"; htmlText = htmlText + "

"; htmlText = htmlText + "" + eventIdLabelNodeText + ""; htmlText = htmlText + " | " + eventTimeLabelNodeText + ""; htmlText = htmlText + " | " + eventDescriptionLabelNodeText + ""; htmlText = htmlText + " | " + eventDetailsLabelNodeText + ""; htmlText = htmlText + "
--- | --- | --- | ---
"; var i; var eventId; var eventTime; var eventDescription; var eventXml; var eventType; var displayEvent; var eventXmlId; var displayBgColor; if(eventRecordArray.length > 0) { for (i=0; i < eventRecordArray.length; i++) { displayEvent = false; var eventIdElements = eventRecordArray[i].getElementsByTagName("EventId"); if((eventIdElements.length > 0) && (eventIdElements[0].firstChild != null)) { eventId = eventIdElements[0].firstChild.nodeValue; } else { eventId = dataNotFoundWarningLabelNodeText; } var eventTimeElements = eventRecordArray[i].getElementsByTagName("EventTime"); if((eventTimeElements.length > 0) && (eventTimeElements[0].firstChild != null)) { eventTime = eventTimeElements[0].firstChild.nodeValue; } else { eventTime = dataNotFoundWarningLabelNodeText; } var eventDescriptionElements = eventRecordArray[i].getElementsByTagName("EventDescription"); if((eventDescriptionElements.length > 0) && (eventDescriptionElements[0].firstChild != null)) { eventDescription = eventDescriptionElements[0].firstChild.xml; } else { eventDescription = dataNotFoundWarningLabelNodeText; } var eventXmlElements = eventRecordArray[i].getElementsByTagName("EventXml"); if((eventXmlElements.length > 0) && (eventXmlElements[0].firstChild != null)) { eventXml = eventXmlElements[0].firstChild.xml; } else { eventXml = dataNotFoundWarningLabelNodeText; } var eventLevelElements = eventRecordArray[i].getElementsByTagName("EventLevel"); if((eventLevelElements.length > 0) && (eventLevelElements[0].firstChild != null)) { eventType = eventLevelElements[0].firstChild.xml; } else { eventType = 5; } if((bVerbose == true)&&(eventType == 5)) { displayEvent = true; } else if((bInformational == true)&&(eventType == 4)) { displayEvent = true; } else if((bWarning == true)&&(eventType == 3)) { displayEvent = true; } else if((bError == true)&&((eventType == 1)||(eventType == 2))) { displayEvent = true; } if (displayEvent == true) { eventXmlId = "EventXml" + (i+""); htmlText = htmlText + "
"; htmlText = htmlText + "" + eventId + ""; htmlText = htmlText + " | " + eventTime + ""; htmlText = htmlText + " | " + eventDescription + ""; htmlText = htmlText + " | "; htmlText = htmlText + eventXmlLabelNodeText + " "; htmlText = htmlText + ""; htmlText = htmlText + eventXml + ""; htmlText = htmlText + ""; htmlText = htmlText + "
"; } } } htmlText = htmlText + "

