mandate the minimum version of SMB",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,MinSmb2Dialect,,,,,,,,,785,,=,,Medium,
|
||||
1843,"Administrative Templates: Network","Lanman Workstation: Require Encryption",Registry,,HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation,RequireEncryption,,,,,,,0,,1,,=,,Medium,
|
||||
1604,"Administrative Templates: Network","WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services",Registry,,HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config,AutoConnectAllowedOEM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi,AllowAutoConnectToWiFiSenseHotspots,,,,1,,0,,=,,Medium,
|
||||
2108,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low,
|
||||
2109,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low,
|
||||
2110,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low,
|
||||
2111,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium,
|
||||
2112,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low,
|
||||
2113,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low,
|
||||
2116,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0,,1,,=,,Low,
|
||||
2114,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low,
|
||||
2115,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Low,
|
||||
1844,"Administrative Templates: Printers","Allow Print Spooler to accept client connections",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RegisterSpoolerRemoteRpcEndPoint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2,RegisterSpoolerRemoteRpcEndPoint,,,,1,,2,,=,,Medium,
|
||||
1772,"Administrative Templates: Printers","Configure Redirection Guard",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",RedirectionGuardPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRedirectionGuardPolicy,,,,,,1,,=,,Medium,
|
||||
1845,"Administrative Templates: Printers","Configure RPC connection settings (RpcUseNamedPipeProtocol)",Registry,RpcConnectionProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcUseNamedPipeProtocol,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,
|
||||
1846,"Administrative Templates: Printers","Configure RPC connection settings (RpcAuthentication)",Registry,RpcConnectionAuthentication_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcAuthentication,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcConnectionPolicy,,,,,,0,,=,,Medium,
|
||||
1847,"Administrative Templates: Printers","Configure RPC listener settings (RpcProtocols)",Registry,RpcListenerProtocols_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcProtocols,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,5,,=,,Medium,
|
||||
1848,"Administrative Templates: Printers","Configure RPC listener settings (ForceKerberosForRpc)",Registry,RpcAuthenticationProtocol_Enum,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",ForceKerberosForRpc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcListenerPolicy,,,,,,0,,>=,,Medium,
|
||||
1849,"Administrative Templates: Printers","Configure RPC over TCP port",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC",RpcTcpPort,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcTcpPort,,,,,,0,,=,,Medium,
|
||||
1850,"Administrative Templates: Printers","Configure RPC packet level privacy setting for incoming connections",Registry,,HKLM:\System\CurrentControlSet\Control\Print,RpcAuthnLevelPrivacyEnabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureRpcAuthnLevelPrivacyEnabled,,,,,,1,,=,,Medium,
|
||||
1851,"Administrative Templates: Printers","Configure Windows protected print",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP",WindowsProtectedPrintGroupPolicyState,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureWindowsProtectedPrint,,,,0,,1,,=,,Medium,
|
||||
1852,"Administrative Templates: Printers","Limits print driver installation to Administrators",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint",RestrictDriverInstallationToAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,RestrictDriverInstallationToAdministrators,,,,,,1,,=,,Medium,
|
||||
1853,"Administrative Templates: Printers","Manage processing of Queue-specific files",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",CopyFilesPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,ConfigureCopyFilesPolicy,,,,,,1,,=,,Medium,
|
||||
1768,"Administrative Templates: Printers","Only use Package Point and Print (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintOnly,,,,,,,,,1,,=,,Medium,
|
||||
1769,"Administrative Templates: Printers","Package Point and Print - Approved servers (CVE-2021-36958)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint",PackagePointAndPrintServerList,,,,,,,,,1,,=,,Medium,
|
||||
1764,"Administrative Templates: Printers","Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnInstall_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",NoWarningNoElevationOnInstall,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,High,
|
||||
1765,"Administrative Templates: Printers","Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527)",Registry,PointAndPrint_NoWarningNoElevationOnUpdate_Enum,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint",UpdatePromptSettings,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers,PointAndPrintRestrictions,,,,0,,0,,=,,High,
|
||||
1771,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off notifications network usage",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoCloudApplicationNotification,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications,DisallowCloudNotification,,,,0,,1,,=,,Medium,
|
||||
1854,"Administrative Templates: Start Menu and Taskbar","Remove Personalized Website Recommendations from the Recommended section in the Start Menu",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,HideRecommendedPersonalizedSites,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start,HideRecommendedPersonalizedSites,,,,0,,1,,=,,Medium,
|
||||
1855,"Administrative Templates: System","Configure the behavior of the sudo command",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Sudo,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo,EnableSudo,,,,,,0,,=,,Medium,
|
||||
1856,"Administrative Templates: System","Audit Process Creation: Include command line in process creation events",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit,ProcessCreationIncludeCmdLine_Enabled,,,,,,,0,,1,,=,,Medium,
|
||||
1605,"Administrative Templates: System","Credentials Delegation: Allow delegation default credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowDefaultCredentials,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowDefaultCredentials,,,,1,,0,,=,,Medium,
|
||||
1606,"Administrative Templates: System","Credentials Delegation: Encryption Oracle Remediation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters,AllowEncryptionOracle,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp,AllowEncryptionOracle,,,,0,,0,,=,,Medium,
|
||||
1699,"Administrative Templates: System","Credentials Delegation: Remote host allows delegation of non-exportable credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation,AllowProtectedCreds,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation,RemoteHostAllowsDelegationOfNonExportableCredentials,,,,0,,1,,=,,Medium,
|
||||
