comi-audit-secu/vendor/lists/finding_list_0x6d69636b_user.csv

1	ID	Category	Name	Method	MethodArgument	RegistryPath	RegistryItem	RegistryPathIntune	RegistryPathDCP	RegistryItemIntune	ClassName	Namespace	Property	DefaultValue	DefaultValueIntune	RecommendedValue	RecommendedValueIntune	Operator	OperatorIntune	Severity	Filter
2	4307	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging	EnableModuleLogging							0		1		=		Medium
3	4308	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging (PowerShell Policy)	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging	UseWindowsPowerShellPolicySetting							0		1		=		Medium
4	4309	Administrative Templates: PowerShellCore	Turn on PowerShell Module Logging - Module Names	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames	*									*		=		Medium
5	4310	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	EnableScriptBlockLogging							0		1		=		Medium
6	4311	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging (Invocation)	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	EnableScriptBlockInvocationLogging							0		1		=		Medium
7	4312	Administrative Templates: PowerShellCore	Turn on PowerShell Script Block Logging (PowerShell Policy)	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging	UseWindowsPowerShellPolicySetting							0		1		=		Medium
8	4313	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription	EnableTranscripting							0		1		=		Medium
9	4314	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription (Invocation)	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription	EnableInvocationHeader							0		1		=		Medium
10	4315	Administrative Templates: PowerShellCore	Turn on PowerShell Transcription (PowerShell Policy)	Registry		HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription	UseWindowsPowerShellPolicySetting							0		1		=		Medium
11	4001	Administrative Templates: Start Menu and Taskbar	Notifications: Turn off toast notifications on the lock screen	Registry		HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications	NoToastApplicationNotificationOnLockScreen	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN	NoLockScreenToastNotification				0		1		=		Medium
12	4100	Administrative Templates: System	Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program	Registry		HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0	NoImplicitFeedback	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport	HPImplicitFeedback				0		1		=		Medium
13	4200	Administrative Templates: Windows Components	Cloud Content: Do not use diagnostic data for tailored experiences	Registry		HKCU:\Software\Policies\Microsoft\Windows\CloudContent	DisableTailoredExperiencesWithDiagnosticData	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience	AllowTailoredExperiencesWithDiagnosticData				0		1		=		Medium
14	4201	Administrative Templates: Windows Components	Cloud Content: Do not suggest third-party content in Windows spotlight	Registry		HKCU:\Software\Policies\Microsoft\Windows\CloudContent	DisableThirdPartySuggestions	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience	AllowThirdPartySuggestionsInWindowsSpotlight				0		1		=		Medium
15	4203	Administrative Templates: Windows Components	Windows AI: Turn off Saving Snapshots for Windows (User)	Registry		HKCU:\Software\Policies\Microsoft\Windows\WindowsAI	DisableAIDataAnalysis							0		1		=		Medium
16	4204	Administrative Templates: Windows Components	Windows Copilot: Turn off Windows Copilot	Registry		HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot	TurnOffWindowsCopilot	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI	TurnOffWindowsCopilot				0		1		=		Medium
17	4202	Administrative Templates: Windows Components	Windows Installer: Always install with elevated privileges	Registry		HKCU:\Software\Policies\Microsoft\Windows\Installer	AlwaysInstallElevated	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement	MSIAlwaysInstallWithElevatedPrivileges				0		0		=		Medium
18	4304	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Module Logging	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging	EnableModuleLogging							0		1		=		Low
19	4305	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Module Logging - Module Names	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames	*									*		=		Low
20	4300	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Script Block Logging	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging	EnableScriptBlockLogging							0		1		=		Medium
21	4301	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging	EnableScriptBlockInvocationLogging							0		1		=		Low
22	4302	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Transcription	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription	EnableTranscripting	HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy	HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy	EnableTranscripting				0		1		=		Low
23	4306	Administrative Templates: Windows Components	Windows PowerShell: Turn on PowerShell Transcription (Invocation)	Registry		HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription	EnableInvocationHeader							0		1		=		Low
24	4303	Administrative Templates: Windows Components	Windows PowerShell: PowerShell Language Mode	LanguageMode										FullLanguage		ConstrainedLanguage		=		Medium
25	4400	Office 2016 / Office 365	Security Settings: Macro Runtime Scan Scope	Registry		HKCU:\software\policies\microsoft\office\16.0\common\security	macroruntimescanscope							0		2		=		Medium
26	4401	Office 2016 / Office 365	Microsoft Excel: Always prevent untrusted Microsoft Query files from opening	Registry		HKCU:\software\policies\microsoft\office\16.0\excel\security\external content	enableblockunsecurequeryfiles							0		1		=		Medium
27	4405	Office 2016 / Office 365	Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel	Registry		HKCU:\software\policies\microsoft\office\16.0\excel\security\external content	disableddeserverlaunch							0		1		=		Medium
