Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

MSFT Windows 11 22H2 - Computer
Data collected on: 9/19/2022 8:29:09 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 12/12/2019 5:55:34 AM
Modified | 9/6/2022 4:51:24 AM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 27 (AD), 27 (SYSVOL)
Unique ID | {1B6AAB4D-20DC-4956-9439-DD15694E2B6A}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
MSFT Clients | No | Enabled | security.local/MSFT Clients
SCT Windows 11 Client | No | Enabled | security.local/SCT Windows 11 Client

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/User Rights Assignment

Policy | Setting
--- | ---
Access Credential Manager as a trusted caller |
Access this computer from the network | BUILTIN\Administrators, BUILTIN\Remote Desktop Users
Act as part of the operating system |
Allow log on locally | BUILTIN\Administrators, BUILTIN\Users
Back up files and directories | BUILTIN\Administrators
Create a pagefile | BUILTIN\Administrators
Create a token object |
Create global objects | BUILTIN\Administrators, NT AUTHORITY\SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE
Create permanent shared objects |
Debug programs | BUILTIN\Administrators
Deny access to this computer from the network | NT AUTHORITY\Local account
Deny log on through Terminal Services | NT AUTHORITY\Local account
Enable computer and user accounts to be trusted for delegation |
Force shutdown from a remote system | BUILTIN\Administrators
Impersonate a client after authentication | BUILTIN\Administrators, NT AUTHORITY\SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE
Load and unload device drivers | BUILTIN\Administrators
Lock pages in memory |
Manage auditing and security log | BUILTIN\Administrators
Modify firmware environment values | BUILTIN\Administrators
Perform volume maintenance tasks | BUILTIN\Administrators
Profile single process | BUILTIN\Administrators
Restore files and directories | BUILTIN\Administrators
Take ownership of files or other objects | BUILTIN\Administrators

Local Policies/Security Options
Accounts

Policy | Setting
--- | ---
Accounts: Limit local account use of blank passwords to console logon only | Enabled

Interactive Logon

Policy | Setting
--- | ---
Interactive logon: Smart card removal behavior | Lock Workstation

Microsoft Network Client

Policy | Setting
--- | ---
Microsoft network client: Digitally sign communications (always) | Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled

Network Access

Policy | Setting
--- | ---
Network access: Allow anonymous SID/Name translation | Disabled
Network access: Do not allow anonymous enumeration of SAM accounts | Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled
Network access: Restrict anonymous access to Named Pipes and Shares | Enabled

Network Security

Policy | Setting
--- | ---
Network security: Do not store LAN Manager hash value on next password change | Enabled
Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirements | Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled

System Objects

Policy | Setting
--- | ---
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Enabled

User Account Control

Policy | Setting
--- | ---
User Account Control: Admin Approval Mode for the Built-in Administrator account | Enabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent on the secure desktop
User Account Control: Behavior of the elevation prompt for standard users | Automatically deny elevation requests
User Account Control: Detect application installations and prompt for elevation | Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled
User Account Control: Run all administrators in Admin Approval Mode | Enabled
User Account Control: Virtualize file and registry write failures to per-user locations | Enabled

Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled
Domain member: Digitally encrypt or sign secure channel data (always) | Enabled
Domain member: Digitally encrypt secure channel data (when possible) | Enabled
Domain member: Digitally sign secure channel data (when possible) | Enabled
Domain member: Require strong (Windows 2000 or later) session key | Enabled
Interactive logon: Machine inactivity limit | 900 seconds
Microsoft network server: Digitally sign communications (always) | Enabled
Network access: Restrict clients allowed to make remote calls to SAM | "O:BAG:BAD:(A;;RC;;;BA)"
Network security: Allow LocalSystem NULL session fallback | Disabled

System Services
Xbox Live Auth Manager (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Xbox Live Game Save (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Xbox Accessory Management Service (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Xbox Live Networking Service (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Windows Firewall with Advanced Security
Global Settings