1614,"Administrative Templates: System","Device Guard: Virtualization Based Security Status",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,VirtualizationBasedSecurityStatus,"Not available",,2,,=,,Medium,
|
||||
1615,"Administrative Templates: System","Device Guard: Available Security Properties: Secure Boot",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,2,,2,,=,,Medium,
|
||||
1616,"Administrative Templates: System","Device Guard: Available Security Properties: DMA protection",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,AvailableSecurityProperties,3,,3,,=,,Medium,
|
||||
1617,"Administrative Templates: System","Device Guard: Security Services Configured: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available",,1,,=,,Medium,
|
||||
1619,"Administrative Templates: System","Device Guard: Security Services Running: Credential Guard",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available",,1,,=,,Medium,
|
||||
1618,"Administrative Templates: System","Device Guard: Security Services Configured: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesConfigured,"Not available",,2,,=,,Medium,
|
||||
1620,"Administrative Templates: System","Device Guard: Security Services Running: HVCI",CimInstance,,,,,,,Win32_DeviceGuard,root\Microsoft\Windows\DeviceGuard,SecurityServicesRunning,"Not available",,2,,=,,Medium,
|
||||
1623,"Administrative Templates: System","Device Guard: Require UEFI Memory Attributes Table (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,HVCIMATRequired,,,,,,,,,1,,=,,Medium,
|
||||
1621,"Administrative Templates: System","Device Guard: Secure Launch Configuration (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,ConfigureSystemGuardLaunch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard,ConfigureSystemGuardLaunch,,,,0,,1,,=,,Medium,
|
||||
1622,"Administrative Templates: System","Device Guard: Windows Defender Application Control deployed (Policy)",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard,DeployConfigCIPolicy,,,,,,,0,,1,,=,,Medium,
|
||||
1607,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,
|
||||
1608,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceIDsRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,1,,=,,Medium,
|
||||
1609,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0010,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0010,,=,,Medium,
|
||||
1610,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs,PCI\CC_0C0A,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceIDs,,,,0,,PCI\CC_0C0A,,=,,Medium,
|
||||
1611,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClasses,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,
|
||||
1612,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions,DenyDeviceClassesRetroactive,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,1,,=,,Medium,
|
||||
1613,"Administrative Templates: System","Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)",RegistryList,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses,d48179be-ec20-11d1-b6b8-00c04fa372a7,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation,PreventInstallationOfMatchingDeviceSetupClasses,,,,0,,d48179be-ec20-11d1-b6b8-00c04fa372a7,,=,,Medium,
|
||||
1630,"Administrative Templates: System","Early Launch Antimalware: Boot-Start Driver Initialization Policy",Registry,,HKLM:\System\CurrentControlSet\Policies\EarlyLaunch,DriverLoadPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,BootStartDriverInitialization,,,,0,,3,,=,,Medium,
|
||||
1631,"Administrative Templates: System","Group Policy: Process even if the Group Policy objects have not changed",Registry,CSE_NOCHANGES10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoBackgroundPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,1,,0,,=,,Low,
|
||||
1632,"Administrative Templates: System","Group Policy: Do not apply during periodic background processing",Registry,CSE_NOBACKGROUND10,"HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}",NoGPOListChanges,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy,CSE_Registry,,,,0,,0,,=,,Low,
|
||||
1640,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\Messenger\Client,CEIP,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,WinMSG_NoInstrumentation_1,,,,0,,2,,=,,Medium,
|
||||
1641,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Printers",DisableWebPnPDownload,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableDownloadingOfPrintDriversOverHTTP,,,,0,,1,,=,,Medium,
|
||||
1642,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1",Registry,,HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,1,,0,,=,,Medium,
|
||||
1643,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2",Registry,,"HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting,DisableWindowsErrorReporting,,,,0,,1,,=,,Medium,
|
||||
1644,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity,DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards,,,,0,,1,,=,,Medium,
|
||||
1645,"Administrative Templates: System","Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program",Registry,,HKLM:\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM,CEIPEnable,,,,1,,0,,=,,Medium,
|
||||
1650,"Administrative Templates: System","Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection",DeviceEnumerationPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard,DeviceEnumerationPolicy,,,,2,,0,,=,,Medium,
|
||||
1857,"Administrative Templates: System","Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowCustomSSPsAPs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,AllowCustomSSPsAPs,,,,,,0,,=,,Medium,
|
||||
1858,"Administrative Templates: System","Local Security Authority: Configures LSASS to run as a protected process",Registry,,HKLM:\System\CurrentControlSet\Control\Lsa,RunAsPPL,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority,ConfigureLsaProtectedProcess,,,,,,2,,=,,Medium,
|
||||
1660,"Administrative Templates: System","Logon: Turn on convenience PIN sign-in",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,AllowDomainPINLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders,AllowPINLogon,,,,1,,0,,=,,Medium,
|
||||
1661,"Administrative Templates: System","Logon: Turn off app notifications on the lock screen",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DisableLockScreenAppNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DisableLockScreenAppNotifications,,,,0,,1,,=,,Medium,
|
||||
1662,"Administrative Templates: System","Logon: Do not display network selection UI",Registry,,HKLM:\Software\Policies\Microsoft\Windows\System,DontDisplayNetworkSelectionUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,DontDisplayNetworkSelectionUI,,,,0,,1,,=,,Medium,
|
||||
1670,"Administrative Templates: System","Mitigation Options: Untrusted Font Blocking",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions",MitigationOptions_FontBocking,,,,,,,0,,1000000000000,,=,,Medium,
|
||||
1680,"Administrative Templates: System","OS Policies: Allow Clipboard synchronization across devices",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,AllowCrossDeviceClipboard,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,AllowCrossDeviceClipboard,,,,1,,0,,=,,Medium,
|
||||