28	4406	Office 2016 / Office 365	Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel	Registry		HKCU:\software\policies\microsoft\office\16.0\excel\security\external content	disableddeserverlookup							0		1		=		Medium
29	4407	Office 2016 / Office 365	Microsoft Excel: Block macros from running in Office files from the Internet	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security	blockcontentexecutionfrominternet							0		1		=		Medium
30	4408	Office 2016 / Office 365	Microsoft Excel: VBA Macro Notification Settings	Registry		HKCU:\Software\Microsoft\Office\16.0\Excel\Security	vbawarnings							2		4		=		Medium
31	4409	Office 2016 / Office 365	Microsoft Excel: VBA Macro Notification Settings (Policy)	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security	vbawarnings							2		4		=		Medium
32	4402	Office 2016 / Office 365	Microsoft Excel: Don't update links	Registry		HKCU:\Software\Microsoft\Office\16.0\Excel\Options	DontUpdateLinks							0		1		=		Medium
33	4403	Office 2016 / Office 365	Microsoft Excel: Don’t allow Dynamic Data Exchange (DDEAllowed)	Registry		HKCU:\Software\Microsoft\Office\16.0\Excel\Options	DDEAllowed							1		1		=		Medium
34	4404	Office 2016 / Office 365	Microsoft Excel: Don’t allow Dynamic Data Exchange (DDECleaned)	Registry		HKCU:\Software\Microsoft\Office\16.0\Excel\Options	DDECleaned							0		1		=		Medium
35	4424	Office 2016 / Office 365	Microsoft Excel: Python Notification Settings	Registry		HKCU:\software\policies\microsoft\office\16.0\excel\security	PythonFunctionWarnings									2		=		Medium
36	4410	Office 2016 / Office 365	Microsoft OneNote: Disable embedded files	Registry		HKCU:\Software\Microsoft\Office\16.0\OneNote\Options	DisableEmbeddedFiles							0		1		=		Medium
37	4425	Office 2016 / Office 365	Microsoft Outlook: Folder Home Pages for Outlook Special Folders: Do not allow Home Page URL to be set in folder Properties	Registry		HKCU:\software\policies\microsoft\office\16.0\outlook\webview	disable									1		=		Medium
38	4426	Office 2016 / Office 365	Microsoft Outlook: Outlook Today Settings: Outlook Today availability	Registry		HKCU:\software\policies\microsoft\office\16.0\outlook\today	disable									1		=		Medium
39	4411	Office 2016 / Office 365	Microsoft PowerPoint: Block macros from running in Office files from the Internet	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security	blockcontentexecutionfrominternet							0		1		=		Medium
40	4412	Office 2016 / Office 365	Microsoft PowerPoint: VBA Macro Notification Settings (Policy)	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security	vbawarnings							2		4		=		Medium
41	4415	Office 2016 / Office 365	Microsoft Word: Block macros from running in Office files from the Internet	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security	blockcontentexecutionfrominternet							0		1		=		Medium
42	4416	Office 2016 / Office 365	Microsoft Word: VBA Macro Notification Settings	Registry		HKCU:\Software\Microsoft\Office\16.0\Word\Security	vbawarnings							2		4		=		Medium
43	4417	Office 2016 / Office 365	Microsoft Word: VBA Macro Notification Settings (Policy)	Registry		HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security	vbawarnings							2		4		=		Medium
44	4413	Office 2016 / Office 365	Microsoft Word: Don't update links	Registry		HKCU:\Software\Microsoft\Office\16.0\Word\Options	DontUpdateLinks							0		1		=		Medium
45	4414	Office 2016 / Office 365	Microsoft Word (Mail): Don't update links	Registry		HKCU:\Software\Microsoft\Office\16.0\Word\Options\WordMail	DontUpdateLinks							0		1		=		Medium
46	4418	Office 365	Disable the Office 365 Telemetry module	Registry		HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry	DisableTelemetry									1		=		Medium
47	4419	Office 365	Allow the use of connected experiences in Office	Registry		HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy	disconnectedstate									2		=		Low
48	4420	Office 365	Allow the use of connected experiences that analyze content	Registry		HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy	usercontentdisabled									2		=		Low
49	4421	Office 365	Allow the use of connected experiences that download online content	Registry		HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy	downloadcontentdisabled									2		=		Low
50	4422	Office 365	Allow the use of additional optional connected experiences	Registry		HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy	controllerconnectedservicesenabled									2		=		Low
51	4423	Office 365	Configure the level of client software diagnostic data sent by Office to Microsoft	Registry		HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry	sendtelemetry									3		=		Low
52	4500	Windows Settings	System: Notification & actions: Show me the Windows welcome experience after updates and occasionally when I sign in to highlight what's new and suggested	Registry		HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager	SubscribedContent-310093Enabled							1		0		=		Low
53	4501	Windows Settings	System: Notification & actions: Get tips, tricks, and suggestions as you use Windows	Registry		HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager	SubscribedContent-338389Enabled							1		0		=		Low
54	4502	Windows Settings	System: Shared experiences: Shared across devices 1	Registry		HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP	RomeSdkChannelUserAuthzPolicy							1		0		=		Low
55	4503	Windows Settings	System: Shared experiences: Shared across devices 2	Registry		HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP	CdpSessionUserAuthzPolicy							1		0		=		Low
56	4504	Windows Settings	Devices: Typing: Autocorrect misspelled words	Registry		HKCU:\Software\Microsoft\TabletTip\1.7	EnableAutocorrection							1		0		=		Low
57	4505	Windows Settings	Devices: AutoPlay: Use AutoPlay for all media and devices	Registry		HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers	DisableAutoplay							0		0		=		Low