Policy | Setting
--- | ---
Policy version | 2.26
Disable stateful FTP | Not Configured
Disable stateful PPTP | Not Configured
IPsec exempt | Not Configured
IPsec through NAT | Not Configured
Preshared key encoding | Not Configured
SA idle time | Not Configured
Strong CRL check | Not Configured

Domain Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | 16384

Private Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | 16384

Public Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | No
Apply local connection security rules | No
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | 16384

Connection Security Settings
Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Success, Failure

Account Management

Policy | Setting
--- | ---
Audit Security Group Management | Success
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit PNP Activity | Success
Audit Process Creation | Success

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Failure
Audit Group Membership | Success
Audit Logon | Success, Failure
Audit Other Logon/Logoff Events | Success, Failure
Audit Special Logon | Success

Object Access

Policy | Setting
--- | ---
Audit Detailed File Share | Failure
Audit File Share | Success, Failure
Audit Other Object Access Events | Success, Failure
Audit Removable Storage | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success
Audit Authentication Policy Change | Success
Audit MPSSVC Rule-Level Policy Change | Success, Failure
Audit Other Policy Change Events | Failure

Privilege Use

Policy | Setting
--- | ---
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit Other System Events | Success, Failure
Audit Security State Change | Success
Audit Security System Extension | Success
Audit System Integrity | Success, Failure

Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Control Panel/Personalization

Policy | Setting | Comment
--- | --- | ---
Prevent enabling lock screen camera | Enabled |
Prevent enabling lock screen slide show | Enabled |

LAPS

Policy | Setting | Comment
--- | --- | ---
Enable local admin password management | Enabled |

MS Security Guide

Policy | Setting | Comment
--- | --- | ---
Apply UAC restrictions to local accounts on network logons | Enabled |
Configure RPC packet level privacy setting for incoming connections | Enabled |
Configure SMB v1 client driver | Enabled |
Configure MrxSmb10 driver | Disable driver (recommended)
Policy | Setting | Comment
Configure SMB v1 server | Disabled |
Enable Structured Exception Handling Overwrite Protection (SEHOP) | Enabled |
NetBT NodeType configuration | Enabled |
Configure NetBT NodeType | P-node (recommended)
Policy | Setting | Comment
WDigest Authentication (disabling may require KB2871997) | Disabled |

MSS (Legacy)

Policy | Setting | Comment
--- | --- | ---
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRoutingIPv6 | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRouting | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled |
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Enabled |

Network/DNS Client

Policy | Setting | Comment
--- | --- | ---
Configure NetBIOS settings | Enabled |
Configure NetBIOS options: | Disable NetBIOS name resolution on public networks
Policy | Setting | Comment
Turn off multicast name resolution | Enabled |

Network/Lanman Workstation

Policy | Setting | Comment
--- | --- | ---
Enable insecure guest logons | Disabled |

Network/Network Connections

Policy | Setting | Comment
--- | --- | ---
Prohibit use of Internet Connection Sharing on your DNS domain network | Enabled |

Network/Network Connections/Windows Defender Firewall/Domain Profile

Policy | Setting | Comment
--- | --- | ---
Windows Defender Firewall: Allow logging | Enabled |
Log dropped packets | Enabled
Log successful connections | Enabled
Log file path and name: |
Size limit (KB): | 16384
Policy | Setting | Comment
Windows Defender Firewall: Prohibit notifications | Enabled |
Windows Defender Firewall: Protect all network connections | Enabled |