1859,"Administrative Templates: System","OS Policies: Allow upload of User Activities",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,UploadUserActivities,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,UploadUserActivities,,,,1,,0,,=,,Medium,
|
||||
1685,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesPluggedIn,,,,0,,1,,=,,Medium,
|
||||
1686,"Administrative Templates: System","Sleep Settings: Require a password when a computer wakes (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,RequirePasswordWhenComputerWakesOnBattery,,,,0,,1,,=,,Medium,
|
||||
1687,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,ACSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyWhenSleepingPluggedIn,,,,1,,0,,=,,Medium,
|
||||
1688,"Administrative Templates: System","Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)",Registry,,HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab,DCSettingIndex,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power,AllowStandbyStatesWhenSleepingOnBattery,,,,1,,0,,=,,Medium,
|
||||
1690,"Administrative Templates: System","Remote Assistance: Configure Offer Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowUnsolicited,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,UnsolicitedRemoteAssistance,,,,1,,0,,=,,Medium,
|
||||
1691,"Administrative Templates: System","Remote Assistance: Configure Solicited Remote Assistance",Registry,,"HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services",fAllowToGetHelp,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance,SolicitedRemoteAssistance,,,,1,,0,,=,,Medium,
|
||||
1692,"Administrative Templates: System","Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",EnableAuthEpResolution,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RPCEndpointMapperClientAuthentication,,,,0,,1,,=,,Medium,
|
||||
1693,"Administrative Templates: System","Remote Procedure Call: Restrict Unauthenticated RPC clients",Registry,,"HKLM:\Software\Policies\Microsoft\Windows NT\Rpc",RestrictRemoteClients,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall,RestrictUnauthenticatedRPCClients,,,,0,,2,,=,,Medium,
|
||||
1694,"Administrative Templates: System","Security Settings: Enable svchost.exe mitigation options",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig,EnableSvchostMitigationPolicy,,,,,,,0,,1,,=,,Medium,
|
||||
1696,"Administrative Templates: System","User Profiles: Turn off the advertising ID",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo,DisabledByGroupPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,DisableAdvertisingID,,,,0,,1,,=,,Medium,
|
||||
1697,"Administrative Templates: System","Time Providers: Enable Windows NTP Client",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPCLIENT,,,,0,,1,,=,,Medium,
|
||||
1698,"Administrative Templates: System","Time Providers: Enable Windows NTP Server",Registry,,HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer,Enabled,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time,W32TIME_POLICY_ENABLE_NTPSERVER,,,,0,,0,,=,,Medium,
|
||||
1860,"Administrative Templates: Windows Components","App and Device Inventory: Turn off API Sampling",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableAPISamping,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffAPISamping,,,,0,,1,,=,,Medium,
|
||||
1861,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Application Footprint",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableApplicationFootprint,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffApplicationFootprint,,,,0,,1,,=,,Medium,
|
||||
1862,"Administrative Templates: Windows Components","App and Device Inventory: Turn off Install Tracing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat,DisableInstallTracing,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory,TurnOffInstallTracing,,,,0,,1,,=,,Medium,
|
||||
1700,"Administrative Templates: Windows Components","App Package Deployment: Allow a Windows app to share application data between users",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager,AllowSharedLocalAppData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowSharedUserAppData,,,,1,,0,,=,,Medium,
|
||||
1701,"Administrative Templates: Windows Components","App Privacy: Let Windows apps activate with voice while the system is locked",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy,LetAppsActivateWithVoiceAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy,LetAppsActivateWithVoiceAboveLock,,,,0,,2,,=,,Medium,
|
||||
1702,"Administrative Templates: Windows Components","App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,BlockHostedAppAccessWinRT,,,,,,,0,,1,,=,,Medium,
|
||||
1703,"Administrative Templates: Windows Components","Application Compatibility: Turn off Application Telemetry",Registry,,HKLM:\Software\Policies\Microsoft\Windows\AppCompat,AITEnable,,,,,,,1,,0,,=,,Medium,
|
||||
1704,"Administrative Templates: Windows Components","AutoPlay Policies: Turn off Autoplay",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDriveTypeAutoRun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,TurnOffAutoPlay,,,,0,,255,,=,,Medium,
|
||||
1705,"Administrative Templates: Windows Components","AutoPlay Policies: Disallow Autoplay for non-volume devices",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,DisallowAutoplayForNonVolumeDevices,,,,0,,1,,=,,Medium,
|
||||
1706,"Administrative Templates: Windows Components","AutoPlay Policies: Set the default behavior for AutoRun",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay,SetDefaultAutoRunBehavior,,,,0,,1,,=,,Medium,
|
||||
1707,"Administrative Templates: Windows Components","Biometrics: Allow the use of biometrics",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics,Enabled,,,,,,,1,,0,,=,,Medium,
|
||||
1773,"Administrative Templates: Windows Components","Biometrics: Facial Features: Configure enhanced anti-spoofing",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures,EnhancedAntiSpoofing,,,,,,,,,1,,=,,Medium,
|
||||
1708,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Volume status",BitLockerVolume,VolumeStatus,,,,,,,,,FullyDecrypted,,FullyEncrypted,,=,,High,
|
||||
1761,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EncryptionMethodWithXtsOs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EncryptionMethodByDriveType,,,,6,,6,,=,,Medium,
|
||||
1762,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Drive encryption method (for operating system drives)",BitLockerVolume,EncryptionMethod,,,,,,,,,None,,XtsAes128,,=,,Medium,
|
||||
1709,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Disable new DMA devices when this computer is locked",Registry,,HKLM:\Software\Policies\Microsoft\FVE,DisableExternalDMAUnderLock,,,,,,,0,,1,,=,,Medium,
|
||||
1710,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSAllowSecureBootForIntegrity,,,,,,,0,,1,,=,,Medium,
|
||||
1711,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseAdvancedStartup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,
|
||||
1715,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM",Registry,,HKLM:\Software\Policies\Microsoft\FVE,EnableBDEWithNoTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,1,,0,,=,,Medium,
|
||||
1716,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPM,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,
|
||||
1717,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,1,,=,,Medium,
|
||||
