comi-audit-secu/vendor/lists/finding_list_0x6d69636b_machine.csv

1	ID	Category	Name	Method	MethodArgument	RegistryPath	RegistryItem	RegistryPathIntune	RegistryPathDCP	RegistryItemIntune	ClassName	Namespace	Property	DefaultValue	DefaultValueIntune	RecommendedValue	RecommendedValueIntune	Operator	OperatorIntune	Severity	Filter
2	1000	Features	SMBv1 Support	WindowsOptionalFeature	smb1protocol									Disabled		Disabled		contains		High
3	1103	Account Policies	Store passwords using reversible encryption	secedit	System Access\ClearTextPassword									0		0		=		High
4	1101	Account Policies	Account lockout duration	accountpolicy										30		15		>=		Low
5	1100	Account Policies	Account lockout threshold	accountpolicy										Never		10		<=		Low
6	1104	Account Policies	Allow Administrator account lockout	secedit	System Access\AllowAdministratorLockout									1		1		=		Medium
7	1102	Account Policies	Reset account lockout counter	accountpolicy										30		15		>=		Low
8	1200	User Rights Assignment	Access this computer from the network	accesschk	SeNetworkLogonRight									BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;Everyone		BUILTIN\Administrators		=		Medium
9	1201	User Rights Assignment	Allow log on locally	accesschk	SeInteractiveLogonRight									BUILTIN\Backup Operators;BUILTIN\Users;BUILTIN\Administrators;COMPUTERNAME\Guest		BUILTIN\Users;BUILTIN\Administrators		=		Medium
10	1202	User Rights Assignment	Debug programs	accesschk	SeDebugPrivilege									BUILTIN\Administrators				=		Medium
11	1203	User Rights Assignment	Deny access to this computer from the network	accesschk	SeDenyNetworkLogonRight									COMPUTERNAME\Guest		BUILTIN\Guests;NT AUTHORITY\Local account		contains		Medium
12	1204	User Rights Assignment	Deny log on as a batch job	accesschk	SeDenyBatchLogonRight											BUILTIN\Guests		contains		Medium
13	1205	User Rights Assignment	Deny log on as a service	accesschk	SeDenyServiceLogonRight											BUILTIN\Guests		contains		Medium
14	1206	User Rights Assignment	Deny log on through Remote Desktop Services	accesschk	SeDenyRemoteInteractiveLogonRight											BUILTIN\Guests;NT AUTHORITY\Local account		contains		Medium
15	1300	Security Options	Accounts: Block Microsoft accounts	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NoConnectedUser	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	Accounts_BlockMicrosoftAccounts				0		3		=		Low
16	1301	Security Options	Audit: Force audit policy subcategory settings to override audit policy category settings	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	SCENoApplyLegacyAuditPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	Audit_ForceAuditPolicySubcategorySettingsToOverrideAuditPolicyCategorySettings				1		1		=		Low
17	1328	Security Options	Devices: Prevent users from installing printer drivers	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers	AddPrinterDrivers	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters				0		1		=		Medium
18	1302	Security Options	Interactive logon: Do not require CTRL+ALT+DEL	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System	DisableCAD	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	InteractiveLogon_DoNotRequireCTRLALTDEL				1		0		=		Low
19	1303	Security Options	Interactive logon: Don't display last signed-in	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System	DontDisplayLastUserName	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	InteractiveLogon_DoNotDisplayLastSignedIn				0		1		=		Low
20	1304	Security Options	Interactive logon: Don't display username at sign-in	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System	DontDisplayUserName	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	InteractiveLogon_DoNotDisplayUsernameAtSignIn				0		1		=		Low
21	1305	Security Options	Microsoft network client: Digitally sign communications (always)	Registry		HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters	RequireSecuritySignature	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	MicrosoftNetworkClient_DigitallySignCommunicationsAlways				0		1		=		Medium
22	1306	Security Options	Microsoft network client: Digitally sign communications (if server agrees)	Registry		HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters	EnableSecuritySignature	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees				1		1		=		Medium
23	1329	Security Options	Microsoft network client: Send unencrypted password to third-party SMB servers	Registry		HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters	EnablePlainTextPassword	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers				0		0		=		Medium
24	1307	Security Options	Microsoft network server: Digitally sign communications (always)	Registry		HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters	RequireSecuritySignature	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	MicrosoftNetworkServer_DigitallySignCommunicationsAlways				0		1		=		Medium
25	1308	Security Options	Microsoft network server: Digitally sign communications (if client agrees)	Registry		HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters	EnableSecuritySignature	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees				0		1		=		Medium
26	1309	Security Options	Network access: Do not allow anonymous enumeration of SAM accounts	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	RestrictAnonymousSAM	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts				1		1		=		Medium
27	1310	Security Options	Network access: Do not allow anonymous enumeration of SAM accounts and shares	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	RestrictAnonymous	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares				0		1		=		Medium
28	1311	Security Options	Network access: Do not allow storage of passwords and credentials for network authentication	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	DisableDomainCreds	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication				0		1		=		Medium
29	1324	Security Options	Network access: Restrict anonymous access to Named Pipes and Shares	Registry		HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters	RestrictNullSessAccess	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares				1		1		=		Medium
30	1325	Security Options	Network access: Restrict clients allowed to make remote calls to SAM	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	RestrictRemoteSAM	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM						O:BAG:BAD:(A;;RC;;;BA)		=		Medium
31	1312	Security Options	Network security: Allow LocalSystem NULL session fallback	Registry		HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0	allownullsessionfallback	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_AllowLocalSystemNULLSessionFallback				0		0		=		Medium
32	1326	Security Options	Network security: Do not store LAN Manager hash value on next password change	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	NoLMHash	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange				1		1		=		High
33	1313	Security Options	Network security: LAN Manager authentication level	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	LmCompatibilityLevel	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_LANManagerAuthenticationLevel				3		5		=		Medium
34	1330	Security Options	Network security: LDAP client encryption requirements	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\LDAP	LDAPClientConfidentiality							1		1		=		Medium
35	1314	Security Options	Network security: LDAP client signing requirements	Registry		HKLM:\System\CurrentControlSet\Services\LDAP	LDAPClientIntegrity	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_LDAPClientSigningRequirements				1		1		>=		Medium
36	1315	Security Options	Network security: Minimum session security for NTLM SSP based (including secure RPC) clients	Registry		HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0	NTLMMinClientSec	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients				536870912		537395200		=		Medium
37	1316	Security Options	Network security: Minimum session security for NTLM SSP based (including secure RPC) servers	Registry		HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0	NTLMMinServerSec	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers				536870912		537395200		=		Medium
38	1317	Security Options	Network security: Restrict NTLM: Audit Incoming NTLM Traffic	Registry		HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0	AuditReceivingNTLMTraffic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic				0		2		=		Medium
39	1318	Security Options	Network security: Restrict NTLM: Audit NTLM authentication in this domain	Registry		HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters	AuditNTLMInDomain							0		7		=		Medium
40	1319	Security Options	Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers	Registry		HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0	RestrictSendingNTLMTraffic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers				0		1		>=		Medium
41	1320	Security Options	Shutdown: Allow system to be shut down without having to log on	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System	ShutdownWithoutLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn				1		0		=		Medium
42	1321	Security Options	User Account Control: Admin Approval Mode for the Built-in Administrator account	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	FilterAdministratorToken	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	UserAccountControl_UseAdminApprovalMode				0		1		=		Medium
43	1322	Security Options	User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ConsentPromptBehaviorAdmin	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	UserAccountControl_BehaviorOfTheElevationPromptForAdministrators				5		2		=		Medium
44	1323	Security Options	User Account Control: Behavior of the elevation prompt for standard users	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ConsentPromptBehaviorUser	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalPoliciesSecurityOptions	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalPoliciesSecurityOptions	UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers				0		1		<=		Medium
45	1400	Windows Firewall	EnableFirewall (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile	EnableFirewall	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		EnableFirewall				0		1		=		Medium
46	1418	Windows Firewall	EnableFirewall (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	EnableFirewall							1		1		=		Medium
47	1401	Windows Firewall	Inbound Connections (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile	DefaultInboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		DefaultInboundAction				1		1		=		Medium
48	1419	Windows Firewall	Inbound Connections (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	DefaultInboundAction							1		1		=		Medium
49	1402	Windows Firewall	Outbound Connections (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile	DefaultOutboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		DefaultOutboundAction				0		0		=		Medium
50	1420	Windows Firewall	Outbound Connections (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	DefaultOutboundAction							0		0		=		Medium
51	1403	Windows Firewall	Log size limit (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging	LogFileSize	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		LogMaxFileSize				4096		16384		>=		Medium
52	1421	Windows Firewall	Log size limit (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	LogFileSize							4096		16384		>=		Medium
53	1404	Windows Firewall	Log dropped packets (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging	LogDroppedPackets	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		EnableLogDroppedPackets				0		1		=		Medium