"; if(windowsArray[strWindowId]) { delete windowsArray[strWindowId]; } // IE specific method for showing the popup. if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") == -1) { var strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;"; var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs); vModeless.document.write(htmlText); vModeless.document.close(); vModeless.location.reload(false); windowsArray[strWindowId] = vModeless; } else { var strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes"; windowsArray[strWindowId] = window.open("", "", strDiagArgs); windowsArray[strWindowId].document.write(htmlText); windowsArray[strWindowId].focus(); } } } function cleanUp() { for(var currentWindow in this.windowsArray) { windowsArray[currentWindow].close(); } } function showComponentProcessingDetails(srcElement) { var strWindowId = "ProcessingDetails_" + srcElement.getAttribute("eventLogActivityId"); if((windowsArray[strWindowId]) &&(windowsArray[strWindowId].closed == false)) { windowsArray[strWindowId].focus(); } else { var xmlDocument = RsopDataIslands.XMLDocument; var extensionsProcessedLabelNode, slowLinkThresholdLabelNode, linkSpeedLabelNode, extensionsProcessedTimeTakenNode; var domainControllerIPLabelNode, domainControllerNameLabelNode, processingTypeLabelNode, loopbackModeLabelNode; var processingTriggerLabelNode, extensionNameLabelNode, timeTakenLabelNode; var dataNotFoundWarningLabelNode; var singlePassEventsDetailsNode, totalProcessingTimeLabelNode, refreshMessageLabelNode; var processingDetailsUserTitleNode, processingDetailsComputerTitleNode; var policySectionNode; var policyEventsDetailsNode, detailsLabelNode; var extensionsProcessedLabelNodeText ,slowLinkThresholdLabelNodeText,linkSpeedLabelNodeText,extensionsProcessedTimeTakenNodeText; var domainControllerIPLabelNodeText, domainControllerNameLabelNodeText, processingTypeLabelNodeText,loopbackModeLabelNodeText; var processingTriggerLabelNodeText, extensionNameLabelNodeText, timeTakenLabelNodeText; var dataNotFoundWarningLabelNodeText, totalProcessingTimeLabelNodeText, refreshMessageLabelNodeText; var processingDetailsUserTitleNodeText, processingDetailsComputerTitleNodeText; var detailsLabelNodeText; var slowLinkThresholdValue, linkSpeedValue, domainControllerIPValue, domainControllerNameValue; var processingTypeValue, loopbackModeValue, processingTriggerValue, totalPolicyProcessingTime, extensionProcessingTimeArray; var cseNameArray = new Array(); var cseElapsedTimeArray = new Array(); var policyApplicationFinishedTime; var isComputerProcessing; if(xmlDocument != null) { extensionsProcessedLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_ExtensionsProcessed']"); slowLinkThresholdLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_SlowLinkThreshold']"); linkSpeedLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_LinkSpeed']"); extensionsProcessedTimeTakenNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_TimeTaken']"); domainControllerIPLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_DomainControllerIP']"); domainControllerNameLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_DomainControllerName']"); processingTypeLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_ProcessingType']"); loopbackModeLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_LoopbackMode']"); processingTriggerLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_ProcessingTrigger']"); extensionNameLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_ExtensionName']"); timeTakenLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_TimeTaken']"); dataNotFoundWarningLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='Warning_DataNotFound']"); totalProcessingTimeLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_TotalProcessingTime']"); refreshMessageLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_RefreshMessage']"); singlePassEventsDetailsNode = xmlDocument.selectSingleNode("//SinglePassEventsDetails[@ActivityId='" + srcElement.getAttribute("eventLogActivityId") + "']"); processingDetailsUserTitleNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_UserProcessingDetails']"); processingDetailsComputerTitleNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_ComputerProcessingDetails']"); detailsLabelNode = xmlDocument.selectSingleNode("MainSection/Label[@Name='ComponentStatus_Details']"); if(singlePassEventsDetailsNode) { policyEventsDetailsNode = singlePassEventsDetailsNode.parentNode; if(policyEventsDetailsNode) { policySectionNode = policyEventsDetailsNode.parentNode; if(policySectionNode) { if(policySectionNode.nodeName == 'UserPolicySection') { isComputerProcessing = false; } if(policySectionNode.nodeName == 'ComputerPolicySection') { isComputerProcessing = true; } } } } } extensionsProcessedLabelNodeText = null; if(extensionsProcessedLabelNode != null) { if((extensionsProcessedLabelNode.firstChild != null) && (extensionsProcessedLabelNode.firstChild.childNodes.length > 0)) { extensionsProcessedLabelNodeText = extensionsProcessedLabelNode.firstChild.childNodes[0].nodeValue; } } slowLinkThresholdLabelNodeText = null; if(slowLinkThresholdLabelNode != null) { if((slowLinkThresholdLabelNode.firstChild != null) && (slowLinkThresholdLabelNode.firstChild.childNodes.length > 0)) { slowLinkThresholdLabelNodeText = slowLinkThresholdLabelNode.firstChild.childNodes[0].nodeValue; } } linkSpeedLabelNodeText = null; if(linkSpeedLabelNode != null) { if((linkSpeedLabelNode.firstChild != null) && (linkSpeedLabelNode.firstChild.childNodes.length > 0)) { linkSpeedLabelNodeText = linkSpeedLabelNode.firstChild.childNodes[0].nodeValue; } } domainControllerIPLabelNodeText = null; if(domainControllerIPLabelNode != null) { if((domainControllerIPLabelNode.firstChild != null) && (domainControllerIPLabelNode.firstChild.childNodes.length > 0)) { domainControllerIPLabelNodeText = domainControllerIPLabelNode.firstChild.childNodes[0].nodeValue; } } domainControllerNameLabelNodeText = null; if(domainControllerNameLabelNode != null) { if((domainControllerNameLabelNode.firstChild != null) && (domainControllerNameLabelNode.firstChild.childNodes.length > 0)) { domainControllerNameLabelNodeText = domainControllerNameLabelNode.firstChild.childNodes[0].nodeValue; } } processingTypeLabelNodeText = null; if(processingTypeLabelNode != null) { if((processingTypeLabelNode.firstChild != null) && (processingTypeLabelNode.firstChild.childNodes.length > 0)) { processingTypeLabelNodeText = processingTypeLabelNode.firstChild.childNodes[0].nodeValue; } } loopbackModeLabelNodeText = null; if(loopbackModeLabelNode != null) { if((loopbackModeLabelNode.firstChild != null) && (loopbackModeLabelNode.firstChild.childNodes.length > 0)) { loopbackModeLabelNodeText = loopbackModeLabelNode.firstChild.childNodes[0].nodeValue; } } processingTriggerLabelNodeText = null; if(processingTriggerLabelNode != null) { if((processingTriggerLabelNode.firstChild != null) && (processingTriggerLabelNode.firstChild.childNodes.length > 0)) { processingTriggerLabelNodeText = processingTriggerLabelNode.firstChild.childNodes[0].nodeValue; } } extensionNameLabelNodeText = null; if(extensionNameLabelNode != null) { if((extensionNameLabelNode.firstChild != null) && (extensionNameLabelNode.firstChild.childNodes.length > 0)) { extensionNameLabelNodeText = extensionNameLabelNode.firstChild.childNodes[0].nodeValue; } } timeTakenLabelNodeText = null; if(timeTakenLabelNode != null) { if((timeTakenLabelNode.firstChild != null) && (timeTakenLabelNode.firstChild.childNodes.length > 0)) { timeTakenLabelNodeText = timeTakenLabelNode.firstChild.childNodes[0].nodeValue; } } processingDetailsUserTitleNodeText = null; if(processingDetailsUserTitleNode != null) { if((processingDetailsUserTitleNode.firstChild != null) && (processingDetailsUserTitleNode.firstChild.childNodes.length > 0)) { processingDetailsUserTitleNodeText = processingDetailsUserTitleNode.firstChild.childNodes[0].nodeValue; } } processingDetailsComputerTitleNodeText = null; if(processingDetailsComputerTitleNode != null) { if((processingDetailsComputerTitleNode.firstChild != null) && (processingDetailsComputerTitleNode.firstChild.childNodes.length > 0)) { processingDetailsComputerTitleNodeText = processingDetailsComputerTitleNode.firstChild.childNodes[0].nodeValue; } } dataNotFoundWarningLabelNodeText = null; if(dataNotFoundWarningLabelNode != null) { if((dataNotFoundWarningLabelNode.firstChild != null) && (dataNotFoundWarningLabelNode.firstChild.childNodes.length > 0)) { dataNotFoundWarningLabelNodeText = dataNotFoundWarningLabelNode.firstChild.childNodes[0].nodeValue; } } totalProcessingTimeLabelNodeText = null; if(totalProcessingTimeLabelNode != null) { if((totalProcessingTimeLabelNode.firstChild != null) && (totalProcessingTimeLabelNode.firstChild.childNodes.length > 0)) { totalProcessingTimeLabelNodeText = totalProcessingTimeLabelNode.firstChild.childNodes[0].nodeValue; } } refreshMessageLabelNodeText = null; if(refreshMessageLabelNode != null) { if((refreshMessageLabelNode.firstChild != null) && (refreshMessageLabelNode.firstChild.childNodes.length > 0)) { refreshMessageLabelNodeText = refreshMessageLabelNode.firstChild.childNodes[0].nodeValue; } } if(detailsLabelNode != null) { if((detailsLabelNode.firstChild != null) && (detailsLabelNode.firstChild.childNodes.length > 0)) { detailsLabelNodeText = detailsLabelNode.firstChild.childNodes[0].nodeValue; } } slowLinkThresholdValue = null; linkSpeedValue = null; domainControllerIPValue = null; domainControllerNameValue = null; processingTypeValue = null; loopbackModeValue = null; processingTriggerValue = null; if(singlePassEventsDetailsNode != null) { slowLinkThresholdValue = singlePassEventsDetailsNode.getAttribute("SlowLinkThresholdInKbps"); linkSpeedValue = singlePassEventsDetailsNode.getAttribute("LinkSpeedInKbps"); domainControllerIPValue = singlePassEventsDetailsNode.getAttribute("DomainControllerIPAddress"); domainControllerNameValue = singlePassEventsDetailsNode.getAttribute("DomainControllerName"); processingTypeValue = singlePassEventsDetailsNode.getAttribute("ProcessingAppMode"); loopbackModeValue = singlePassEventsDetailsNode.getAttribute("PolicyProcessingMode"); processingTriggerValue = singlePassEventsDetailsNode.getAttribute("ProcessingTrigger"); totalPolicyProcessingTime = singlePassEventsDetailsNode.getAttribute("PolicyElapsedTime"); extensionProcessingTimeArray = singlePassEventsDetailsNode.getElementsByTagName("ExtensionProcessingTime"); } if(slowLinkThresholdValue == null) { slowLinkThresholdValue = dataNotFoundWarningLabelNodeText; } if(linkSpeedValue == null) { linkSpeedValue = dataNotFoundWarningLabelNodeText; } if(domainControllerIPValue == null) { domainControllerIPValue = dataNotFoundWarningLabelNodeText; } else { domainControllerIPValue = domainControllerIPValue.replace(/^\\\\/,""); } if(domainControllerNameValue == null) { domainControllerNameValue= dataNotFoundWarningLabelNodeText; } else { domainControllerNameValue= domainControllerNameValue.replace(/^\\\\/,""); } if(processingTypeValue == null) { processingTypeValue = dataNotFoundWarningLabelNodeText; } if(loopbackModeValue == null) { loopbackModeValue = dataNotFoundWarningLabelNodeText; } if(processingTriggerValue == null) { processingTriggerValue = dataNotFoundWarningLabelNodeText; } if (extensionProcessingTimeArray.length > 0) { var cseName; var cseElapsedTime; var cseProcessedTime; var cseId; var i; var index = 0; for (i = 0; i < extensionProcessingTimeArray.length; i++) { var cseNameElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionName"); var cseElapsedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ElapsedTime"); var cseProcessedTimeElements = extensionProcessingTimeArray[i].getElementsByTagName("ProcessedTime"); var cseIdElements = extensionProcessingTimeArray[i].getElementsByTagName("ExtensionGuid"); if((cseNameElements.length > 0) && (cseElapsedTimeElements.length > 0) && (cseProcessedTimeElements.length > 0) && (cseIdElements.length > 0)) { if((cseNameElements[0].firstChild != null) && (cseElapsedTimeElements[0].firstChild != null) && (cseProcessedTimeElements[0].firstChild != null) && (cseIdElements[0].firstChild != null)) { cseName = cseNameElements[0].firstChild.nodeValue; cseElapsedTime = cseElapsedTimeElements[0].firstChild.nodeValue; cseProcessedTime = cseProcessedTimeElements[0].firstChild.nodeValue; cseId = cseIdElements[0].firstChild.nodeValue; if((cseName != null)&&(cseElapsedTime != null)&&(cseProcessedTime != null)&&(cseId != null)) { cseNameArray[index]= cseName; cseElapsedTimeArray[index]= cseElapsedTime; index = index+1; if(cseId == '{00000000-0000-0000-0000-000000000000}') { policyApplicationFinishedTime = cseProcessedTime; } } } } } } var htmlText = "
"; htmlText = htmlText + ""; htmlText = htmlText + ""; htmlText = htmlText + ""; if(isComputerProcessing != null) { if(isComputerProcessing == true) { htmlText = htmlText + "" + processingDetailsComputerTitleNodeText + ""; } else { htmlText = htmlText + "" + processingDetailsUserTitleNodeText + ""; } } htmlText = htmlText + "
"; htmlText = htmlText + "
"; htmlText = htmlText + "" + refreshMessageLabelNodeText + " " + policyApplicationFinishedTime + "" ; htmlText = htmlText + "
" + detailsLabelNodeText + "
" htmltext = htmlText + "