1718,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKey,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,
|
||||
1719,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseTPMKeyPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesRequireStartupAuthentication,,,,0,,0,,=,,Medium,
|
||||
1712,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,UseEnhancedPin,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,EnhancedPIN_Name,,,,0,,1,,=,,Medium,
|
||||
1713,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives",Registry,,HKLM:\Software\Policies\Microsoft\FVE,OSHardwareEncryption,,,,,,,0,,0,,=,,Medium,
|
||||
1763,"Administrative Templates: Windows Components","BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup",Registry,,HKLM:\Software\Policies\Microsoft\FVE,MinimumPIN,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker,SystemDrivesMinimumPINLength,,,,,,8,,>=,,Medium,
|
||||
1720,"Administrative Templates: Windows Components","Cloud Content: Do not show Windows tips",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableSoftLanding,,,,,,,0,,1,,=,,Medium,
|
||||
1863,"Administrative Templates: Windows Components","Cloud Content: Turn off cloud consumer account state content",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableConsumerAccountStateContent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DisableConsumerAccountStateContent,,,,,,1,,=,,Medium,
|
||||
1721,"Administrative Templates: Windows Components","Cloud Content: Turn off Microsoft consumer experiences",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CloudContent,DisableWindowsConsumerFeatures,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowWindowsConsumerFeatures,,,,0,,1,,=,,Medium,
|
||||
1722,"Administrative Templates: Windows Components","Credential User Interface: Do not display the password reveal button",Registry,,HKLM:\Software\Policies\Microsoft\Windows\CredUI,DisablePasswordReveal,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,DisablePasswordReveal,,,,0,,1,,=,,Medium,
|
||||
1724,"Administrative Templates: Windows Components","Credential User Interface: Enumerate administrator accounts on elevation",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI,EnumerateAdministrators,,,,1,,0,,=,,Medium,
|
||||
1864,"Administrative Templates: Windows Components","Credential User Interface: Prevent the use of security questions for local accounts",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,NoLocalPasswordResetQuestions,,,,,,,0,,1,,=,,Medium,
|
||||
1725,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow Diagnostic Data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowTelemetry,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowTelemetry,,,,2,,1,,<=,,Medium,
|
||||
1726,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,AllowDeviceNameInTelemetry,,,,,,,1,,0,,=,,Medium,
|
||||
1865,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Disable OneSettings Downloads",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DisableOneSettingsDownloads,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneSettingsDownloads,,,,,,1,,=,,Medium,
|
||||
1866,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Do not show feedback notifications",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,DoNotShowFeedbackNotifications,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,DoNotShowFeedbackNotifications,,,,0,,1,,=,,Medium,
|
||||
1867,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Diagnostic Log Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDiagnosticLogCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDiagnosticLogCollection,,,,,,1,,=,,Medium,
|
||||
1868,"Administrative Templates: Windows Components","Data Collection and Preview Builds: Limit Dump Collection",Registry,,HKLM:\Software\Policies\Microsoft\Windows\DataCollection,LimitDumpCollection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,LimitDumpCollection,,,,,,1,,=,,Medium,
|
||||
1727,"Administrative Templates: Windows Components","Delivery Optimization: Download Mode",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization,DODownloadMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization,DODownloadMode,,,,1,,99,,=,,Medium,
|
||||
1728,"Administrative Templates: Windows Components","Event Log Service: Application: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeApplicationLog,,,,4096,,32768,,>=,,Medium,
|
||||
1729,"Administrative Templates: Windows Components","Event Log Service: Security: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSecurityLog,,,,4096,,196608,,>=,,Medium,
|
||||
1730,"Administrative Templates: Windows Components","Event Log Service: System: Specify the maximum log file size (KB)",Registry,Channel_LogMaxSize,HKLM:\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService,SpecifyMaximumFileSizeSystemLog,,,,4096,,32768,,>=,,Medium,
|
||||
1774,"Administrative Templates: Windows Components","Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB)",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PowerShell/Operational,MaxSize,,,,,,,15728640,,268435456,,>=,,Medium,
|
||||
1775,"Administrative Templates: Windows Components","Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB)",Registry,"",HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\PowerShellCore/Operational,MaxSize,,,,,,,15728640,,268435456,,>=,,Medium,
|
||||
1731,"Administrative Templates: Windows Components","File Explorer: Allow the use of remote paths in file shortcut icons",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Explorer,EnableShellShortcutIconRemotePath,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer,EnableShellShortcutIconRemotePath,,,,0,,0,,=,,Medium,
|
||||
1869,"Administrative Templates: Windows Components","File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer,DisableGraphRecentItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer,DisableGraphRecentItems,,,,,,1,,=,,Medium,
|
||||
1732,"Administrative Templates: Windows Components","HomeGroup: Prevent the computer from joining a homegroup",Registry,,HKLM:\Software\Policies\Microsoft\Windows\HomeGroup,DisableHomeGroup,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing,DisableHomeGroup,,,,0,,1,,=,,Medium,
|
||||
1870,"Administrative Templates: Windows Components","Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation",Registry,,"HKLM:\Software\Policies\Microsoft\Internet Explorer\Main",DisableInternetExplorerLaunchViaCOM,,,,,,,,,1,,=,,Medium,
|
||||
1874,"Administrative Templates: Windows Components","Location and Sensors: Turn off location",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors,DisableLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,AllowLocation,,,,0,,1,,=,,Medium,
|
||||
1800,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",DisableAntiSpyware,,,,,,,0,,0,,=,,Medium,
|
||||
1826,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable Tamper Protection (Status)",MpComputerStatus,IsTamperProtected,,,,,,,,,,,True,,=,,Medium,
|
||||
1801,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Configure detection for potentially unwanted applications",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender",PUAProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,PUAProtection,,,,0,,1,,>=,,Medium,
|
||||