54	1422	Windows Firewall	Log dropped packets (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	LogDroppedPackets							0		1		=		Medium
55	1405	Windows Firewall	Log successful connections (Domain Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging	LogSuccessfulConnections	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DomainProfile		EnableLogSuccessConnections				0		1		=		Low
56	1423	Windows Firewall	Log successful connections (Domain Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	LogSuccessfulConnections							0		1		=		Low
57	1406	Windows Firewall	EnableFirewall (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile	EnableFirewall	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		EnableFirewall				0		1		=		Medium
58	1424	Windows Firewall	EnableFirewall (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	EnableFirewall							1		1		=		Medium
59	1407	Windows Firewall	Inbound Connections (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile	DefaultInboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		DefaultInboundAction				1		1		=		Medium
60	1425	Windows Firewall	Inbound Connections (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	DefaultInboundAction							1		1		=		Medium
61	1408	Windows Firewall	Outbound Connections (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile	DefaultOutboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		DefaultOutboundAction				0		0		=		Medium
62	1426	Windows Firewall	Outbound Connections (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	DefaultOutboundAction							0		0		=		Medium
63	1409	Windows Firewall	Log size limit (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging	LogFileSize	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		LogMaxFileSize				4096		16384		>=		Medium
64	1427	Windows Firewall	Log size limit (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	LogFileSize							4096		16384		>=		Medium
65	1410	Windows Firewall	Log dropped packets (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging	LogDroppedPackets	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		EnableLogDroppedPackets				0		1		=		Medium
66	1428	Windows Firewall	Log dropped packets (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	LogDroppedPackets							0		1		=		Medium
67	1411	Windows Firewall	Log successful connections (Private Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging	LogSuccessfulConnections	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\StandardProfile		EnableLogSuccessConnections				0		1		=		Low
68	1429	Windows Firewall	Log successful connections (Private Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	LogSuccessfulConnections							0		1		=		Low
69	1412	Windows Firewall	EnableFirewall (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile	EnableFirewall	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		EnableFirewall				0		1		=		Medium
70	1430	Windows Firewall	EnableFirewall (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	EnableFirewall							1		1		=		Medium
71	1413	Windows Firewall	Inbound Connections (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile	DefaultInboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		DefaultInboundAction				1		1		=		Medium
72	1431	Windows Firewall	Inbound Connections (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	DefaultInboundAction							1		1		=		Medium
73	1414	Windows Firewall	Outbound Connections (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile	DefaultOutboundAction	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		DefaultOutboundAction				0		0		=		Medium
74	1432	Windows Firewall	Outbound Connections (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	DefaultOutboundAction							0		0		=		Medium
75	1415	Windows Firewall	Log size limit (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging	LogFileSize	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		LogMaxFileSize				4096		16384		>=		Medium
76	1433	Windows Firewall	Log size limit (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	LogFileSize							4096		16384		>=		Medium
77	1416	Windows Firewall	Log dropped packets (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging	LogDroppedPackets	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		EnableLogDroppedPackets				0		1		=		Medium
78	1434	Windows Firewall	Log dropped packets (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	LogDroppedPackets							0		1		=		Medium
79	1417	Windows Firewall	Log successful connections (Public Profile, Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging	LogSuccessfulConnections	HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\PublicProfile		EnableLogSuccessConnections				0		1		=		Low
80	1435	Windows Firewall	Log successful connections (Public Profile)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	LogSuccessfulConnections							0		1		=		Low
81	1500	Advanced Audit Policy Configuration	Credential Validation	auditpol	{0CCE923F-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
82	1501	Advanced Audit Policy Configuration	Security Group Management	auditpol	{0CCE9237-69AE-11D9-BED3-505054503030}									Success		Success		contains		Low
83	1502	Advanced Audit Policy Configuration	User Account Management	auditpol	{0CCE9235-69AE-11D9-BED3-505054503030}									Success		Success and Failure		=		Low
84	1503	Advanced Audit Policy Configuration	DPAPI Activity	auditpol	{0CCE922D-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
85	1504	Advanced Audit Policy Configuration	Plug and Play Events	auditpol	{0cce9248-69ae-11d9-bed3-505054503030}									No Auditing		Success		contains		Low
86	1505	Advanced Audit Policy Configuration	Process Creation	auditpol	{0CCE922B-69AE-11D9-BED3-505054503030}									No Auditing		Success		contains		Low
87	1506	Advanced Audit Policy Configuration	Account Lockout	auditpol	{0CCE9217-69AE-11D9-BED3-505054503030}									Success		Failure		contains		Low
88	1507	Advanced Audit Policy Configuration	Group Membership	auditpol	{0cce9249-69ae-11d9-bed3-505054503030}									No Auditing		Success		contains		Low
89	1508	Advanced Audit Policy Configuration	Logon	auditpol	{0CCE9215-69AE-11D9-BED3-505054503030}									Success and Failure		Success and Failure		=		Low
90	1509	Advanced Audit Policy Configuration	Other Logon/Logoff Events	auditpol	{0CCE921C-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
91	1510	Advanced Audit Policy Configuration	Special Logon	auditpol	{0CCE921B-69AE-11D9-BED3-505054503030}									Success		Success		contains		Low
92	1511	Advanced Audit Policy Configuration	Detailed File Share	auditpol	{0CCE9244-69AE-11D9-BED3-505054503030}									No Auditing		Failure		contains		Low
93	1512	Advanced Audit Policy Configuration	File Share	auditpol	{0CCE9224-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
94	1513	Advanced Audit Policy Configuration	Kernel Object	auditpol	{0CCE921F-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
95	1514	Advanced Audit Policy Configuration	Other Object Access Events	auditpol	{0CCE9227-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
96	1515	Advanced Audit Policy Configuration	Removable Storage	auditpol	{0CCE9245-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
97	1516	Advanced Audit Policy Configuration	SAM	auditpol	{0CCE9220-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
98	1517	Advanced Audit Policy Configuration	Audit Policy Change	auditpol	{0CCE922F-69AE-11D9-BED3-505054503030}									Success		Success		contains		Low
99	1518	Advanced Audit Policy Configuration	Authentication Policy Change	auditpol	{0CCE9230-69AE-11D9-BED3-505054503030}									Success		Success		contains		Low
100	1519	Advanced Audit Policy Configuration	MPSSVC Rule-Level Policy Change	auditpol	{0CCE9232-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
101	1520	Advanced Audit Policy Configuration	Other Policy Change Events	auditpol	{0CCE9234-69AE-11D9-BED3-505054503030}									No Auditing		Failure		contains		Low
102	1521	Advanced Audit Policy Configuration	Sensitive Privilege Use	auditpol	{0CCE9228-69AE-11D9-BED3-505054503030}									No Auditing		Success and Failure		=		Low
103	1522	Advanced Audit Policy Configuration	Other System Events	auditpol	{0CCE9214-69AE-11D9-BED3-505054503030}									Success and Failure		Success and Failure		=		Low
104	1523	Advanced Audit Policy Configuration	Security State Change	auditpol	{0CCE9210-69AE-11D9-BED3-505054503030}									Success		Success		contains		Low
105	1524	Advanced Audit Policy Configuration	Security System Extension	auditpol	{0CCE9211-69AE-11D9-BED3-505054503030}									No Auditing		Success		contains		Low
106	1525	Advanced Audit Policy Configuration	System Integrity	auditpol	{0CCE9212-69AE-11D9-BED3-505054503030}									Success and Failure		Success and Failure		=		Low
107	1828	Administrative Templates: Control Panel	Allow Online Tips	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	AllowOnlineTips	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Settings	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings	AllowOnlineTips				1		0		=		Medium
108	1600	Administrative Templates: Control Panel	Personalization: Prevent enabling lock screen camera	Registry		HKLM:\Software\Policies\Microsoft\Windows\Personalization	NoLockScreenCamera	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceLock	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock	PreventLockScreenCamera				0		1		=		Low
109	1829	Administrative Templates: Control Panel	Regional and Language Options: Allow users to enable online speech recognition services	Registry		HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization	AllowInputPersonalization	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy	AllowInputPersonalization				1		0		=		Medium
110	1830	Administrative Templates: Network	DNS Client: Configure NetBIOS settings	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient	EnableNetbios									0		=		Medium
111	1601	Administrative Templates: Network	DNS Client: Turn off multicast name resolution (LLMNR)	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient	EnableMulticast	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DNSClient	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DNSClient	Turn_Off_Multicast				1		0		=		Medium
112	1831	Administrative Templates: Network	Lanman Server: Audit client does not support encryption	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	AuditClientDoesNotSupportEncryption							0		1		=		Medium
113	1832	Administrative Templates: Network	Lanman Server: Audit client does not support signing	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	AuditClientDoesNotSupportSigning							0		1		=		Medium
114	1833	Administrative Templates: Network	Lanman Server: Audit insecure guest logon	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	AuditInsecureGuestLogon							0		1		=		Medium
115	1834	Administrative Templates: Network	Lanman Server: Enable authentication rate limiter	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	EnableAuthRateLimiter							1		1		=		Medium
116	1835	Administrative Templates: Network	Lanman Server: Enable remote mailslots	Registry		HKLM:\Software\Policies\Microsoft\Windows\Bowser	EnableMailslots							1		0		=		Medium
117	1836	Administrative Templates: Network	Lanman Server: Mandate the minimum version of SMB	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	MinSmb2Dialect									785		=		Medium
118	1837	Administrative Templates: Network	Lanman Server: Set authentication rate limiter delay (milliseconds)	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanServer	InvalidAuthenticationDelayTimeInMs									2000		>=		Medium
119	1838	Administrative Templates: Network	Lanman Workstation: Audit insecure guest logon	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	AuditInsecureGuestLogon							0		1		=		Medium