Network/Network Provider

Policy | Setting | Comment
--- | --- | ---
Hardened UNC Paths | Enabled |
Specify hardened network paths. In the name field, type a fully-qualified UNC path for each network resource. To secure all access to a share with a particular name, regardless of the server name, specify a server name of '*' (asterisk). For example, "\\*\NETLOGON". To secure all access to all shares hosted on a server, the share name portion of the UNC path may be omitted. For example, "\\SERVER". In the value field, specify one or more of the following options, separated by commas: 'RequireMutualAuthentication=1': Mutual authentication between the client and server is required to ensure the client connects to the correct server. 'RequireIntegrity=1': Communication between the client and server must employ an integrity mechanism to prevent data tampering. 'RequirePrivacy=1': Communication between the client and the server must be encrypted to prevent third parties from observing sensitive data.
Hardened UNC Paths: |
--- | ---
\\*\SYSVOL | RequireMutualAuthentication=1,RequireIntegrity=1
\\*\NETLOGON | RequireMutualAuthentication=1,RequireIntegrity=1
You should require both Integrity and Mutual Authentication for any UNC paths that host executable programs, script files, or files that control security policies. Consider hosting files that do not require Integrity or Privacy on separate shares from those that absolutely need such security for optimal performance. For additional details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Network/Windows Connection Manager

Policy | Setting | Comment
--- | --- | ---
Prohibit connection to non-domain networks when connected to domain authenticated network | Enabled |

Network/WLAN Service/WLAN Settings

Policy | Setting | Comment
--- | --- | ---
Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services | Disabled |

Printers

Policy | Setting | Comment
--- | --- | ---
Configure Redirection Guard | Enabled |
Configure options for Redirection Guard
Redirection Guard Options | Redirection Guard Enabled
Policy | Setting | Comment
Configure RPC connection settings | Enabled |
Configure protocol options for outgoing RPC connections.
Protocol to use for outgoing RPC connections: | RPC over TCP
Use authentication for outgoing RPC connections: | Default
Policy | Setting | Comment
Configure RPC listener settings | Enabled |
Configure protocol options for incoming RPC connections.
Protocols to allow for incoming RPC connections: | RPC over TCP
Authentication protocol to use for incoming RPC connections: | Negotiate
Policy | Setting | Comment
Configure RPC over TCP port | Enabled |
Configure port to use for RPC over TCP.
RPC over TCP port: | 0
Policy | Setting | Comment
Limits print driver installation to Administrators | Enabled |
Manage processing of Queue-specific files | Enabled |
Select the method by which Queue-specific files will be processed.
Manage processing of Queue-Specific files: | Limit Queue-specific files to Color profiles

System/Credentials Delegation

Policy | Setting | Comment
--- | --- | ---
Encryption Oracle Remediation | Enabled |
Protection Level: | Force Updated Clients
Policy | Setting | Comment
Remote host allows delegation of non-exportable credentials | Enabled |

System/Early Launch Antimalware

Policy | Setting | Comment
--- | --- | ---
Boot-Start Driver Initialization Policy | Enabled |
Choose the boot-start drivers that can be initialized: | Good, unknown and bad but critical

System/Group Policy

Policy | Setting | Comment
--- | --- | ---
Configure registry policy processing | Enabled |
Do not apply during periodic background processing | Disabled
Process even if the Group Policy objects have not changed | Enabled

System/Internet Communication Management/Internet Communication settings

Policy | Setting | Comment
--- | --- | ---
Turn off downloading of print drivers over HTTP | Enabled |
Turn off Internet download for Web publishing and online ordering wizards | Enabled |

System/Kernel DMA Protection

Policy | Setting | Comment
--- | --- | ---
Enumeration policy for external devices incompatible with Kernel DMA Protection | Enabled |
Enumeration policy | Block all

System/Local Security Authority

Policy | Setting | Comment
--- | --- | ---
Allow Custom SSPs and APs to be loaded into LSASS | Disabled |
Configures LSASS to run as a protected process | Enabled |
Configure LSA to run as a protected process | Enabled with UEFI Lock

System/Logon

Policy | Setting | Comment
--- | --- | ---
Enumerate local users on domain-joined computers | Disabled |
Turn on convenience PIN sign-in | Disabled |