1806,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Extensions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Extensions,,,,,,,,=,,Medium,
|
||||
1807,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Extension Exclusions",MpPreferenceExclusion,ExclusionExtension,,,,,,,,,,,,,=,,Medium,
|
||||
1808,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Paths,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Paths,,,,,,,,=,,Medium,
|
||||
1809,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Path Exclusions",MpPreferenceExclusion,ExclusionPath,,,,,,,,,,,,,=,,Medium,
|
||||
1810,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",Exclusions_Processes,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,Exclusions_Processes,,,,,,,,=,,Medium,
|
||||
1811,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Exclusions: Process Exclusions",MpPreferenceExclusion,ExclusionProcess,,,,,,,,,,,,,=,,Medium,
|
||||
1816,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet",SpynetReporting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,SpynetReporting,,,,0,,2,,=,,Medium,
|
||||
1817,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",DisableBlockAtFirstSeen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,DisableBlockAtFirstSeen,,,,,,0,,=,,Medium,
|
||||
1818,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet",SubmitSamplesConsent,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,SubmitSamplesConsent,,,,,,2,,=,,Medium,
|
||||
1819,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine",EnableFileHashComputation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableFileHashComputation,,,,,,1,,=,,Medium,
|
||||
1820,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: MpEngine: Select cloud protection level",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine",MpCloudBlockLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,MpEngine_MpCloudBlockLevel,,,,0,,2,,>=,,Medium,
|
||||
1821,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableIOAVProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,RealtimeProtection_DisableIOAVProtection,,,,0,,0,,=,,Medium,
|
||||
1822,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableRealtimeMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowRealtimeMonitoring,,,,0,,0,,=,,Medium,
|
||||
1823,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableBehaviorMonitoring,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowBehaviorMonitoring,,,,0,,0,,=,,Medium,
|
||||
1824,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection",DisableScriptScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AllowScriptScanning,,,,0,,0,,=,,Medium,
|
||||
1825,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Scan: Scan removable drives",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Scan",DisableRemovableDriveScanning,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,Scan_DisableRemovableDriveScanning,,,,1,,0,,=,,Medium,
|
||||
1812,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Enable sandboxing for Microsoft Defender Antivirus",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment",MP_FORCE_USE_SANDBOX,,,,,,,0,,1,,=,,Medium,
|
||||
1900,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_Rules,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1901,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1916,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail",MpPreferenceAsr,be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,,,,,,,,,0,,1,,=,,Medium,
|
||||
1902,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d4f940ab-401b-4efc-aadc-ad5f3c50688a,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1917,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes",MpPreferenceAsr,d4f940ab-401b-4efc-aadc-ad5f3c50688a,,,,,,,,,0,,1,,=,,Medium,
|
||||
1903,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",3b576869-a4ec-4529-8536-b80a7769e899,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1918,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content",MpPreferenceAsr,3b576869-a4ec-4529-8536-b80a7769e899,,,,,,,,,0,,1,,=,,Medium,
|
||||
1904,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1919,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes",MpPreferenceAsr,75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,,,,,,,,,0,,1,,=,,Medium,
|
||||
1905,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d3e037e1-3eb8-44c8-a917-57927947596d,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1920,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content",MpPreferenceAsr,d3e037e1-3eb8-44c8-a917-57927947596d,,,,,,,,,0,,1,,=,,Medium,
|
||||
1906,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",5beb7efe-fd9a-4556-801d-275e5ffc04cc,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1921,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts",MpPreferenceAsr,5beb7efe-fd9a-4556-801d-275e5ffc04cc,,,,,,,,,0,,1,,=,,Medium,
|
||||
1907,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1922,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros",MpPreferenceAsr,92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,,,,,,,,,0,,1,,=,,Medium,
|
||||
1908,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",01443614-cd74-433a-b99e-2ecdc07bfc25,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,2,,=,,Medium,
|
||||
1923,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion",MpPreferenceAsr,01443614-cd74-433a-b99e-2ecdc07bfc25,,,,,,,,,0,,2,,=,,Medium,
|
||||
1909,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c1db55ab-c21a-4637-bb3f-a12568109d35,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1924,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware",MpPreferenceAsr,c1db55ab-c21a-4637-bb3f-a12568109d35,,,,,,,,,0,,1,,=,,Medium,
|
||||
1910,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1925,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)",MpPreferenceAsr,9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,,,,,,,,,0,,1,,=,,Medium,
|
||||
1911,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",d1e49aac-8f56-4280-b9ba-993a6d77406c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1926,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands",MpPreferenceAsr,d1e49aac-8f56-4280-b9ba-993a6d77406c,,,,,,,,,0,,1,,=,,Medium,
|
||||
1912,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1927,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB",MpPreferenceAsr,b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,,,,,,,,,0,,1,,=,,Medium,
|
||||
1913,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",26190899-1602-49e8-8b27-eb1d0a1ce869,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1928,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes",MpPreferenceAsr,26190899-1602-49e8-8b27-eb1d0a1ce869,,,,,,,,,0,,1,,=,,Medium,
|
||||
1914,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1929,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes",MpPreferenceAsr,7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,,,,,,,,,0,,1,,=,,Medium,
|
||||
1915,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",e6db77e5-3df2-4cf1-b95a-636979351e5b,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1930,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription",MpPreferenceAsr,e6db77e5-3df2-4cf1-b95a-636979351e5b,,,,,,,,,0,,1,,=,,Medium,
|
||||