120	1839	Administrative Templates: Network	Lanman Workstation: Audit server does not support encryption	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	AuditServerDoesNotSupportEncryption							0		1		=		Medium
121	1840	Administrative Templates: Network	Lanman Workstation: Audit server does not support signing	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	AuditServerDoesNotSupportSigning							0		1		=		Medium
122	1602	Administrative Templates: Network	Lanman Workstation: Enable insecure guest logons	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	AllowInsecureGuestAuth	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LanmanWorkstation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LanmanWorkstation	EnableInsecureGuestLogons				1		0		=		Medium
123	1841	Administrative Templates: Network	Lanman Workstation: Enable remote mailslots	Registry		HKLM:\Software\Policies\Microsoft\Windows\NetworkProvider	EnableMailslots							1		0		=		Medium
124	1842	Administrative Templates: Network	Lanman Workstation: Mandate the minimum version of SMB	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	MinSmb2Dialect									785		=		Medium
125	1843	Administrative Templates: Network	Lanman Workstation: Require Encryption	Registry		HKLM:\Software\Policies\Microsoft\Windows\LanmanWorkstation	RequireEncryption							0		1		=		Medium
126	1604	Administrative Templates: Network	WLAN Service: WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services	Registry		HKLM:\Software\Microsoft\wcmsvc\wifinetworkmanager\config	AutoConnectAllowedOEM	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Wifi	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Wifi	AllowAutoConnectToWiFiSenseHotspots				1		0		=		Medium
127	2108	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging	EnableModuleLogging							0		1		=		Low
128	2109	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging (PowerShell Policy)	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging	UseWindowsPowerShellPolicySetting							0		1		=		Low
129	2110	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging - Module Names	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames	*									*		=		Low
130	2111	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	EnableScriptBlockLogging							0		1		=		Medium
131	2112	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging (Invocation)	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	EnableScriptBlockInvocationLogging							0		1		=		Low
132	2113	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging (PowerShell Policy)	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	UseWindowsPowerShellPolicySetting							0		1		=		Low
133	2116	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription	EnableTranscripting							0		1		=		Low
134	2114	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription (Invocation)	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription	EnableInvocationHeader							0		1		=		Low
135	2115	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription (PowerShell Policy)	Registry		HKLM:\Software\Policies\Microsoft\PowerShellCore\Transcription	UseWindowsPowerShellPolicySetting							0		1		=		Low
136	1844	Administrative Templates: Printers	Allow Print Spooler to accept client connections	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers	RegisterSpoolerRemoteRpcEndPoint	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Printing2	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Printing2	RegisterSpoolerRemoteRpcEndPoint				1		2		=		Medium
137	1772	Administrative Templates: Printers	Configure Redirection Guard	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers	RedirectionGuardPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRedirectionGuardPolicy						1		=		Medium
138	1845	Administrative Templates: Printers	Configure RPC connection settings (RpcUseNamedPipeProtocol)	Registry	RpcConnectionProtocol_Enum	HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC	RpcUseNamedPipeProtocol	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcConnectionPolicy						0		=		Medium
139	1846	Administrative Templates: Printers	Configure RPC connection settings (RpcAuthentication)	Registry	RpcConnectionAuthentication_Enum	HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC	RpcAuthentication	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcConnectionPolicy						0		=		Medium
140	1847	Administrative Templates: Printers	Configure RPC listener settings (RpcProtocols)	Registry	RpcListenerProtocols_Enum	HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC	RpcProtocols	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcListenerPolicy						5		=		Medium
141	1848	Administrative Templates: Printers	Configure RPC listener settings (ForceKerberosForRpc)	Registry	RpcAuthenticationProtocol_Enum	HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC	ForceKerberosForRpc	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcListenerPolicy						0		>=		Medium
142	1849	Administrative Templates: Printers	Configure RPC over TCP port	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers\RPC	RpcTcpPort	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcTcpPort						0		=		Medium
143	1850	Administrative Templates: Printers	Configure RPC packet level privacy setting for incoming connections	Registry		HKLM:\System\CurrentControlSet\Control\Print	RpcAuthnLevelPrivacyEnabled	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureRpcAuthnLevelPrivacyEnabled						1		=		Medium
144	1851	Administrative Templates: Printers	Configure Windows protected print	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers\WPP	WindowsProtectedPrintGroupPolicyState	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureWindowsProtectedPrint				0		1		=		Medium
145	1852	Administrative Templates: Printers	Limits print driver installation to Administrators	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint	RestrictDriverInstallationToAdministrators	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	RestrictDriverInstallationToAdministrators						1		=		Medium
146	1853	Administrative Templates: Printers	Manage processing of Queue-specific files	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers	CopyFilesPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	ConfigureCopyFilesPolicy						1		=		Medium
147	1768	Administrative Templates: Printers	Only use Package Point and Print (CVE-2021-36958)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint	PackagePointAndPrintOnly									1		=		Medium
148	1769	Administrative Templates: Printers	Package Point and Print - Approved servers (CVE-2021-36958)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint	PackagePointAndPrintServerList									1		=		Medium
149	1764	Administrative Templates: Printers	Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527)	Registry	PointAndPrint_NoWarningNoElevationOnInstall_Enum	HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint	NoWarningNoElevationOnInstall	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	PointAndPrintRestrictions				0		0		=		High
150	1765	Administrative Templates: Printers	Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527)	Registry	PointAndPrint_NoWarningNoElevationOnUpdate_Enum	HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint	UpdatePromptSettings	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Printers	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Printers	PointAndPrintRestrictions				0		0		=		High
151	1771	Administrative Templates: Start Menu and Taskbar	Notifications: Turn off notifications network usage	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications	NoCloudApplicationNotification	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Notifications	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Notifications	DisallowCloudNotification				0		1		=		Medium
152	1854	Administrative Templates: Start Menu and Taskbar	Remove Personalized Website Recommendations from the Recommended section in the Start Menu	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer	HideRecommendedPersonalizedSites	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start	HideRecommendedPersonalizedSites				0		1		=		Medium
153	1855	Administrative Templates: System	Configure the behavior of the sudo command	Registry		HKLM:\Software\Policies\Microsoft\Windows\Sudo	Enabled	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Sudo	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Sudo	EnableSudo						0		=		Medium
154	1856	Administrative Templates: System	Audit Process Creation: Include command line in process creation events	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	ProcessCreationIncludeCmdLine_Enabled							0		1		=		Medium
155	1605	Administrative Templates: System	Credentials Delegation: Allow delegation default credentials	Registry		HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation	AllowDefaultCredentials	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp	AllowDefaultCredentials				1		0		=		Medium
156	1606	Administrative Templates: System	Credentials Delegation: Encryption Oracle Remediation	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters	AllowEncryptionOracle	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_CredSsp	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_CredSsp	AllowEncryptionOracle				0		0		=		Medium
157	1699	Administrative Templates: System	Credentials Delegation: Remote host allows delegation of non-exportable credentials	Registry		HKLM:\Software\Policies\Microsoft\Windows\CredentialsDelegation	AllowProtectedCreds	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsDelegation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsDelegation	RemoteHostAllowsDelegationOfNonExportableCredentials				0		1		=		Medium
158	1614	Administrative Templates: System	Device Guard: Virtualization Based Security Status	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	VirtualizationBasedSecurityStatus	Not available		2		=		Medium
159	1615	Administrative Templates: System	Device Guard: Available Security Properties: Secure Boot	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	AvailableSecurityProperties	2		2		=		Medium
160	1616	Administrative Templates: System	Device Guard: Available Security Properties: DMA protection	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	AvailableSecurityProperties	3		3		=		Medium
161	1617	Administrative Templates: System	Device Guard: Security Services Configured: Credential Guard	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	SecurityServicesConfigured	Not available		1		=		Medium
162	1619	Administrative Templates: System	Device Guard: Security Services Running: Credential Guard	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	SecurityServicesRunning	Not available		1		=		Medium
163	1618	Administrative Templates: System	Device Guard: Security Services Configured: HVCI	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	SecurityServicesConfigured	Not available		2		=		Medium
164	1620	Administrative Templates: System	Device Guard: Security Services Running: HVCI	CimInstance							Win32_DeviceGuard	root\Microsoft\Windows\DeviceGuard	SecurityServicesRunning	Not available		2		=		Medium
165	1623	Administrative Templates: System	Device Guard: Require UEFI Memory Attributes Table (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard	HVCIMATRequired									1		=		Medium
166	1621	Administrative Templates: System	Device Guard: Secure Launch Configuration (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard	ConfigureSystemGuardLaunch	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceGuard	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceGuard	ConfigureSystemGuardLaunch				0		1		=		Medium
