Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

DoD WinSvr 2025 DC STIG Comp v1r2
Data collected on: 7/10/2026 8:12:58 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 7/10/2026 5:28:26 AM
Modified | 7/10/2026 6:18:50 AM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 3 (AD), 3 (SYSVOL)
Unique ID | {62D7D6D6-C97F-4E86-B9A1-C2A9A5C493DA}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/User Rights Assignment

Policy | Setting
--- | ---
Access Credential Manager as a trusted caller |
Access this computer from the network | NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS, NT AUTHORITY\Authenticated Users, BUILTIN\Administrators
Act as part of the operating system |
Add workstations to domain | BUILTIN\Administrators
Allow log on locally | BUILTIN\Administrators
Allow log on through Terminal Services | BUILTIN\Administrators
Back up files and directories | BUILTIN\Administrators
Create a pagefile | BUILTIN\Administrators
Create a token object |
Create global objects | BUILTIN\Administrators, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\SERVICE
Create permanent shared objects |
Create symbolic links | BUILTIN\Administrators
Debug programs | BUILTIN\Administrators
Deny access to this computer from the network | BUILTIN\Guests
Deny log on as a batch job | BUILTIN\Guests
Deny log on as a service |
Deny log on locally | BUILTIN\Guests
Deny log on through Terminal Services | BUILTIN\Guests
Enable computer and user accounts to be trusted for delegation | BUILTIN\Administrators
Force shutdown from a remote system | BUILTIN\Administrators
Generate security audits | NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE
Impersonate a client after authentication | BUILTIN\Administrators, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\SERVICE
Increase scheduling priority | BUILTIN\Administrators
Load and unload device drivers | BUILTIN\Administrators
Lock pages in memory |
Manage auditing and security log | BUILTIN\Administrators
Modify firmware environment values | BUILTIN\Administrators
Perform volume maintenance tasks | BUILTIN\Administrators
Profile single process | BUILTIN\Administrators
Restore files and directories | BUILTIN\Administrators
Take ownership of files or other objects | BUILTIN\Administrators

Local Policies/Security Options
Accounts

Policy | Setting
--- | ---
Accounts: Guest account status | Disabled
Accounts: Limit local account use of blank passwords to console logon only | Enabled
Accounts: Rename administrator account | "X_Admin"
Accounts: Rename guest account | "Visitor"

Domain Controller

Policy | Setting
--- | ---
Domain controller: LDAP server signing requirements | Require signing
Domain controller: Refuse machine account password changes | Disabled

Domain Member

Policy | Setting
--- | ---
Domain member: Digitally encrypt or sign secure channel data (always) | Enabled
Domain member: Digitally encrypt secure channel data (when possible) | Enabled
Domain member: Digitally sign secure channel data (when possible) | Enabled
Domain member: Disable machine account password changes | Disabled
Domain member: Maximum machine account password age | 30 days
Domain member: Require strong (Windows 2000 or later) session key | Enabled

Interactive Logon

Policy | Setting
--- | ---
Interactive logon: Message text for users attempting to log on | You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only., By using this IS (which includes any device attached to this IS), you consent to the following conditions:, -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations., -At any time, the USG may inspect and seize data stored on this IS., -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose., -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy., -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
Interactive logon: Message title for users attempting to log on | "US Department of Defense Warning Statement"
Interactive logon: Smart card removal behavior | Lock Workstation

Microsoft Network Client

Policy | Setting
--- | ---
Microsoft network client: Digitally sign communications (always) | Enabled
Microsoft network client: Digitally sign communications (if server agrees) | Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled

Microsoft Network Server

Policy | Setting
--- | ---
Microsoft network server: Digitally sign communications (always) | Enabled
Microsoft network server: Digitally sign communications (if client agrees) | Enabled

Network Access

Policy | Setting
--- | ---
Network access: Allow anonymous SID/Name translation | Disabled
Network access: Do not allow anonymous enumeration of SAM accounts | Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled
Network access: Let Everyone permissions apply to anonymous users | Disabled
Network access: Restrict anonymous access to Named Pipes and Shares | Enabled

Network Security

Policy | Setting
--- | ---
Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirements | Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled

System Cryptography

Policy | Setting
--- | ---
System cryptography: Force strong key protection for user keys stored on the computer | User must enter a password each time they use a key
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing | Enabled