1931,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",56a863a9-875e-4185-98a7-b882c64b5ce5,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1932,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers",MpPreferenceAsr,56a863a9-875e-4185-98a7-b882c64b5ce5,,,,,,,,,0,,1,,=,,Medium,
|
||||
1933,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",33ddedf1-c6e0-47cb-833e-de6133960387,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1934,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode",MpPreferenceAsr,33ddedf1-c6e0-47cb-833e-de6133960387,,,,,,,,,0,,1,,=,,Medium,
|
||||
1935,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules",c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,AttackSurfaceReductionRules,,,,0,,1,,=,,Medium,
|
||||
1936,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools",MpPreferenceAsr,c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb,,,,,,,,,0,,1,,=,,Medium,
|
||||
1966,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy)",Registry,,"HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR",ExploitGuard_ASR_ASROnlyExclusions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus,ExploitGuard_ASR_ASROnlyExclusions,,,,0,,0,,=,,Medium,
|
||||
1967,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules",MpPreferenceExclusion,AttackSurfaceReductionOnlyExclusions,,,,,,,,,,,,,=|0,,Medium,
|
||||
1965,"Administrative Templates: Windows Components","Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection",EnableNetworkProtection,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender,EnableNetworkProtection,,,,,,1,,=,,Medium,
|
||||
1733,"Administrative Templates: Windows Components","OneDrive: Prevent the usage of OneDrive for file storage",Registry,,HKLM:\Software\Policies\Microsoft\Windows\OneDrive,DisableFileSyncNGSC,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System,DisableOneDriveFileSync,,,,0,,1,,=,,Medium,
|
||||
1734,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Do not allow passwords to be saved",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",DisablePasswordSaving,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowPasswordSaving,,,,0,,1,,=,,Medium,
|
||||
1871,"Administrative Templates: Windows Components","Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client",DisableCloudClipboardIntegration,,,,,,,,,1,,=,,Medium,
|
||||
1735,"Administrative Templates: Windows Components","Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDenyTSConnections,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,AllowUsersToConnectRemotely,,,,0,,1,,=,,Medium,
|
||||
1736,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fDisableCdm,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,DoNotAllowDriveRedirection,,,,0,,1,,=,,Medium,
|
||||
1872,"Administrative Templates: Windows Components","Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",SCClipLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,LimitServerToClientClipboardRedirection,,,,,,0,,=,,Medium,
|
||||
1737,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Always prompt for password upon connection",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fPromptForPassword,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,PromptForPasswordUponConnection,,,,0,,1,,=,,Medium,
|
||||
1738,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Require secure RPC communication",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",fEncryptRPCTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,RequireSecureRPCCommunication,,,,0,,1,,=,,Medium,
|
||||
1739,"Administrative Templates: Windows Components","Remote Desktop Session Host: Security: Set client connection encryption level",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services",MinEncryptionLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices,ClientConnectionEncryptionLevel,,,,0,,3,,=,,Medium,
|
||||
1740,"Administrative Templates: Windows Components","Search: Allow Cloud Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCloudSearch,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowCloudSearch,,,,1,,0,,=,,Medium,
|
||||
1741,"Administrative Templates: Windows Components","Search: Allow Cortana",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortana,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience,AllowCortana,,,,1,,0,,=,,Medium,
|
||||
1742,"Administrative Templates: Windows Components","Search: Allow Cortana above lock screen",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowCortanaAboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock,AllowCortanaAboveLock,,,,1,,0,,=,,Medium,
|
||||
1743,"Administrative Templates: Windows Components","Search: Allow indexing of encrypted files",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowIndexingEncryptedStoresOrItems,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowIndexingEncryptedStoresOrItems,,,,1,,0,,=,,Medium,
|
||||
1744,"Administrative Templates: Windows Components","Search: Allow search and Cortana to use location",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",AllowSearchToUseLocation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search,AllowSearchToUseLocation,,,,1,,0,,=,,Medium,
|
||||
1745,"Administrative Templates: Windows Components","Search: Set what information is shared in Search",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search",ConnectedSearchPrivacy,,,,,,,1,,3,,=,,Medium,
|
||||
2000,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,EnableSmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen,EnableSmartScreenInShell,,,,1,,1,,=,,Medium,
|
||||
1873,"Administrative Templates: Windows Components","Windows AI: Allow Recall to be enabled",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WindowsAI,AllowRecallEnablement,,,,,,,,,0,,=,,Medium,
|
||||
2001,"Administrative Templates: Windows Components","Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass",Registry,,HKLM:\SOFTWARE\Policies\Microsoft\Windows\System,ShellSmartScreenLevel,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser,PreventSmartScreenPromptOverride,,,,Warn,,Block,,=,,Medium,
|
||||
1746,"Administrative Templates: Windows Components","Windows Error Reporting: Disable Windows Error Reporting",Registry,,"HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting",Disabled,,,,,,,0,,1,,=,,Medium,
|
||||
1747,"Administrative Templates: Windows Components","Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting",Registry,,HKLM:\Software\Policies\Microsoft\Windows\GameDVR,AllowGameDVR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,AllowGameDVR,,,,1,,0,,=,,Low,
|
||||
1748,"Administrative Templates: Windows Components","Windows Ink Workspace: Allow Windows Ink Workspace",Registry,,HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace,AllowWindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace,AllowWindowsInkWorkspace,,,,1,,0,,=,,Medium,
|
||||
1749,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,
|
||||
1750,"Administrative Templates: Windows Components","Windows Installer: Allow user control over installs",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,EnableUserControl,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement,MSIAllowUserControlOverInstall,,,,1,,0,,=,,Medium,
|
||||