167	1622	Administrative Templates: System	Device Guard: Windows Defender Application Control deployed (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard	DeployConfigCIPolicy							0		1		=		Medium
168	1607	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID	Registry		HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions	DenyDeviceIDs	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceIDs				0		1		=		Medium
169	1608	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive)	Registry		HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions	DenyDeviceIDsRetroactive	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceIDs				0		1		=		Medium
170	1609	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire)	RegistryList		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs	PCI\CC_0C0010	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceIDs				0		PCI\CC_0C0010		=		Medium
171	1610	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt)	RegistryList		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs	PCI\CC_0C0A	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceIDs				0		PCI\CC_0C0A		=		Medium
172	1611	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class	Registry		HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions	DenyDeviceClasses	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceSetupClasses				0		1		=		Medium
173	1612	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive)	Registry		HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions	DenyDeviceClassesRetroactive	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceSetupClasses				0		1		=		Medium
174	1613	Administrative Templates: System	Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive)	RegistryList		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses	d48179be-ec20-11d1-b6b8-00c04fa372a7	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeviceInstallation	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceInstallation	PreventInstallationOfMatchingDeviceSetupClasses				0		d48179be-ec20-11d1-b6b8-00c04fa372a7		=		Medium
175	1630	Administrative Templates: System	Early Launch Antimalware: Boot-Start Driver Initialization Policy	Registry		HKLM:\System\CurrentControlSet\Policies\EarlyLaunch	DriverLoadPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	BootStartDriverInitialization				0		3		=		Medium
176	1631	Administrative Templates: System	Group Policy: Process even if the Group Policy objects have not changed	Registry	CSE_NOCHANGES10	HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}	NoBackgroundPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy	CSE_Registry				1		0		=		Low
177	1632	Administrative Templates: System	Group Policy: Do not apply during periodic background processing	Registry	CSE_NOBACKGROUND10	HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}	NoGPOListChanges	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_GroupPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_GroupPolicy	CSE_Registry				0		0		=		Low
178	1640	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program	Registry		HKLM:\Software\Policies\Microsoft\Messenger\Client	CEIP	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM	WinMSG_NoInstrumentation_1				0		2		=		Medium
179	1641	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Printers	DisableWebPnPDownload	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity	DisableDownloadingOfPrintDriversOverHTTP				0		1		=		Medium
180	1642	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1	Registry		HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting	DoReport	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting	DisableWindowsErrorReporting				1		0		=		Medium
181	1643	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2	Registry		HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting	Disabled	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ErrorReporting	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ErrorReporting	DisableWindowsErrorReporting				0		1		=		Medium
182	1644	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoWebServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Connectivity	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity	DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards				0		1		=		Medium
183	1645	Administrative Templates: System	Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program	Registry		HKLM:\Software\Policies\Microsoft\SQMClient\Windows	CEIPEnable	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_ICM	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_ICM	CEIPEnable				1		0		=		Medium
184	1650	Administrative Templates: System	Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection	DeviceEnumerationPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DmaGuard	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DmaGuard	DeviceEnumerationPolicy				2		0		=		Medium
185	1857	Administrative Templates: System	Local Security Authority: Allow Custom SSPs and APs to be loaded into LSASS	Registry		HKLM:\Software\Policies\Microsoft\Windows\System	AllowCustomSSPsAPs	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority	AllowCustomSSPsAPs						0		=		Medium
186	1858	Administrative Templates: System	Local Security Authority: Configures LSASS to run as a protected process	Registry		HKLM:\System\CurrentControlSet\Control\Lsa	RunAsPPL	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\LocalSecurityAuthority	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\LocalSecurityAuthority	ConfigureLsaProtectedProcess						2		=		Medium
187	1660	Administrative Templates: System	Logon: Turn on convenience PIN sign-in	Registry		HKLM:\Software\Policies\Microsoft\Windows\System	AllowDomainPINLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialProviders	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialProviders	AllowPINLogon				1		0		=		Medium
188	1661	Administrative Templates: System	Logon: Turn off app notifications on the lock screen	Registry		HKLM:\Software\Policies\Microsoft\Windows\System	DisableLockScreenAppNotifications	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon	DisableLockScreenAppNotifications				0		1		=		Medium
189	1662	Administrative Templates: System	Logon: Do not display network selection UI	Registry		HKLM:\Software\Policies\Microsoft\Windows\System	DontDisplayNetworkSelectionUI	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon	DontDisplayNetworkSelectionUI				0		1		=		Medium
190	1670	Administrative Templates: System	Mitigation Options: Untrusted Font Blocking	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions	MitigationOptions_FontBocking							0		1000000000000		=		Medium
191	1680	Administrative Templates: System	OS Policies: Allow Clipboard synchronization across devices	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\System	AllowCrossDeviceClipboard	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy	AllowCrossDeviceClipboard				1		0		=		Medium
192	1859	Administrative Templates: System	OS Policies: Allow upload of User Activities	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\System	UploadUserActivities	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy	UploadUserActivities				1		0		=		Medium
193	1685	Administrative Templates: System	Sleep Settings: Require a password when a computer wakes (plugged in)	Registry		HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51	ACSettingIndex	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power	RequirePasswordWhenComputerWakesPluggedIn				0		1		=		Medium
194	1686	Administrative Templates: System	Sleep Settings: Require a password when a computer wakes (on battery)	Registry		HKLM:\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51	DCSettingIndex	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power	RequirePasswordWhenComputerWakesOnBattery				0		1		=		Medium
195	1687	Administrative Templates: System	Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in)	Registry		HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab	ACSettingIndex	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power	AllowStandbyWhenSleepingPluggedIn				1		0		=		Medium
196	1688	Administrative Templates: System	Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery)	Registry		HKLM:\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab	DCSettingIndex	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Power	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Power	AllowStandbyStatesWhenSleepingOnBattery				1		0		=		Medium
197	1690	Administrative Templates: System	Remote Assistance: Configure Offer Remote Assistance	Registry		HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services	fAllowUnsolicited	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance	UnsolicitedRemoteAssistance				1		0		=		Medium
198	1691	Administrative Templates: System	Remote Assistance: Configure Solicited Remote Assistance	Registry		HKLM:\Software\policies\Microsoft\Windows NT\Terminal Services	fAllowToGetHelp	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteAssistance	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteAssistance	SolicitedRemoteAssistance				1		0		=		Medium
199	1692	Administrative Templates: System	Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Rpc	EnableAuthEpResolution	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall	RPCEndpointMapperClientAuthentication				0		1		=		Medium
200	1693	Administrative Templates: System	Remote Procedure Call: Restrict Unauthenticated RPC clients	Registry		HKLM:\Software\Policies\Microsoft\Windows NT\Rpc	RestrictRemoteClients	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteProcedureCall	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteProcedureCall	RestrictUnauthenticatedRPCClients				0		2		=		Medium
201	1694	Administrative Templates: System	Security Settings: Enable svchost.exe mitigation options	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig	EnableSvchostMitigationPolicy							0		1		=		Medium
202	1696	Administrative Templates: System	User Profiles: Turn off the advertising ID	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo	DisabledByGroupPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy	DisableAdvertisingID				0		1		=		Medium
203	1697	Administrative Templates: System	Time Providers: Enable Windows NTP Client	Registry		HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient	Enabled	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time	W32TIME_POLICY_ENABLE_NTPCLIENT				0		1		=		Medium
204	1698	Administrative Templates: System	Time Providers: Enable Windows NTP Server	Registry		HKLM:\Software\Policies\Microsoft\W32time\TimeProviders\NtpServer	Enabled	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_W32Time	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_W32Time	W32TIME_POLICY_ENABLE_NTPSERVER				0		0		=		Medium
205	1860	Administrative Templates: Windows Components	App and Device Inventory: Turn off API Sampling	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat	DisableAPISamping	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory	TurnOffAPISamping				0		1		=		Medium
206	1861	Administrative Templates: Windows Components	App and Device Inventory: Turn off Application Footprint	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat	DisableApplicationFootprint	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory	TurnOffApplicationFootprint				0		1		=		Medium
207	1862	Administrative Templates: Windows Components	App and Device Inventory: Turn off Install Tracing	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat	DisableInstallTracing	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AppDeviceInventory	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AppDeviceInventory	TurnOffInstallTracing				0		1		=		Medium