"; htmlText = htmlText + ""; htmlText = htmlText + " "; htmlText = htmlText + "
"; htmlText = htmlText + "
" + processingTypeLabelNodeText + ""; htmlText = htmlText + " | " + processingTypeValue + "
"; htmlText = htmlText + "
" + loopbackModeLabelNodeText + ""; htmlText = htmlText + " | " + loopbackModeValue + "
"; htmlText = htmlText + "
" + linkSpeedLabelNodeText + ""; htmlText = htmlText + " | " + linkSpeedValue + "
"; htmlText = htmlText + "
" + slowLinkThresholdLabelNodeText + ""; htmlText = htmlText + " | " + slowLinkThresholdValue + "
"; htmlText = htmlText + "
" + domainControllerNameLabelNodeText + ""; htmlText = htmlText + " | " + domainControllerNameValue +"
"; htmlText = htmlText + "
" + domainControllerIPLabelNodeText + ""; htmlText = htmlText + " | " + domainControllerIPValue +"
"; htmlText = htmlText + "
" + processingTriggerLabelNodeText + ""; htmlText = htmlText + " | " + processingTriggerValue + "
"; htmlText = htmlText + "
"; htmlText = htmlText + "
"; htmlText = htmlText + "
" + extensionsProcessedLabelNodeText +"
"; htmlText = htmlText + "
"; htmlText = htmlText + "
" + extensionNameLabelNodeText + ""; htmlText = htmlText + " | " + timeTakenLabelNodeText + "
"; for (var idx in cseNameArray) { htmlText = htmlText + "
" + cseNameArray[idx] + ""; htmlText = htmlText + " | " + cseElapsedTimeArray[idx] + "
"; } if (totalPolicyProcessingTime != null) { htmlText = htmlText + "
" + totalProcessingTimeLabelNodeText +":"; htmlText = htmlText + " | " + totalPolicyProcessingTime + "
"; } htmlText = htmlText + "