1751,"Administrative Templates: Windows Components","Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts",Registry,,HKLM:\Software\Policies\Microsoft\Windows\Installer,SafeForScripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI,SafeForScripting,,,,1,,0,,=,,Medium,
|
||||
1770,"Administrative Templates: Windows Components","Windows Installer: Disable Co-Installer (USB AutoInstall)",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer",DisableCoInstallers,,,,,,,,,1,,=,,Medium,
|
||||
1752,"Administrative Templates: Windows Components","Windows Logon Options: Sign-in and lock last interactive user automatically after a restart",Registry,,HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,DisableAutomaticRestartSignOn,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,AllowAutomaticRestartSignOn,,,,0,,1,,=,,Medium,
|
||||
1776,"Administrative Templates: Windows Components","Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon",Registry,,HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableMPR,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon,EnableMPRNotifications,,,,,,0,,=,,Medium,
|
||||
2105,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low,
|
||||
2106,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low,
|
||||
2100,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell,TurnOnPowerShellScriptBlockLogging,,,,0,,1,,=,,Medium,
|
||||
2101,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low,
|
||||
2102,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Low,
|
||||
2107,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low,
|
||||
1753,"Administrative Templates: Windows Components","WinRM Client: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Client,,,,0,,0,,=,,Medium,
|
||||
1754,"Administrative Templates: Windows Components","WinRM Client: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Client,,,,0,,0,,=,,Medium,
|
||||
1755,"Administrative Templates: Windows Components","WinRM Client: Disallow Digest authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client,AllowDigest,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowDigestAuthentication,,,,0,,0,,=,,Medium,
|
||||
1756,"Administrative Templates: Windows Components","WinRM Service: Allow remote server management through WinRM",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowAutoConfig,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowRemoteServerManagement,,,,0,,0,,=,,Medium,
|
||||
1757,"Administrative Templates: Windows Components","WinRM Service: Allow Basic authentication",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowBasic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowBasicAuthentication_Service,,,,0,,0,,=,,Medium,
|
||||
1758,"Administrative Templates: Windows Components","WinRM Service: Allow unencrypted traffic",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,AllowUnencryptedTraffic,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,AllowUnencryptedTraffic_Service,,,,0,,0,,=,,Medium,
|
||||
1759,"Administrative Templates: Windows Components","WinRM Service: Disallow WinRM from storing RunAs credentials",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service,DisableRunAs,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement,DisallowStoringOfRunAsCredentials,,,,0,,1,,=,,Medium,
|
||||
1760,"Administrative Templates: Windows Components","Windows Remote Shell: Allow Remote Shell Access",Registry,,HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS,AllowRemoteShellAccess,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell,AllowRemoteShellAccess,,,,1,,0,,=,,Medium,
|
||||
2201,"MS Security Guide","Lsass.exe audit mode",Registry,,"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe",AuditLevel,,,,,,,,,8,,=,,Low,
|
||||
2202,"MS Security Guide","NetBT NodeType configuration",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters,NodeType,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,NetBTNodeTypeConfiguration,,,,0,,2,,=,,Medium,
|
||||
2203,"MS Security Guide","WDigest Authentication",Registry,,HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest,UseLogonCredential,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,WDigestAuthentication,,,,0,,0,,=,,High,
|
||||
2209,"MS Security Guide","Enable Structured Exception Handling Overwrite Protection (SEHOP)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel",DisableExceptionChainValidation,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,EnableStructuredExceptionHandlingOverwriteProtection,,,,0,,0,,=,,Medium,
|
||||
2213,"MS Security Guide","Configure SMB v1 client driver",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1ClientDriver,,,,1,,4,,=,,Medium,
|
||||
2214,"MS Security Guide","Configure SMB v1 server",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters,SMB1,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide,ConfigureSMBV1Server,,,,1,,0,,=,,Medium,
|
||||
2215,"MS Security Guide","Enable Certificate Padding",Registry,,HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,
|
||||
2216,"MS Security Guide","Enable Certificate Padding (32-bit subsystem on 64-bit OS)",Registry,,HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config,EnableCertPaddingCheck,,,,,,,,,1,,=,,Medium,
|
||||
2204,"MSS (Legacy)","MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)",Registry,,"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager",SafeDLLSearchMode,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy,Pol_MSS_SafeDllSearchMode,,,,0,,1,,=,,Medium,
|
||||
2205,"MSS (Legacy)","MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,IPv6SourceRoutingProtectionLevel,,,,0,,2,,=,,Medium,
|
||||
2206,"MSS (Legacy)","MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,SourceRoutingProtectionLevel,,,,1,,2,,=,,Medium,
|
||||
2207,"MSS (Legacy)","MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes",Registry,,HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowICMPRedirectsToOverrideGeneratedRoute,,,,1,,0,,=,,Medium,
|
||||
2208,"MSS (Legacy)","MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers",Registry,,HKLM:\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy,AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers,,,,0,,1,,=,,Medium,
|
||||
2400,"Scheduled Task","XblGameSave Standby Task",ScheduledTask,XblGameSaveTask,,,,,,,,,Ready,,Disabled,,=,,Medium,
|
||||
2411,"System Services","Disable mDNS in Dnscache service",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters,EnableMDNS,,,,,,,,,0,,=,,Medium,
|
||||
2401,"System Services","Print Spooler (Spooler)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\Spooler,Start,,,,,,,2,,4,,=,,Medium,
|
||||
2402,"System Services","Print Spooler (Spooler) (Service Startup type)",service,Spooler,,,,,,,,,Automatic,,Disabled,,=,,Medium,
|
||||
2412,"System Services","WebClient (WebClient)",Registry,"",HKLM:\SYSTEM\CurrentControlSet\Services\WebClient,Start,,,,,,,3,,4,,=,,Medium,
|
||||
2413,"System Services","WebClient (WebClient) (Service Startup type)",service,WebClient,,,,,,,,,Manual,,Disabled,,=,,Medium,
|
||||
2403,"System Services","Xbox Accessory Management Service (XboxGipSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxAccessoryManagementServiceStartupMode,,,,3,,4,,=,,Medium,
|
||||
2404,"System Services","Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)",service,XboxGipSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,