208	1700	Administrative Templates: Windows Components	App Package Deployment: Allow a Windows app to share application data between users	Registry		HKLM:\Software\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager	AllowSharedLocalAppData	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement	AllowSharedUserAppData				1		0		=		Medium
209	1701	Administrative Templates: Windows Components	App Privacy: Let Windows apps activate with voice while the system is locked	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy	LetAppsActivateWithVoiceAboveLock	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Privacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Privacy	LetAppsActivateWithVoiceAboveLock				0		2		=		Medium
210	1702	Administrative Templates: Windows Components	App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	BlockHostedAppAccessWinRT							0		1		=		Medium
211	1703	Administrative Templates: Windows Components	Application Compatibility: Turn off Application Telemetry	Registry		HKLM:\Software\Policies\Microsoft\Windows\AppCompat	AITEnable							1		0		=		Medium
212	1704	Administrative Templates: Windows Components	AutoPlay Policies: Turn off Autoplay	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoDriveTypeAutoRun	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay	TurnOffAutoPlay				0		255		=		Medium
213	1705	Administrative Templates: Windows Components	AutoPlay Policies: Disallow Autoplay for non-volume devices	Registry		HKLM:\Software\Policies\Microsoft\Windows\Explorer	NoAutoplayfornonVolume	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay	DisallowAutoplayForNonVolumeDevices				0		1		=		Medium
214	1706	Administrative Templates: Windows Components	AutoPlay Policies: Set the default behavior for AutoRun	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoAutorun	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Autoplay	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Autoplay	SetDefaultAutoRunBehavior				0		1		=		Medium
215	1707	Administrative Templates: Windows Components	Biometrics: Allow the use of biometrics	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Biometrics	Enabled							1		0		=		Medium
216	1773	Administrative Templates: Windows Components	Biometrics: Facial Features: Configure enhanced anti-spoofing	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures	EnhancedAntiSpoofing									1		=		Medium
217	1708	Administrative Templates: Windows Components	BitLocker Drive Encryption: Volume status	BitLockerVolume	VolumeStatus									FullyDecrypted		FullyEncrypted		=		High
218	1761	Administrative Templates: Windows Components	BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives)	Registry		HKLM:\Software\Policies\Microsoft\FVE	EncryptionMethodWithXtsOs	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	EncryptionMethodByDriveType				6		6		=		Medium
219	1762	Administrative Templates: Windows Components	BitLocker Drive Encryption: Drive encryption method (for operating system drives)	BitLockerVolume	EncryptionMethod									None		XtsAes128		=		Medium
220	1709	Administrative Templates: Windows Components	BitLocker Drive Encryption: Disable new DMA devices when this computer is locked	Registry		HKLM:\Software\Policies\Microsoft\FVE	DisableExternalDMAUnderLock							0		1		=		Medium
221	1710	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation	Registry		HKLM:\Software\Policies\Microsoft\FVE	OSAllowSecureBootForIntegrity							0		1		=		Medium
222	1711	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseAdvancedStartup	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				0		1		=		Medium
223	1715	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM	Registry		HKLM:\Software\Policies\Microsoft\FVE	EnableBDEWithNoTPM	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				1		0		=		Medium
224	1716	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseTPM	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				0		0		=		Medium
225	1717	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseTPMPIN	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				0		1		=		Medium
226	1718	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseTPMKey	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				0		0		=		Medium
227	1719	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseTPMKeyPIN	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesRequireStartupAuthentication				0		0		=		Medium
228	1712	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup	Registry		HKLM:\Software\Policies\Microsoft\FVE	UseEnhancedPin	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	EnhancedPIN_Name				0		1		=		Medium
229	1713	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives	Registry		HKLM:\Software\Policies\Microsoft\FVE	OSHardwareEncryption							0		0		=		Medium
230	1763	Administrative Templates: Windows Components	BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup	Registry		HKLM:\Software\Policies\Microsoft\FVE	MinimumPIN	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\BitLocker	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker	SystemDrivesMinimumPINLength						8		>=		Medium
231	1720	Administrative Templates: Windows Components	Cloud Content: Do not show Windows tips	Registry		HKLM:\Software\Policies\Microsoft\Windows\CloudContent	DisableSoftLanding							0		1		=		Medium
232	1863	Administrative Templates: Windows Components	Cloud Content: Turn off cloud consumer account state content	Registry		HKLM:\Software\Policies\Microsoft\Windows\CloudContent	DisableConsumerAccountStateContent	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience	DisableConsumerAccountStateContent						1		=		Medium
233	1721	Administrative Templates: Windows Components	Cloud Content: Turn off Microsoft consumer experiences	Registry		HKLM:\Software\Policies\Microsoft\Windows\CloudContent	DisableWindowsConsumerFeatures	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience	AllowWindowsConsumerFeatures				0		1		=		Medium
234	1722	Administrative Templates: Windows Components	Credential User Interface: Do not display the password reveal button	Registry		HKLM:\Software\Policies\Microsoft\Windows\CredUI	DisablePasswordReveal	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI	DisablePasswordReveal				0		1		=		Medium
235	1724	Administrative Templates: Windows Components	Credential User Interface: Enumerate administrator accounts on elevation	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI	EnumerateAdministrators	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\CredentialsUI	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\CredentialsUI	EnumerateAdministrators				1		0		=		Medium
236	1864	Administrative Templates: Windows Components	Credential User Interface: Prevent the use of security questions for local accounts	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\System	NoLocalPasswordResetQuestions							0		1		=		Medium
237	1725	Administrative Templates: Windows Components	Data Collection and Preview Builds: Allow Diagnostic Data	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	AllowTelemetry	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	AllowTelemetry				2		1		<=		Medium
238	1726	Administrative Templates: Windows Components	Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	AllowDeviceNameInTelemetry							1		0		=		Medium
239	1865	Administrative Templates: Windows Components	Data Collection and Preview Builds: Disable OneSettings Downloads	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	DisableOneSettingsDownloads	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	DisableOneSettingsDownloads						1		=		Medium
240	1866	Administrative Templates: Windows Components	Data Collection and Preview Builds: Do not show feedback notifications	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	DoNotShowFeedbackNotifications	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience	DoNotShowFeedbackNotifications				0		1		=		Medium
241	1867	Administrative Templates: Windows Components	Data Collection and Preview Builds: Limit Diagnostic Log Collection	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	LimitDiagnosticLogCollection	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	LimitDiagnosticLogCollection						1		=		Medium
242	1868	Administrative Templates: Windows Components	Data Collection and Preview Builds: Limit Dump Collection	Registry		HKLM:\Software\Policies\Microsoft\Windows\DataCollection	LimitDumpCollection	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	LimitDumpCollection						1		=		Medium
243	1727	Administrative Templates: Windows Components	Delivery Optimization: Download Mode	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization	DODownloadMode	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\DeliveryOptimization	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\DeliveryOptimization	DODownloadMode				1		99		=		Medium
244	1728	Administrative Templates: Windows Components	Event Log Service: Application: Specify the maximum log file size (KB)	Registry	Channel_LogMaxSize	HKLM:\Software\Policies\Microsoft\Windows\EventLog\Application	MaxSize	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService	SpecifyMaximumFileSizeApplicationLog				4096		32768		>=		Medium
245	1729	Administrative Templates: Windows Components	Event Log Service: Security: Specify the maximum log file size (KB)	Registry	Channel_LogMaxSize	HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security	MaxSize	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService	SpecifyMaximumFileSizeSecurityLog				4096		196608		>=		Medium
246	1730	Administrative Templates: Windows Components	Event Log Service: System: Specify the maximum log file size (KB)	Registry	Channel_LogMaxSize	HKLM:\Software\Policies\Microsoft\Windows\EventLog\System	MaxSize	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\EventLogService	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\EventLogService	SpecifyMaximumFileSizeSystemLog				4096		32768		>=		Medium
247	1774	Administrative Templates: Windows Components	Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB)	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PowerShell/Operational	MaxSize							15728640		268435456		>=		Medium
248	1775	Administrative Templates: Windows Components	Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB)	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\PowerShellCore/Operational	MaxSize							15728640		268435456		>=		Medium
249	1731	Administrative Templates: Windows Components	File Explorer: Allow the use of remote paths in file shortcut icons	Registry		HKLM:\Software\Policies\Microsoft\Windows\Explorer	EnableShellShortcutIconRemotePath	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_WindowsExplorer	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_WindowsExplorer	EnableShellShortcutIconRemotePath				0		0		=		Medium
250	1869	Administrative Templates: Windows Components	File Explorer: Turn off account-based insights, recent, favorite, and recommended files in File Explorer	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer	DisableGraphRecentItems	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\FileExplorer	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\FileExplorer	DisableGraphRecentItems						1		=		Medium
251	1732	Administrative Templates: Windows Components	HomeGroup: Prevent the computer from joining a homegroup	Registry		HKLM:\Software\Policies\Microsoft\Windows\HomeGroup	DisableHomeGroup	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_Sharing	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_Sharing	DisableHomeGroup				0		1		=		Medium
252	1870	Administrative Templates: Windows Components	Internet Explorer: Disable Internet Explorer 11 Launch Via COM Automation	Registry		HKLM:\Software\Policies\Microsoft\Internet Explorer\Main	DisableInternetExplorerLaunchViaCOM									1		=		Medium