"; if(windowsArray[strWindowId]) { delete windowsArray[strWindowId]; } // IE specific method for showing the popup. if(navigator.userAgent.indexOf("MSIE") > 0 && window.location.toString().indexOf("file:") == -1) { var strDiagArgs = "dialogHeight=360px;dialogWidth=630px;status=no;scroll=yes;resizable=yes;minimize=yes;maximize=yes;"; var vModeless = window.showModelessDialog("about:blank", window, strDiagArgs); vModeless.document.write(htmlText); vModeless.document.close(); vModeless.location.reload(false); windowsArray[strWindowId] = vModeless; } else { var strDiagArgs = "height=360px, width=630px, status=no, toolbar=no, scrollbars=yes, resizable=yes"; windowsArray[strWindowId] = window.open("", "" , strDiagArgs); windowsArray[strWindowId].document.write(htmlText); windowsArray[strWindowId].focus(); } } } -->
Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

DoD WinSvr 2012 R2 DC STIG Comp v3r7
Data collected on: 9/11/2023 10:39:43 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 9/5/2023 10:03:02 AM
Modified | 9/5/2023 10:04:56 AM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 1 (AD), 1 (SYSVOL)
Unique ID | {2B4E334D-E39E-4F22-8FE4-9E0A89C30D5F}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Account Policies/Password Policy

Policy | Setting
--- | ---
Enforce password history | 24 passwords remembered
Maximum password age | 60 days
Minimum password age | 1 days
Minimum password length | 14 characters
Password must meet complexity requirements | Enabled
Store passwords using reversible encryption | Disabled

Account Policies/Account Lockout Policy

Policy | Setting
--- | ---
Account lockout duration | 15 minutes
Account lockout threshold | 3 invalid logon attempts
Reset account lockout counter after | 15 minutes

Local Policies/User Rights Assignment

Policy | Setting
--- | ---
Access Credential Manager as a trusted caller |
Access this computer from the network | NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS, NT AUTHORITY\Authenticated Users, BUILTIN\Administrators
Act as part of the operating system |
Add workstations to domain | BUILTIN\Administrators
Allow log on locally | BUILTIN\Administrators
Allow log on through Terminal Services | BUILTIN\Administrators
Back up files and directories | BUILTIN\Administrators
Create a pagefile | BUILTIN\Administrators
Create a token object |
Create global objects | NT AUTHORITY\SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, BUILTIN\Administrators
Create permanent shared objects |
Create symbolic links | BUILTIN\Administrators
Debug programs | BUILTIN\Administrators
Deny access to this computer from the network | BUILTIN\Guests
Deny log on as a batch job | BUILTIN\Guests
Deny log on as a service |
Deny log on locally | BUILTIN\Guests
Deny log on through Terminal Services | BUILTIN\Guests
Enable computer and user accounts to be trusted for delegation | BUILTIN\Administrators
Force shutdown from a remote system | BUILTIN\Administrators
Generate security audits | NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE
Impersonate a client after authentication | NT AUTHORITY\SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, BUILTIN\Administrators
Increase scheduling priority | BUILTIN\Administrators
Load and unload device drivers | BUILTIN\Administrators
Lock pages in memory |
Manage auditing and security log | BUILTIN\Administrators
Modify firmware environment values | BUILTIN\Administrators
Perform volume maintenance tasks | BUILTIN\Administrators
Profile single process | BUILTIN\Administrators
Restore files and directories | BUILTIN\Administrators
Take ownership of files or other objects | BUILTIN\Administrators

Local Policies/Security Options
Accounts

Policy | Setting
--- | ---
Accounts: Guest account status | Disabled
Accounts: Limit local account use of blank passwords to console logon only | Enabled
Accounts: Rename administrator account | "X_Admin"
Accounts: Rename guest account | "Visitor"

Audit

Policy | Setting
--- | ---
Audit: Audit the access of global system objects | Disabled
Audit: Audit the use of Backup and Restore privilege | Disabled

Devices

Policy | Setting
--- | ---
Devices: Allowed to format and eject removable media | Administrators
Devices: Prevent users from installing printer drivers | Enabled

Domain Controller

Policy | Setting
--- | ---
Domain controller: LDAP server signing requirements | Require signing
Domain controller: Refuse machine account password changes | Disabled

Domain Member

Policy | Setting
--- | ---
Domain member: Digitally encrypt or sign secure channel data (always) | Enabled
Domain member: Digitally encrypt secure channel data (when possible) | Enabled
Domain member: Digitally sign secure channel data (when possible) | Enabled
Domain member: Disable machine account password changes | Disabled
Domain member: Maximum machine account password age | 30 days
Domain member: Require strong (Windows 2000 or later) session key | Enabled

Interactive Logon

Policy | Setting
--- | ---
Interactive logon: Do not display last user name | Enabled
Interactive logon: Do not require CTRL+ALT+DEL | Disabled
Interactive logon: Message text for users attempting to log on | You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
Interactive logon: Message title for users attempting to log on | "US Department of Defense Warning Statement"
Interactive logon: Number of previous logons to cache (in case domain controller is not available) | 4 logons
Interactive logon: Prompt user to change password before expiration | 14 days
Interactive logon: Smart card removal behavior | Lock Workstation

Microsoft Network Client

Policy | Setting
--- | ---
Microsoft network client: Digitally sign communications (always) | Enabled
Microsoft network client: Digitally sign communications (if server agrees) | Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled

Microsoft Network Server

Policy | Setting
--- | ---
Microsoft network server: Amount of idle time required before suspending session | 15 minutes
Microsoft network server: Digitally sign communications (always) | Enabled
Microsoft network server: Digitally sign communications (if client agrees) | Enabled
Microsoft network server: Disconnect clients when logon hours expire | Enabled

Network Access

Policy | Setting
--- | ---
Network access: Allow anonymous SID/Name translation | Disabled
Network access: Do not allow anonymous enumeration of SAM accounts | Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled
Network access: Let Everyone permissions apply to anonymous users | Disabled
Network access: Named Pipes that can be accessed anonymously | lsarpc, netlogon, samr
Network access: Remotely accessible registry paths | System\CurrentControlSet\Control\ProductOptions, System\CurrentControlSet\Control\Server Applications, Software\Microsoft\Windows NT\CurrentVersion
Network access: Remotely accessible registry paths and sub-paths | Software\Microsoft\Windows NT\CurrentVersion\Print, Software\Microsoft\Windows NT\CurrentVersion\Windows, System\CurrentControlSet\Control\Print\Printers, System\CurrentControlSet\Services\Eventlog, Software\Microsoft\OLAP Server, System\CurrentControlSet\Control\ContentIndex, System\CurrentControlSet\Control\Terminal Server, System\CurrentControlSet\Control\Terminal Server\UserConfig, System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration, Software\Microsoft\Windows NT\CurrentVersion\Perflib, System\CurrentControlSet\Services\SysmonLog
Network access: Restrict anonymous access to Named Pipes and Shares | Enabled
Network access: Shares that can be accessed anonymously |
Network access: Sharing and security model for local accounts | Classic - local users authenticate as themselves

Network Security

Policy | Setting
--- | ---
Network security: Do not store LAN Manager hash value on next password change | Enabled
Network security: Force logoff when logon hours expire | Enabled
Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirements | Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled

Shutdown

Policy | Setting
--- | ---
Shutdown: Allow system to be shut down without having to log on | Disabled

System Cryptography

Policy | Setting
--- | ---
System cryptography: Force strong key protection for user keys stored on the computer | User must enter a password each time they use a key
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing | Enabled

System Objects

Policy | Setting
--- | ---
System objects: Require case insensitivity for non-Windows subsystems | Enabled
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Enabled

System Settings

Policy | Setting
--- | ---
System settings: Optional subsystems |

User Account Control

Policy | Setting
--- | ---
User Account Control: Admin Approval Mode for the Built-in Administrator account | Enabled
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop | Disabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent
User Account Control: Behavior of the elevation prompt for standard users | Automatically deny elevation requests
User Account Control: Detect application installations and prompt for elevation | Enabled
User Account Control: Only elevate executables that are signed and validated | Disabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled
User Account Control: Run all administrators in Admin Approval Mode | Enabled
User Account Control: Switch to the secure desktop when prompting for elevation | Enabled
User Account Control: Virtualize file and registry write failures to per-user locations | Enabled

Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled
Interactive logon: Machine inactivity limit | 900 seconds
Microsoft network server: Server SPN target name validation level | Off
Network security: Allow Local System to use computer identity for NTLM | Enabled
Network security: Allow LocalSystem NULL session fallback | Disabled
Network security: Allow PKU2U authentication requests to this computer to use online identities. | Disabled
Network security: Configure encryption types allowed for Kerberos | Enabled
DES_CBC_CRC | Disabled
DES_CBC_MD5 | Disabled
RC4_HMAC_MD5 | Disabled
AES128_HMAC_SHA1 | Enabled
AES256_HMAC_SHA1 | Enabled
Future encryption types | Enabled

System Services
Smart Card Removal Policy (Startup Mode: Automatic)
Permissions
No permissions specified
Auditing
No auditing specified
Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Success, Failure

Account Management

Policy | Setting
--- | ---
Audit Computer Account Management | Success
Audit Other Account Management Events | Success
Audit Security Group Management | Success
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit Process Creation | Success

DS Access

Policy | Setting
--- | ---
Audit Directory Service Access | Success, Failure
Audit Directory Service Changes | Success

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Failure
Audit Logoff | Success
Audit Logon | Success, Failure
Audit Special Logon | Success

Object Access

Policy | Setting
--- | ---
Audit Removable Storage | Success, Failure
Audit Central Access Policy Staging | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success, Failure
Audit Authentication Policy Change | Success
Audit Authorization Policy Change | Success

Privilege Use

Policy | Setting
--- | ---
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit IPsec Driver | Success, Failure
Audit Other System Events | Success, Failure
Audit Security State Change | Success
Audit Security System Extension | Success
Audit System Integrity | Success, Failure

Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Control Panel/Personalization

Policy | Setting | Comment
--- | --- | ---
Prevent enabling lock screen slide show | Enabled |