System Objects

Policy | Setting
--- | ---
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Enabled

User Account Control

Policy | Setting
--- | ---
User Account Control: Admin Approval Mode for the Built-in Administrator account | Enabled
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop | Disabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent on the secure desktop
User Account Control: Behavior of the elevation prompt for standard users | Automatically deny elevation requests
User Account Control: Detect application installations and prompt for elevation | Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled
User Account Control: Run all administrators in Admin Approval Mode | Enabled
User Account Control: Virtualize file and registry write failures to per-user locations | Enabled

Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled
Interactive logon: Machine inactivity limit | 900 seconds
Network security: Allow Local System to use computer identity for NTLM | Enabled
Network security: Allow LocalSystem NULL session fallback | Disabled
Network security: Allow PKU2U authentication requests to this computer to use online identities. | Disabled
Network security: Configure encryption types allowed for Kerberos | Enabled
DES_CBC_CRC | Disabled
DES_CBC_MD5 | Disabled
RC4_HMAC_MD5 | Disabled
AES128_HMAC_SHA1 | Enabled
AES256_HMAC_SHA1 | Enabled
Future encryption types | Enabled

Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Success, Failure
Audit Other Account Logon Events | Success

Account Management

Policy | Setting
--- | ---
Audit Computer Account Management | Success
Audit Security Group Management | Success
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit PNP Activity | Success
Audit Process Creation | Success

DS Access

Policy | Setting
--- | ---
Audit Directory Service Access | Success, Failure
Audit Directory Service Changes | Success, Failure

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Success, Failure
Audit Group Membership | Success
Audit Logoff | Success
Audit Logon | Success, Failure
Audit Special Logon | Success

Object Access

Policy | Setting
--- | ---
Audit Handle Manipulation | Failure
Audit Other Object Access Events | Success, Failure
Audit Registry | Success, Failure
Audit Removable Storage | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success, Failure
Audit Authentication Policy Change | Success
Audit Authorization Policy Change | Success

Privilege Use

Policy | Setting
--- | ---
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit IPsec Driver | Success, Failure
Audit Other System Events | Success, Failure
Audit Security State Change | Success
Audit Security System Extension | Success
Audit System Integrity | Success, Failure

Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Control Panel/Personalization

Policy | Setting | Comment
--- | --- | ---
Prevent enabling lock screen slide show | Enabled |

MS Security Guide

Policy | Setting | Comment
--- | --- | ---
Configure SMB v1 client driver | Enabled |
Configure MrxSmb10 driver | Disable driver (recommended)
Policy | Setting | Comment
Configure SMB v1 server | Disabled |

MSS (Legacy)

Policy | Setting | Comment
--- | --- | ---
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level | Enabled |
DisableIPSourceRoutingIPv6 | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (DisableIPSourceRouting) IP source routing protection level | Enabled |
DisableIPSourceRouting | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled |
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Enabled |

Network/Lanman Workstation

Policy | Setting | Comment
--- | --- | ---
Enable insecure guest logons | Disabled |

Network/Network Provider

Policy | Setting | Comment
--- | --- | ---
Hardened UNC Paths | Enabled |
Specify hardened network paths. In the name field, type a fully-qualified UNC path for each network resource. To secure all access to a share with a particular name, regardless of the server name, specify a server name of '*' (asterisk). For example, "\\*\NETLOGON". To secure all access to all shares hosted on a server, the share name portion of the UNC path may be omitted. For example, "\\SERVER". In the value field, specify one or more of the following options, separated by commas: 'RequireMutualAuthentication=1': Mutual authentication between the client and server is required to ensure the client connects to the correct server. 'RequireIntegrity=1': Communication between the client and server must employ an integrity mechanism to prevent data tampering. 'RequirePrivacy=1': Communication between the client and the server must be encrypted to prevent third parties from observing sensitive data.
Hardened UNC Paths: |
--- | ---
\\*\SYSVOL | Value: RequireMutualAuthentication=1, RequireIntegrity=1
\\*\NETLOGON | Value: RequireMutualAuthentication=1, RequireIntegrity=1
You should require both Integrity and Mutual Authentication for any UNC paths that host executable programs, script files, or files that control security policies. Consider hosting files that do not require Integrity or Privacy on separate shares from those that absolutely need such security for optimal performance. For additional details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