253	1874	Administrative Templates: Windows Components	Location and Sensors: Turn off location	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors	DisableLocation	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	AllowLocation				0		1		=		Medium
254	1800	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Turn off Microsoft Defender Antivirus	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender	DisableAntiSpyware							0		0		=		Medium
255	1826	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Enable Tamper Protection (Status)	MpComputerStatus	IsTamperProtected											True		=		Medium
256	1801	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Configure detection for potentially unwanted applications	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender	PUAProtection	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	PUAProtection				0		1		>=		Medium
257	1806	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Extension Exclusions (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Exclusions_Extensions	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	Exclusions_Extensions								=		Medium
258	1807	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Extension Exclusions	MpPreferenceExclusion	ExclusionExtension													=		Medium
259	1808	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Path Exclusions (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Exclusions_Paths	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	Exclusions_Paths								=		Medium
260	1809	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Path Exclusions	MpPreferenceExclusion	ExclusionPath													=		Medium
261	1810	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Process Exclusions (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Exclusions_Processes	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	Exclusions_Processes								=		Medium
262	1811	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Exclusions: Process Exclusions	MpPreferenceExclusion	ExclusionProcess													=		Medium
263	1816	Administrative Templates: Windows Components	Microsoft Defender Antivirus: MAPS: Join Microsoft MAPS	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet	SpynetReporting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	SpynetReporting				0		2		=		Medium
264	1817	Administrative Templates: Windows Components	Microsoft Defender Antivirus: MAPS: Configure the 'Block at First Sight' feature	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet	DisableBlockAtFirstSeen	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	DisableBlockAtFirstSeen						0		=		Medium
265	1818	Administrative Templates: Windows Components	Microsoft Defender Antivirus: MAPS: Send file samples when further analysis is required	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet	SubmitSamplesConsent	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	SubmitSamplesConsent						2		=		Medium
266	1819	Administrative Templates: Windows Components	Microsoft Defender Antivirus: MpEngine: Enable file hash computation feature	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine	EnableFileHashComputation	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	EnableFileHashComputation						1		=		Medium
267	1820	Administrative Templates: Windows Components	Microsoft Defender Antivirus: MpEngine: Select cloud protection level	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine	MpCloudBlockLevel	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	MpEngine_MpCloudBlockLevel				0		2		>=		Medium
268	1821	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Real-time Protection: Scan all downloaded files and attachments	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	DisableIOAVProtection	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	RealtimeProtection_DisableIOAVProtection				0		0		=		Medium
269	1822	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Real-time Protection: Turn off real-time protection	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	DisableRealtimeMonitoring	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AllowRealtimeMonitoring				0		0		=		Medium
270	1823	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Real-time Protection: Turn on behavior monitoring (Policy)	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	DisableBehaviorMonitoring	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AllowBehaviorMonitoring				0		0		=		Medium
271	1824	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Real-time Protection: Turn on script scanning	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	DisableScriptScanning	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AllowScriptScanning				0		0		=		Medium
272	1825	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Scan: Scan removable drives	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Scan	DisableRemovableDriveScanning	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	Scan_DisableRemovableDriveScanning				1		0		=		Medium
273	1812	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Enable sandboxing for Microsoft Defender Antivirus	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment	MP_FORCE_USE_SANDBOX							0		1		=		Medium
274	1900	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Attack Surface Reduction rules	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR	ExploitGuard_ASR_Rules	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
275	1901	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	be9ba2d9-53ea-4cdc-84e5-9b1eeee46550	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
276	1916	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable content from email client and webmail	MpPreferenceAsr	be9ba2d9-53ea-4cdc-84e5-9b1eeee46550									0		1		=		Medium
277	1902	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	d4f940ab-401b-4efc-aadc-ad5f3c50688a	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
278	1917	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block all Office applications from creating child processes	MpPreferenceAsr	d4f940ab-401b-4efc-aadc-ad5f3c50688a									0		1		=		Medium
279	1903	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	3b576869-a4ec-4529-8536-b80a7769e899	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
280	1918	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from creating executable content	MpPreferenceAsr	3b576869-a4ec-4529-8536-b80a7769e899									0		1		=		Medium
281	1904	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
282	1919	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office applications from injecting code into other processes	MpPreferenceAsr	75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84									0		1		=		Medium
283	1905	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	d3e037e1-3eb8-44c8-a917-57927947596d	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
284	1920	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block JavaScript or VBScript from launching downloaded executable content	MpPreferenceAsr	d3e037e1-3eb8-44c8-a917-57927947596d									0		1		=		Medium
285	1906	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	5beb7efe-fd9a-4556-801d-275e5ffc04cc	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
286	1921	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block execution of potentially obfuscated scripts	MpPreferenceAsr	5beb7efe-fd9a-4556-801d-275e5ffc04cc									0		1		=		Medium
287	1907	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
288	1922	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Win32 API calls from Office macros	MpPreferenceAsr	92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b									0		1		=		Medium
289	1908	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	01443614-cd74-433a-b99e-2ecdc07bfc25	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		2		=		Medium
290	1923	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion	MpPreferenceAsr	01443614-cd74-433a-b99e-2ecdc07bfc25									0		2		=		Medium
291	1909	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	c1db55ab-c21a-4637-bb3f-a12568109d35	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
292	1924	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Use advanced protection against ransomware	MpPreferenceAsr	c1db55ab-c21a-4637-bb3f-a12568109d35									0		1		=		Medium
293	1910	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
294	1925	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe)	MpPreferenceAsr	9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2									0		1		=		Medium
295	1911	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	d1e49aac-8f56-4280-b9ba-993a6d77406c	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
296	1926	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block process creations originating from PSExec and WMI commands	MpPreferenceAsr	d1e49aac-8f56-4280-b9ba-993a6d77406c									0		1		=		Medium
297	1912	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
298	1927	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block untrusted and unsigned processes that run from USB	MpPreferenceAsr	b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4									0		1		=		Medium
299	1913	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	26190899-1602-49e8-8b27-eb1d0a1ce869	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
300	1928	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Office communication application from creating child processes	MpPreferenceAsr	26190899-1602-49e8-8b27-eb1d0a1ce869									0		1		=		Medium
301	1914	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
302	1929	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block Adobe Reader from creating child processes	MpPreferenceAsr	7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c									0		1		=		Medium
303	1915	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	e6db77e5-3df2-4cf1-b95a-636979351e5b	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
304	1930	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block persistence through WMI event subscription	MpPreferenceAsr	e6db77e5-3df2-4cf1-b95a-636979351e5b									0		1		=		Medium
305	1931	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	56a863a9-875e-4185-98a7-b882c64b5ce5	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
306	1932	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block abuse of exploited vulnerable signed drivers	MpPreferenceAsr	56a863a9-875e-4185-98a7-b882c64b5ce5									0		1		=		Medium
307	1933	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	33ddedf1-c6e0-47cb-833e-de6133960387	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
308	1934	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block rebooting machine in Safe Mode	MpPreferenceAsr	33ddedf1-c6e0-47cb-833e-de6133960387									0		1		=		Medium
309	1935	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\rules	c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	AttackSurfaceReductionRules				0		1		=		Medium
310	1936	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Block use of copied or impersonated system tools	MpPreferenceAsr	c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb									0		1		=		Medium
311	1966	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy)	Registry		HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR	ExploitGuard_ASR_ASROnlyExclusions	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MicrosoftDefenderAntivirus	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MicrosoftDefenderAntivirus	ExploitGuard_ASR_ASROnlyExclusions				0		0		=		Medium
312	1967	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: ASR: Exclude files and paths from Attack Surface Reduction Rules	MpPreferenceExclusion	AttackSurfaceReductionOnlyExclusions													=|0		Medium