MS Security Guide

Policy | Setting | Comment
--- | --- | ---
Apply UAC restrictions to local accounts on network logons | Enabled |
Configure SMB v1 client driver | Enabled |
Configure MrxSmb10 driver | Disable driver (recommended)
Policy | Setting | Comment
Configure SMB v1 server | Disabled |
WDigest Authentication (disabling may require KB2871997) | Disabled |

MSS (Legacy)

Policy | Setting | Comment
--- | --- | ---
MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) | Disabled |
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRoutingIPv6 | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRouting | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled |
MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds | Enabled |
KeepAliveTime | 300000 or 5 minutes (recommended)
Policy | Setting | Comment
MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. | Enabled |
NoDefaultExempt | Only ISAKMP is exempt (recommended for Windows Server 2003).
Policy | Setting | Comment
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Enabled |
MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS) | Disabled |
MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) | Enabled |
MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended) | Enabled |
ScreenSaverGracePeriod | 5
Policy | Setting | Comment
MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) | Enabled |
TcpMaxDataRetransmissions | 3
Policy | Setting | Comment
MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) | Enabled |
TcpMaxDataRetransmissions | 3
Policy | Setting | Comment
MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning | Enabled |
WarningLevel | 90%

Network/Link-Layer Topology Discovery

Policy | Setting | Comment
--- | --- | ---
Turn on Mapper I/O (LLTDIO) driver | Disabled |
Turn on Responder (RSPNDR) driver | Disabled |

Network/Microsoft Peer-to-Peer Networking Services

Policy | Setting | Comment
--- | --- | ---
Turn off Microsoft Peer-to-Peer Networking Services | Enabled |

Network/Network Connections

Policy | Setting | Comment
--- | --- | ---
Prohibit installation and configuration of Network Bridge on your DNS domain network | Enabled |
Require domain users to elevate when setting a network's location | Enabled |
Route all traffic through the internal network | Enabled |
Select from the following states: | Enabled State

Network/TCPIP Settings/Parameters

Policy | Setting | Comment
--- | --- | ---
Set IP Stateless Autoconfiguration Limits State | Enabled |

Network/Windows Connect Now

Policy | Setting | Comment
--- | --- | ---
Configuration of wireless settings using Windows Connect Now | Disabled |
Prohibit access of the Windows Connect Now wizards | Enabled |

Printers

Policy | Setting | Comment
--- | --- | ---
Extend Point and Print connection to search Windows Update | Disabled |

System

Policy | Setting | Comment
--- | --- | ---
Specify settings for optional component installation and component repair | Enabled |
Alternate source file path |
Never attempt to download payload from Windows Update | Enabled
Contact Windows Update directly to download repair content instead of Windows Server Update Services (WSUS) | Disabled

System/Audit Process Creation

Policy | Setting | Comment
--- | --- | ---
Include command line in process creation events | Enabled |

System/Device Installation

Policy | Setting | Comment
--- | --- | ---
Allow remote access to the Plug and Play interface | Disabled |
Do not send a Windows error report when a generic driver is installed on a device | Enabled |
Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point | Disabled |
Prevent device metadata retrieval from the Internet | Enabled |
Prevent Windows from sending an error report when a device driver requests additional software during installation | Enabled |
Specify search order for device driver source locations | Enabled |
Select search order: | Do not search Windows Update
Policy | Setting | Comment
Specify the search server for device driver updates | Enabled |
Select update server: | Search Managed Server

System/Driver Installation

Policy | Setting | Comment
--- | --- | ---
Turn off Windows Update device driver search prompt | Enabled |

System/Early Launch Antimalware

Policy | Setting | Comment
--- | --- | ---
Boot-Start Driver Initialization Policy | Enabled |
Choose the boot-start drivers that can be initialized: |

System/Group Policy

Policy | Setting | Comment
--- | --- | ---
Configure registry policy processing | Enabled |
Do not apply during periodic background processing | Disabled
Process even if the Group Policy objects have not changed | Enabled
Policy | Setting | Comment
Turn off background refresh of Group Policy | Disabled |

System/Internet Communication Management/Internet Communication settings

Policy | Setting | Comment
--- | --- | ---
Turn off access to the Store | Enabled |
Turn off downloading of print drivers over HTTP | Enabled |
Turn off Event Viewer "Events.asp" links | Enabled |
Turn off handwriting recognition error reporting | Enabled |
Turn off Internet File Association service | Enabled |
Turn off printing over HTTP | Enabled |
Turn off Windows Customer Experience Improvement Program | Enabled |
Turn off Windows Update device driver searching | Enabled |

System/Locale Services

Policy | Setting | Comment
--- | --- | ---
Disallow copying of user input methods to the system account for sign-in | Enabled |

System/Logon

Policy | Setting | Comment
--- | --- | ---
Do not display network selection UI | Enabled |
Enumerate local users on domain-joined computers | Disabled |
Turn off app notifications on the lock screen | Enabled |