System/Power Management/Sleep Settings

Policy | Setting | Comment
--- | --- | ---
Require a password when a computer wakes (on battery) | Enabled |
Require a password when a computer wakes (plugged in) | Enabled |

System/Remote Assistance

Policy | Setting | Comment
--- | --- | ---
Configure Solicited Remote Assistance | Disabled |

System/Remote Procedure Call

Policy | Setting | Comment
--- | --- | ---
Restrict Unauthenticated RPC clients | Enabled |
RPC Runtime Unauthenticated Client Restriction to Apply: | Authenticated

Windows Components/App Privacy

Policy | Setting | Comment
--- | --- | ---
Let Windows apps activate with voice while the system is locked | Enabled |
Default for all apps: | Force Deny

Windows Components/App runtime

Policy | Setting | Comment
--- | --- | ---
Allow Microsoft accounts to be optional | Enabled |

Windows Components/AutoPlay Policies

Policy | Setting | Comment
--- | --- | ---
Disallow Autoplay for non-volume devices | Enabled |
Set the default behavior for AutoRun | Enabled |
Default AutoRun Behavior | Do not execute any autorun commands
Policy | Setting | Comment
Turn off Autoplay | Enabled |
Turn off Autoplay on: | All drives

Windows Components/Biometrics/Facial Features

Policy | Setting | Comment
--- | --- | ---
Configure enhanced anti-spoofing | Enabled |

Windows Components/Cloud Content

Policy | Setting | Comment
--- | --- | ---
Turn off Microsoft consumer experiences | Enabled |

Windows Components/Credential User Interface

Policy | Setting | Comment
--- | --- | ---
Enumerate administrator accounts on elevation | Disabled |

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 196608

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Policy | Setting | Comment
--- | --- | ---
Do not allow passwords to be saved | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection

Policy | Setting | Comment
--- | --- | ---
Do not allow drive redirection | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security

Policy | Setting | Comment
--- | --- | ---
Always prompt for password upon connection | Enabled |
Require secure RPC communication | Enabled |
Set client connection encryption level | Enabled |
Encryption Level | High Level
Choose the encryption level from the drop-down list.

Windows Components/RSS Feeds

Policy | Setting | Comment
--- | --- | ---
Prevent downloading of enclosures | Enabled |

Windows Components/Search

Policy | Setting | Comment
--- | --- | ---
Allow indexing of encrypted files | Disabled |

Windows Components/Windows Defender SmartScreen/Enhanced Phishing Protection

Policy | Setting | Comment
--- | --- | ---
Notify Malicious | Enabled |
Notify Password Reuse | Enabled |
Notify Unsafe App | Enabled |
Service Enabled | Enabled |

Windows Components/Windows Defender SmartScreen/Explorer

Policy | Setting | Comment
--- | --- | ---
Configure Windows Defender SmartScreen | Enabled |
Pick one of the following settings: | Warn and prevent bypass

Windows Components/Windows Game Recording and Broadcasting

Policy | Setting | Comment
--- | --- | ---
Enables or disables Windows Game Recording and Broadcasting | Disabled |

Windows Components/Windows Ink Workspace

Policy | Setting | Comment
--- | --- | ---
Allow Windows Ink Workspace | Enabled |
Choose one of the following actions |

Windows Components/Windows Installer

Policy | Setting | Comment
--- | --- | ---
Allow user control over installs | Disabled |
Always install with elevated privileges | Disabled |

Windows Components/Windows Logon Options

Policy | Setting | Comment
--- | --- | ---
Enable MPR notifications for the system | Disabled |
Sign-in and lock last interactive user automatically after a restart | Disabled |

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on PowerShell Script Block Logging | Enabled |
Log script block invocation start / stop events: | Disabled

Windows Components/Windows Remote Management (WinRM)/WinRM Client

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow Digest authentication | Enabled |

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow WinRM from storing RunAs credentials | Enabled |

User Configuration (Disabled)
No settings defined.