313	1965	Administrative Templates: Windows Components	Microsoft Defender Antivirus: Microsoft Defender Exploit Guard: Network Protection: Prevent users and apps from accessing dangerous websites	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection	EnableNetworkProtection	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Defender	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender	EnableNetworkProtection						1		=		Medium
314	1733	Administrative Templates: Windows Components	OneDrive: Prevent the usage of OneDrive for file storage	Registry		HKLM:\Software\Policies\Microsoft\Windows\OneDrive	DisableFileSyncNGSC	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\System	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\System	DisableOneDriveFileSync				0		1		=		Medium
315	1734	Administrative Templates: Windows Components	Remote Desktop Connection Client: Do not allow passwords to be saved	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	DisablePasswordSaving	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	DoNotAllowPasswordSaving				0		1		=		Medium
316	1871	Administrative Templates: Windows Components	Remote Desktop Connection Client: Disable Cloud Clipboard integration for server-to-client data transfer	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client	DisableCloudClipboardIntegration									1		=		Medium
317	1735	Administrative Templates: Windows Components	Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	fDenyTSConnections	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	AllowUsersToConnectRemotely				0		1		=		Medium
318	1736	Administrative Templates: Windows Components	Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	fDisableCdm	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	DoNotAllowDriveRedirection				0		1		=		Medium
319	1872	Administrative Templates: Windows Components	Remote Desktop Session Host: Device and Resource Redirection: Restrict clipboard transfer from server to client	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	SCClipLevel	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	LimitServerToClientClipboardRedirection						0		=		Medium
320	1737	Administrative Templates: Windows Components	Remote Desktop Session Host: Security: Always prompt for password upon connection	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	fPromptForPassword	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	PromptForPasswordUponConnection				0		1		=		Medium
321	1738	Administrative Templates: Windows Components	Remote Desktop Session Host: Security: Require secure RPC communication	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	fEncryptRPCTraffic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	RequireSecureRPCCommunication				0		1		=		Medium
322	1739	Administrative Templates: Windows Components	Remote Desktop Session Host: Security: Set client connection encryption level	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services	MinEncryptionLevel	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteDesktopServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteDesktopServices	ClientConnectionEncryptionLevel				0		3		=		Medium
323	1740	Administrative Templates: Windows Components	Search: Allow Cloud Search	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	AllowCloudSearch	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search	AllowCloudSearch				1		0		=		Medium
324	1741	Administrative Templates: Windows Components	Search: Allow Cortana	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	AllowCortana	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience	AllowCortana				1		0		=		Medium
325	1742	Administrative Templates: Windows Components	Search: Allow Cortana above lock screen	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	AllowCortanaAboveLock	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\AboveLock	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\AboveLock	AllowCortanaAboveLock				1		0		=		Medium
326	1743	Administrative Templates: Windows Components	Search: Allow indexing of encrypted files	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	AllowIndexingEncryptedStoresOrItems	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search	AllowIndexingEncryptedStoresOrItems				1		0		=		Medium
327	1744	Administrative Templates: Windows Components	Search: Allow search and Cortana to use location	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	AllowSearchToUseLocation	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Search	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search	AllowSearchToUseLocation				1		0		=		Medium
328	1745	Administrative Templates: Windows Components	Search: Set what information is shared in Search	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search	ConnectedSearchPrivacy							1		3		=		Medium
329	2000	Administrative Templates: Windows Components	Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\System	EnableSmartScreen	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SmartScreen	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SmartScreen	EnableSmartScreenInShell				1		1		=		Medium
330	1873	Administrative Templates: Windows Components	Windows AI: Allow Recall to be enabled	Registry		HKLM:\Software\Policies\Microsoft\Windows\WindowsAI	AllowRecallEnablement									0		=		Medium
331	2001	Administrative Templates: Windows Components	Windows Defender SmartScreen: Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\System	ShellSmartScreenLevel	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\Browser	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Browser	PreventSmartScreenPromptOverride				Warn		Block		=		Medium
332	1746	Administrative Templates: Windows Components	Windows Error Reporting: Disable Windows Error Reporting	Registry		HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting	Disabled							0		1		=		Medium
333	1747	Administrative Templates: Windows Components	Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting	Registry		HKLM:\Software\Policies\Microsoft\Windows\GameDVR	AllowGameDVR	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement	AllowGameDVR				1		0		=		Low
334	1748	Administrative Templates: Windows Components	Windows Ink Workspace: Allow Windows Ink Workspace	Registry		HKLM:\Software\Policies\Microsoft\WindowsInkWorkspace	AllowWindowsInkWorkspace	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsInkWorkspace	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace	AllowWindowsInkWorkspace				1		0		=		Medium
335	1749	Administrative Templates: Windows Components	Windows Installer: Always install with elevated privileges	Registry		HKLM:\Software\Policies\Microsoft\Windows\Installer	AlwaysInstallElevated	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement	MSIAlwaysInstallWithElevatedPrivileges				0		0		=		Medium
336	1750	Administrative Templates: Windows Components	Windows Installer: Allow user control over installs	Registry		HKLM:\Software\Policies\Microsoft\Windows\Installer	EnableUserControl	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ApplicationManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement	MSIAllowUserControlOverInstall				1		0		=		Medium
337	1751	Administrative Templates: Windows Components	Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts	Registry		HKLM:\Software\Policies\Microsoft\Windows\Installer	SafeForScripting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSI	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSI	SafeForScripting				1		0		=		Medium
338	1770	Administrative Templates: Windows Components	Windows Installer: Disable Co-Installer (USB AutoInstall)	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer	DisableCoInstallers									1		=		Medium
339	1752	Administrative Templates: Windows Components	Windows Logon Options: Sign-in and lock last interactive user automatically after a restart	Registry		HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	DisableAutomaticRestartSignOn	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon	AllowAutomaticRestartSignOn				0		1		=		Medium
340	1776	Administrative Templates: Windows Components	Windows Logon Options: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon	Registry		HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System	EnableMPR	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsLogon	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon	EnableMPRNotifications						0		=		Medium
341	2105	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Module Logging	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging	EnableModuleLogging							0		1		=		Low
342	2106	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Module Logging - Module Names	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames	*									*		=		Low
343	2100	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Script Block Logging	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging	EnableScriptBlockLogging	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\WindowsPowerShell	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsPowerShell	TurnOnPowerShellScriptBlockLogging				0		1		=		Medium
344	2101	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging	EnableScriptBlockInvocationLogging							0		1		=		Low
345	2102	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Transcription	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription	EnableTranscripting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy	EnableTranscripting				0		1		=		Low
346	2107	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Transcription (Invocation)	Registry		HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription	EnableInvocationHeader							0		1		=		Low
347	1753	Administrative Templates: Windows Components	WinRM Client: Allow Basic authentication	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client	AllowBasic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	AllowBasicAuthentication_Client				0		0		=		Medium
348	1754	Administrative Templates: Windows Components	WinRM Client: Allow unencrypted traffic	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client	AllowUnencryptedTraffic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	AllowUnencryptedTraffic_Client				0		0		=		Medium
349	1755	Administrative Templates: Windows Components	WinRM Client: Disallow Digest authentication	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Client	AllowDigest	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	DisallowDigestAuthentication				0		0		=		Medium
350	1756	Administrative Templates: Windows Components	WinRM Service: Allow remote server management through WinRM	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service	AllowAutoConfig	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	AllowRemoteServerManagement				0		0		=		Medium
351	1757	Administrative Templates: Windows Components	WinRM Service: Allow Basic authentication	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service	AllowBasic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	AllowBasicAuthentication_Service				0		0		=		Medium
352	1758	Administrative Templates: Windows Components	WinRM Service: Allow unencrypted traffic	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service	AllowUnencryptedTraffic	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	AllowUnencryptedTraffic_Service				0		0		=		Medium
353	1759	Administrative Templates: Windows Components	WinRM Service: Disallow WinRM from storing RunAs credentials	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service	DisableRunAs	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteManagement	DisallowStoringOfRunAsCredentials				0		1		=		Medium