System/Power Management/Sleep Settings

Policy | Setting | Comment
--- | --- | ---
Require a password when a computer wakes (on battery) | Enabled |
Require a password when a computer wakes (plugged in) | Enabled |

System/Remote Assistance

Policy | Setting | Comment
--- | --- | ---
Configure Offer Remote Assistance | Disabled |
Configure Solicited Remote Assistance | Disabled |
Turn on session logging | Enabled |

System/Troubleshooting and Diagnostics/Application Compatibility Diagnostics

Policy | Setting | Comment
--- | --- | ---
Detect compatibility issues for applications and drivers | Disabled |

System/Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool

Policy | Setting | Comment
--- | --- | ---
Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider | Disabled |

System/Troubleshooting and Diagnostics/Scripted Diagnostics

Policy | Setting | Comment
--- | --- | ---
Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS) | Disabled |

System/Troubleshooting and Diagnostics/Windows Performance PerfTrack

Policy | Setting | Comment
--- | --- | ---
Enable/Disable PerfTrack | Disabled |

Windows Components/App Package Deployment

Policy | Setting | Comment
--- | --- | ---
Allow all trusted apps to install | Enabled |

Windows Components/App runtime

Policy | Setting | Comment
--- | --- | ---
Allow Microsoft accounts to be optional | Enabled |

Windows Components/Application Compatibility

Policy | Setting | Comment
--- | --- | ---
Turn off Inventory Collector | Enabled |

Windows Components/AutoPlay Policies

Policy | Setting | Comment
--- | --- | ---
Disallow Autoplay for non-volume devices | Enabled |
Set the default behavior for AutoRun | Enabled |
Default AutoRun Behavior | Do not execute any autorun commands
Policy | Setting | Comment
Turn off Autoplay | Enabled |
Turn off Autoplay on: | All drives

Windows Components/Biometrics

Policy | Setting | Comment
--- | --- | ---
Allow the use of biometrics | Disabled |

Windows Components/Credential User Interface

Policy | Setting | Comment
--- | --- | ---
Do not display the password reveal button | Enabled |
Enumerate administrator accounts on elevation | Disabled |

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 196608

Windows Components/Event Log Service/Setup

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/File Explorer

Policy | Setting | Comment
--- | --- | ---
Configure Windows SmartScreen | Enabled |
Pick one of the following settings | Require approval from an administrator before running downloaded unknown software
Policy | Setting | Comment
Turn off Data Execution Prevention for Explorer | Disabled |
Turn off heap termination on corruption | Disabled |
Turn off shell protocol protected mode | Disabled |

Windows Components/Location and Sensors

Policy | Setting | Comment
--- | --- | ---
Turn off location | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Policy | Setting | Comment
--- | --- | ---
Do not allow passwords to be saved | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection

Policy | Setting | Comment
--- | --- | ---
Do not allow COM port redirection | Enabled |
Do not allow drive redirection | Enabled |
Do not allow LPT port redirection | Enabled |
Do not allow smart card device redirection | Disabled |
Do not allow supported Plug and Play device redirection | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Printer Redirection

Policy | Setting | Comment
--- | --- | ---
Redirect only the default client printer | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security

Policy | Setting | Comment
--- | --- | ---
Always prompt for password upon connection | Enabled |
Require secure RPC communication | Enabled |
Set client connection encryption level | Enabled |
Encryption Level | High Level
Choose the encryption level from the drop-down list.

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Temporary folders

Policy | Setting | Comment
--- | --- | ---
Do not delete temp folders upon exit | Disabled |
Do not use temporary folders per session | Disabled |

Windows Components/RSS Feeds

Policy | Setting | Comment
--- | --- | ---
Prevent downloading of enclosures | Enabled |
Turn on Basic feed authentication over HTTP | Disabled |

Windows Components/Windows Installer

Policy | Setting | Comment
--- | --- | ---
Allow user control over installs | Disabled |
Always install with elevated privileges | Disabled |
Prevent Internet Explorer security prompt for Windows Installer scripts | Disabled |
Prohibit non-administrators from applying vendor signed updates | Enabled |

Windows Components/Windows Logon Options

Policy | Setting | Comment
--- | --- | ---
Sign-in last interactive user automatically after a system-initiated restart | Disabled |

Windows Components/Windows Media Digital Rights Management

Policy | Setting | Comment
--- | --- | ---
Prevent Windows Media DRM Internet Access | Enabled |

Windows Components/Windows Media Player

Policy | Setting | Comment
--- | --- | ---
Do Not Show First Use Dialog Boxes | Enabled |
Prevent Automatic Updates | Enabled |

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on PowerShell Script Block Logging | Enabled |
Log script block invocation start / stop events: | Disabled

Windows Components/Windows Remote Management (WinRM)/WinRM Client

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow Digest authentication | Enabled |

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow WinRM from storing RunAs credentials | Enabled |

User Configuration (Disabled)
No settings defined.