|
||||
2405,"System Services","Xbox Live Auth Manager (XblAuthManager)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveAuthManagerServiceStartupMode,,,,3,,4,,=,,Medium,
|
||||
2406,"System Services","Xbox Live Auth Manager (XblAuthManager) (Service Startup type)",service,XblAuthManager,,,,,,,,,Manual,,Disabled,,=,,Medium,
|
||||
2407,"System Services","Xbox Live Game Save (XblGameSave)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveGameSaveServiceStartupMode,,,,3,,4,,=,,Medium,
|
||||
2408,"System Services","Xbox Live Game Save (XblGameSave) (Service Startup type)",service,XblGameSave,,,,,,,,,Manual,,Disabled,,=,,Medium,
|
||||
2409,"System Services","Xbox Live Networking Service (XboxNetApiSvc)",Registry,,HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc,Start,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices,ConfigureXboxLiveNetworkingServiceStartupMode,,,,3,,4,,=,,Medium,
|
||||
2410,"System Services","Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)",service,XboxNetApiSvc,,,,,,,,,Manual,,Disabled,,=,,Medium,
|
||||
1950,"Microsoft Defender Exploit Guard","Exploit protection: Control flow guard (CFG)",Processmitigation,Cfg.Enable,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1951,"Microsoft Defender Exploit Guard","Exploit protection: Data Execution Prevention (DEP)",Processmitigation,DEP.Enable,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1952,"Microsoft Defender Exploit Guard","Exploit protection: Override Data Execution Prevention (DEP)",Processmitigation,DEP.OverrideDEP,,,,,,,,,False,,False,,=,,Medium,
|
||||
1954,"Microsoft Defender Exploit Guard","Exploit protection: Force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.ForceRelocateImages,,,,,,,,,Off,,ON,,=,,Medium,
|
||||
1955,"Microsoft Defender Exploit Guard","Exploit protection: Override force randomization for images (Mandatory ASLR)",Processmitigation,ASLR.OverrideForceRelocateImages,,,,,,,,,False,,False,,=,,Medium,
|
||||
1956,"Microsoft Defender Exploit Guard","Exploit protection: Randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.BottomUp,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1957,"Microsoft Defender Exploit Guard","Exploit protection: Override randomize memory allocations (Bottom-up ASLR)",Processmitigation,ASLR.OverrideBottomUp,,,,,,,,,False,,False,,=,,Medium,
|
||||
1958,"Microsoft Defender Exploit Guard","Exploit protection: High-entropy ASLR",Processmitigation,ASLR.HighEntropy,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1959,"Microsoft Defender Exploit Guard","Exploit protection: Override high-entropy ASLR",Processmitigation,ASLR.OverrideHighEntropy,,,,,,,,,False,,False,,=,,Medium,
|
||||
1960,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP)",Processmitigation,SEHOP.Enable,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1961,"Microsoft Defender Exploit Guard","Exploit protection: Validate exception chains (SEHOP (Telemetry only)",Processmitigation,SEHOP.TelemetryOnly,,,,,,,,,NOTSET,,OFF,,=,,Medium,
|
||||
1962,"Microsoft Defender Exploit Guard","Exploit protection: Override validate exception chains (SEHOP)",Processmitigation,SEHOP.OverrideSEHOP,,,,,,,,,False,,False,,=,,Medium,
|
||||
1963,"Microsoft Defender Exploit Guard","Exploit protection: Validate heap integrity",Processmitigation,HEAP.TerminateOnError,,,,,,,,,On,,ON,,=,,Medium,
|
||||
1964,"Microsoft Defender Exploit Guard","Exploit protection: Override validate heap integrity",Processmitigation,HEAP.OverrideHEAP,,,,,,,,,False,,False,,=,,Medium,
|
||||
1953,"Microsoft Defender Exploit Guard","Force use of Data Execution Prevention (DEP)",bcdedit,nx,,,,,,,,,OptIn,,AlwaysOn,,=,,Medium,
|
||||
2300,"Windows Firewall",HardeningKitty-Block-TCP-NetBIOS,FirewallRule,"Any|Inbound|Block|TCP|137,138,139||",,,,,,,,,False,,True,,=,,Low,
|
||||
2301,"Windows Firewall",HardeningKitty-Block-TCP-RDP,FirewallRule,Any|Inbound|Block|TCP|3389||,,,,,,,,,False,,True,,=,,Low,
|
||||
2302,"Windows Firewall",HardeningKitty-Block-TCP-RPC,FirewallRule,"Any|Inbound|Block|TCP|135,593||",,,,,,,,,False,,True,,=,,Low,
|
||||
2303,"Windows Firewall",HardeningKitty-Block-TCP-SMB,FirewallRule,Any|Inbound|Block|TCP|445||,,,,,,,,,False,,True,,=,,Low,
|
||||
2304,"Windows Firewall",HardeningKitty-Block-TCP-WinRM,FirewallRule,"Any|Inbound|Block|TCP|5985,5986||",,,,,,,,,False,,True,,=,,Low,
|
||||
2305,"Windows Firewall",HardeningKitty-Block-UDP-NetBIOS,FirewallRule,"Any|Inbound|Block|UDP|137,138,139||",,,,,,,,,False,,True,,=,,Low,
|
||||
2306,"Windows Firewall",HardeningKitty-Block-UDP-RPC,FirewallRule,"Any|Inbound|Block|UDP|135,593||",,,,,,,,,False,,True,,=,,Low,
|
||||
2307,"Windows Firewall",HardeningKitty-Block-calc-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\calc.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2308,"Windows Firewall",HardeningKitty-Block-calc-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\calc.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2309,"Windows Firewall",HardeningKitty-Block-certutil-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\certutil.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2310,"Windows Firewall",HardeningKitty-Block-certutil-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\certutil.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2311,"Windows Firewall",HardeningKitty-Block-conhost-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\conhost.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2312,"Windows Firewall",HardeningKitty-Block-conhost-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\conhost.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2313,"Windows Firewall",HardeningKitty-Block-cscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\cscript.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2314,"Windows Firewall",HardeningKitty-Block-cscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\cscript.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2315,"Windows Firewall",HardeningKitty-Block-mshta-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\mshta.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2316,"Windows Firewall",HardeningKitty-Block-mshta-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\mshta.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2317,"Windows Firewall",HardeningKitty-Block-notepad-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\notepad.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2318,"Windows Firewall",HardeningKitty-Block-notepad-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\notepad.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2319,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\RunScriptHelper.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2320,"Windows Firewall",HardeningKitty-Block-RunScriptHelper-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\RunScriptHelper.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2321,"Windows Firewall",HardeningKitty-Block-wscript-x64,FirewallRule,Any|Outbound|Block|||%SystemRoot%\System32\wscript.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
2322,"Windows Firewall",HardeningKitty-Block-wscript-x86,FirewallRule,Any|Outbound|Block|||%SystemRoot%\Syswow64\wscript.exe|,,,,,,,,,False,,True,,=,,Low,
|
||||
|
Reference in new issue
Block a user