354	1760	Administrative Templates: Windows Components	Windows Remote Shell: Allow Remote Shell Access	Registry		HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS	AllowRemoteShellAccess	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\RemoteShell	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\RemoteShell	AllowRemoteShellAccess				1		0		=		Medium
355	2201	MS Security Guide	Lsass.exe audit mode	Registry		HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	AuditLevel									8		=		Low
356	2202	MS Security Guide	NetBT NodeType configuration	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters	NodeType	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide	NetBTNodeTypeConfiguration				0		2		=		Medium
357	2203	MS Security Guide	WDigest Authentication	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest	UseLogonCredential	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide	WDigestAuthentication				0		0		=		High
358	2209	MS Security Guide	Enable Structured Exception Handling Overwrite Protection (SEHOP)	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel	DisableExceptionChainValidation	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide	EnableStructuredExceptionHandlingOverwriteProtection				0		0		=		Medium
359	2213	MS Security Guide	Configure SMB v1 client driver	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\MrxSmb10	Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide	ConfigureSMBV1ClientDriver				1		4		=		Medium
360	2214	MS Security Guide	Configure SMB v1 server	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters	SMB1	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSecurityGuide	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSecurityGuide	ConfigureSMBV1Server				1		0		=		Medium
361	2215	MS Security Guide	Enable Certificate Padding	Registry		HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config	EnableCertPaddingCheck									1		=		Medium
362	2216	MS Security Guide	Enable Certificate Padding (32-bit subsystem on 64-bit OS)	Registry		HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config	EnableCertPaddingCheck									1		=		Medium
363	2204	MSS (Legacy)	MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)	Registry		HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager	SafeDLLSearchMode	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_MSS-legacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_MSS-legacy	Pol_MSS_SafeDllSearchMode				0		1		=		Medium
364	2205	MSS (Legacy)	MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)	Registry		HKLM:\System\CurrentControlSet\Services\Tcpip6\Parameters	DisableIPSourceRouting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy	IPv6SourceRoutingProtectionLevel				0		2		=		Medium
365	2206	MSS (Legacy)	MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)	Registry		HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters	DisableIPSourceRouting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy	SourceRoutingProtectionLevel				1		2		=		Medium
366	2207	MSS (Legacy)	MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes	Registry		HKLM:\System\CurrentControlSet\Services\Tcpip\Parameters	EnableICMPRedirect	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy	AllowICMPRedirectsToOverrideGeneratedRoute				1		0		=		Medium
367	2208	MSS (Legacy)	MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers	Registry		HKLM:\System\CurrentControlSet\Services\Netbt\Parameters	NoNameReleaseOnDemand	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\MSSLegacy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\MSSLegacy	AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers				0		1		=		Medium
368	2400	Scheduled Task	XblGameSave Standby Task	ScheduledTask	XblGameSaveTask									Ready		Disabled		=		Medium
369	2411	System Services	Disable mDNS in Dnscache service	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters	EnableMDNS									0		=		Medium
370	2401	System Services	Print Spooler (Spooler)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\Spooler	Start							2		4		=		Medium
371	2402	System Services	Print Spooler (Spooler) (Service Startup type)	service	Spooler									Automatic		Disabled		=		Medium
372	2412	System Services	WebClient (WebClient)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\WebClient	Start							3		4		=		Medium
373	2413	System Services	WebClient (WebClient) (Service Startup type)	service	WebClient									Manual		Disabled		=		Medium
374	2403	System Services	Xbox Accessory Management Service (XboxGipSvc)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\XboxGipSvc	Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices	ConfigureXboxAccessoryManagementServiceStartupMode				3		4		=		Medium
375	2404	System Services	Xbox Accessory Management Service (XboxGipSvc) (Service Startup type)	service	XboxGipSvc									Manual		Disabled		=		Medium
376	2405	System Services	Xbox Live Auth Manager (XblAuthManager)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\XblAuthManager	Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices	ConfigureXboxLiveAuthManagerServiceStartupMode				3		4		=		Medium
377	2406	System Services	Xbox Live Auth Manager (XblAuthManager) (Service Startup type)	service	XblAuthManager									Manual		Disabled		=		Medium
378	2407	System Services	Xbox Live Game Save (XblGameSave)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\XblGameSave	Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices	ConfigureXboxLiveGameSaveServiceStartupMode				3		4		=		Medium
379	2408	System Services	Xbox Live Game Save (XblGameSave) (Service Startup type)	service	XblGameSave									Manual		Disabled		=		Medium
380	2409	System Services	Xbox Live Networking Service (XboxNetApiSvc)	Registry		HKLM:\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc	Start	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\SystemServices	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\SystemServices	ConfigureXboxLiveNetworkingServiceStartupMode				3		4		=		Medium
381	2410	System Services	Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type)	service	XboxNetApiSvc									Manual		Disabled		=		Medium
382	1950	Microsoft Defender Exploit Guard	Exploit protection: Control flow guard (CFG)	Processmitigation	Cfg.Enable									On		ON		=		Medium
383	1951	Microsoft Defender Exploit Guard	Exploit protection: Data Execution Prevention (DEP)	Processmitigation	DEP.Enable									On		ON		=		Medium
384	1952	Microsoft Defender Exploit Guard	Exploit protection: Override Data Execution Prevention (DEP)	Processmitigation	DEP.OverrideDEP									False		False		=		Medium
385	1954	Microsoft Defender Exploit Guard	Exploit protection: Force randomization for images (Mandatory ASLR)	Processmitigation	ASLR.ForceRelocateImages									Off		ON		=		Medium
386	1955	Microsoft Defender Exploit Guard	Exploit protection: Override force randomization for images (Mandatory ASLR)	Processmitigation	ASLR.OverrideForceRelocateImages									False		False		=		Medium
387	1956	Microsoft Defender Exploit Guard	Exploit protection: Randomize memory allocations (Bottom-up ASLR)	Processmitigation	ASLR.BottomUp									On		ON		=		Medium
388	1957	Microsoft Defender Exploit Guard	Exploit protection: Override randomize memory allocations (Bottom-up ASLR)	Processmitigation	ASLR.OverrideBottomUp									False		False		=		Medium
389	1958	Microsoft Defender Exploit Guard	Exploit protection: High-entropy ASLR	Processmitigation	ASLR.HighEntropy									On		ON		=		Medium
390	1959	Microsoft Defender Exploit Guard	Exploit protection: Override high-entropy ASLR	Processmitigation	ASLR.OverrideHighEntropy									False		False		=		Medium
391	1960	Microsoft Defender Exploit Guard	Exploit protection: Validate exception chains (SEHOP)	Processmitigation	SEHOP.Enable									On		ON		=		Medium
392	1961	Microsoft Defender Exploit Guard	Exploit protection: Validate exception chains (SEHOP (Telemetry only)	Processmitigation	SEHOP.TelemetryOnly									NOTSET		OFF		=		Medium
393	1962	Microsoft Defender Exploit Guard	Exploit protection: Override validate exception chains (SEHOP)	Processmitigation	SEHOP.OverrideSEHOP									False		False		=		Medium
394	1963	Microsoft Defender Exploit Guard	Exploit protection: Validate heap integrity	Processmitigation	HEAP.TerminateOnError									On		ON		=		Medium
395	1964	Microsoft Defender Exploit Guard	Exploit protection: Override validate heap integrity	Processmitigation	HEAP.OverrideHEAP									False		False		=		Medium
396	1953	Microsoft Defender Exploit Guard	Force use of Data Execution Prevention (DEP)	bcdedit	nx									OptIn		AlwaysOn		=		Medium
397	2300	Windows Firewall	HardeningKitty-Block-TCP-NetBIOS	FirewallRule	Any|Inbound|Block|TCP|137,138,139||									False		True		=		Low
398	2301	Windows Firewall	HardeningKitty-Block-TCP-RDP	FirewallRule	Any|Inbound|Block|TCP|3389||									False		True		=		Low
399	2302	Windows Firewall	HardeningKitty-Block-TCP-RPC	FirewallRule	Any|Inbound|Block|TCP|135,593||									False		True		=		Low
400	2303	Windows Firewall	HardeningKitty-Block-TCP-SMB	FirewallRule	Any|Inbound|Block|TCP|445||									False		True		=		Low
401	2304	Windows Firewall	HardeningKitty-Block-TCP-WinRM	FirewallRule	Any|Inbound|Block|TCP|5985,5986||									False		True		=		Low
402	2305	Windows Firewall	HardeningKitty-Block-UDP-NetBIOS	FirewallRule	Any|Inbound|Block|UDP|137,138,139||									False		True		=		Low
403	2306	Windows Firewall	HardeningKitty-Block-UDP-RPC	FirewallRule	Any|Inbound|Block|UDP|135,593||									False		True		=		Low
404	2307	Windows Firewall	HardeningKitty-Block-calc-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\calc.exe|									False		True		=		Low
405	2308	Windows Firewall	HardeningKitty-Block-calc-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\calc.exe|									False		True		=		Low
406	2309	Windows Firewall	HardeningKitty-Block-certutil-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\certutil.exe|									False		True		=		Low
407	2310	Windows Firewall	HardeningKitty-Block-certutil-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\certutil.exe|									False		True		=		Low
408	2311	Windows Firewall	HardeningKitty-Block-conhost-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\conhost.exe|									False		True		=		Low
409	2312	Windows Firewall	HardeningKitty-Block-conhost-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\conhost.exe|									False		True		=		Low
410	2313	Windows Firewall	HardeningKitty-Block-cscript-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\cscript.exe|									False		True		=		Low
411	2314	Windows Firewall	HardeningKitty-Block-cscript-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\cscript.exe|									False		True		=		Low
412	2315	Windows Firewall	HardeningKitty-Block-mshta-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\mshta.exe|									False		True		=		Low
413	2316	Windows Firewall	HardeningKitty-Block-mshta-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\mshta.exe|									False		True		=		Low
414	2317	Windows Firewall	HardeningKitty-Block-notepad-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\notepad.exe|									False		True		=		Low
415	2318	Windows Firewall	HardeningKitty-Block-notepad-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\notepad.exe|									False		True		=		Low
416	2319	Windows Firewall	HardeningKitty-Block-RunScriptHelper-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\RunScriptHelper.exe|									False		True		=		Low
417	2320	Windows Firewall	HardeningKitty-Block-RunScriptHelper-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\RunScriptHelper.exe|									False		True		=		Low
418	2321	Windows Firewall	HardeningKitty-Block-wscript-x64	FirewallRule	Any|Outbound|Block|||%SystemRoot%\System32\wscript.exe|									False		True		=		Low
419	2322	Windows Firewall	HardeningKitty-Block-wscript-x86	FirewallRule	Any|Outbound|Block|||%SystemRoot%\Syswow64\wscript.exe|									False		True		=		Low