System/Audit Process Creation

Policy | Setting | Comment
--- | --- | ---
Include command line in process creation events | Enabled |

System/Credentials Delegation

Policy | Setting | Comment
--- | --- | ---
Remote host allows delegation of non-exportable credentials | Enabled |

System/Device Guard

Policy | Setting | Comment
--- | --- | ---
Turn On Virtualization Based Security | Enabled |
Select Platform Security Level: | Secure Boot
Virtualization Based Protection of Code Integrity: | Not Configured
Require UEFI Memory Attributes Table | Disabled
Credential Guard Configuration: | Not Configured
Machine Identity Isolation Configuration: | Not Configured
Secure Launch Configuration: | Not Configured
Kernel-mode Hardware-enforced Stack Protection: | Not Configured

System/Internet Communication Management/Internet Communication settings

Policy | Setting | Comment
--- | --- | ---
Turn off downloading of print drivers over HTTP | Enabled |
Turn off printing over HTTP | Enabled |

System/Logon

Policy | Setting | Comment
--- | --- | ---
Do not display network selection UI | Enabled |

System/Power Management/Sleep Settings

Policy | Setting | Comment
--- | --- | ---
Require a password when a computer wakes (on battery) | Enabled |
Require a password when a computer wakes (plugged in) | Enabled |

Windows Components/Application Compatibility

Policy | Setting | Comment
--- | --- | ---
Turn off Inventory Collector | Enabled |

Windows Components/AutoPlay Policies

Policy | Setting | Comment
--- | --- | ---
Disallow Autoplay for non-volume devices | Enabled |
Set the default behavior for AutoRun | Enabled |
Default AutoRun Behavior | Do not execute any autorun commands
Policy | Setting | Comment
Turn off Autoplay | Enabled |
Turn off Autoplay on: | All drives

Windows Components/Credential User Interface

Policy | Setting | Comment
--- | --- | ---
Enumerate administrator accounts on elevation | Disabled |

Windows Components/Data Collection and Preview Builds

Policy | Setting | Comment
--- | --- | ---
Allow Diagnostic Data | Enabled |
| Send required diagnostic data

Windows Components/Delivery Optimization

Policy | Setting | Comment
--- | --- | ---
Download Mode | Enabled |
Download Mode: | LAN (1)

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 196608

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Policy | Setting | Comment
--- | --- | ---
Do not allow passwords to be saved | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection

Policy | Setting | Comment
--- | --- | ---
Do not allow drive redirection | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security

Policy | Setting | Comment
--- | --- | ---
Always prompt for password upon connection | Enabled |
Require secure RPC communication | Enabled |
Set client connection encryption level | Enabled |
Encryption Level | High Level
Choose the encryption level from the drop-down list.

Windows Components/RSS Feeds

Policy | Setting | Comment
--- | --- | ---
Prevent downloading of enclosures | Enabled |

Windows Components/Search

Policy | Setting | Comment
--- | --- | ---
Allow indexing of encrypted files | Disabled |

Windows Components/Windows Defender SmartScreen/Explorer

Policy | Setting | Comment
--- | --- | ---
Configure Windows Defender SmartScreen | Enabled |
Pick one of the following settings: | Warn and prevent bypass

Windows Components/Windows Installer

Policy | Setting | Comment
--- | --- | ---
Allow user control over installs | Disabled |
Always install with elevated privileges | Enabled |
This policy setting must be set for the machine and the user to be enforced.

Windows Components/Windows Logon Options

Policy | Setting | Comment
--- | --- | ---
Sign-in and lock last interactive user automatically after a restart | Disabled |

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on PowerShell Script Block Logging | Enabled |
Log script block invocation start / stop events: | Disabled
Policy | Setting | Comment
Turn on PowerShell Transcription | Enabled |
Transcript output directory | C:\ProgramData\PS_Transcript
Include invocation headers: | Disabled

Windows Components/Windows Remote Management (WinRM)/WinRM Client

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow Digest authentication | Enabled |

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow WinRM from storing RunAs credentials | Enabled |

User Configuration (Disabled)
No settings defined.