Home > Security Measures > Securing the Domain Controllers Policy

Securing the Domain Controllers Policy

The default Domain Controllers Policy controls and governs the assignment of numerous vital local policies, user rights and privileges on Domain Controllers, and securing it is amongst the most important of all Active Directory Security Measures.

Note - Account Policies (Password Policy, Account Lockout Policy and Kerberos policy) that apply to domain user accounts and Kerberos authentication are configured in the default Domain Policy, which is separate from the default Domain Controllers Policy.

There are 3 local policies that need to be adequately configured -

AUDIT POLICY
1. Audit account logon events - This policy controls whether or not account logon events are generated when domain accounts are authenticated on domain controllers.
  
  Default: Audit Success Recommendation: Audit Success and Failure
2. Audit account management - This policy controls whether or not account management events are generated when domain accounts are created, modified or deleted.
  
  Default: Audit Success Recommendation: No change
3. Audit directory service access - This policy controls whether or not directory service access events are generated when an Active Directory object (with a SACL) is accessed.
  
  Default: Audit Success Recommendation: No change
4. Audit logon events - This policy controls whether or not logon events are generated when a domain account logs interatively (or via a network logon) on to a Domain Controller.
  
  Default: Audit Success Recommendation: No change
5. Audit object access - This policy controls whether or not access events are generated when non-Active Directory securable objects (with a SACL) are accessed.
  
  Default: No auditing Recommendation: No change
6. Audit policy change - This policy controls whether or not policy change events are generated when changes are made to user rights assignment policies, audit policies or trust policies.
  
  Default: Audit Success Recommendation: No change
7. Audit privilege use - This policy controls whether or not events are generated when a security principals excercises a user right or privilege (e.g. Take ownership of files or other objects.)
  
  Default: No auditing Recommendation: No change
  
  Note - The exercise of the following rights/privileges is not audited even if auditing is enabled – Bypass traverse checking, Debug programs, Create a token object, Replace process level tokens, Generate security audits, Backup files and directories, Restore files and directories
  To audit the exercise of these seven specific user rights and privileges, you must enable the FullPrivilegeAuditing registry key.
8. Audit process tracking - This policy controls whether or not process related events (e.g. process creation, termination, handle duplication etc.) and indirect object access.
  
  Default: No auditing Recommendation: Audit success
9. Audit system events - This policy controls whether or not system events are generated when someone restarts or shuts down a DC or when an event affects the security or system security logs.
  
  Default: Audit Success Recommendation: No change

USER RIGHTS ASSIGNMENT
1. Access Credential Manager as a trusted caller - This privilege is used by Credential Manager during Backup and Restore.
  
  Default: Not Defined Recommendation: No change
2. Access this computer from the network - This user right determines which users and groups are allowed to connect to the computer over the network. (It does not affect access via Remote Desktop Services.)
  
  Default: Administrators, Authenticated Users, Enterprise Domain Controllers, Everyone, Pre-Windows 2000 Compatible Access Recommendation: No change
3. Act as part of the operating system - This privilege allows a process to impersonate any user without authentication.
  
  Default: Not Defined Recommendation: No change
4. Add workstations to domain - This privilege governs which users or groups can add computers to a domain. Any user that has this right can add up to 10 computers to the domain via the exercise of this user right.
  
  Default: Authenticated Users Recommendation: Organizations may wish to consider changing it such that only members of the IT team can add computers to the domain.
  
  Note - When a computer is joined to the domain via the exercise of this right, the owner of the computer account is the Domain Admins group. In contrast, when a computer is added to the domain via security permissions, the owner is the creator of the computer account.
  
  Note 2 - By default, any security principal that has this right assigned can join up to 10 computer to the domain. This number can be custom configured (such as set to 0) by modifying the ms-DS-MachineAccountQuota attribute on the domain root object.
5. Adjust memory quotas for a process - This privilege determines who can change the maximum memory that can be consumed by a process.
  
  Default: Administrators, Local Service, Network Service Recommendation: No change
6. Allow log on locally - This user right governs who can log on locally to a Domain Controller
  
  Default: Account Operators, Administrators, Backup Operators, Enterprise Domain Controllers, Print Operators, Server Operators
  Recommendation: Strongly consider removing Account Operators, Print Operators and Server Operators groups from the list of groups granted this user right.
7. Allow log on through Remote Desktop Services - This user right governs who can logon to a Domain Controller as a Remote Desktop Services client
  
  Default: Administrators Recommendation: No change
8. Back up files and directories - This privilege determines which users can bypass directory, registry and other persistent object permissions for the purposes of backing up a system.
  
  Default: Administrators, Backup Operators, Server Operators
  Recommendation: Consider removing Server Operators from the list of groups granted this user right.
9. Bypass traverse checking - This privilege determines which users can traverse directory trees even though they may not have permissions on the traversed directory. It only allows them the ability to traverse directories, not to list contents.
  
  Default: Administrators, Authenticated Users, Everyone, Local Service, Network Service, Pre-Windows 2000 Compatible access, RESTRICTED SERVICES\PrintSpoolerService Recommendation: No change
10. Change the system time - This privilege controls who can change the system time on a Domain Controller.
  
  Default: Administrators, Local Service, Server Operators Recommendation: Consider removing Server Operators from the list of groups granted this user right.
11. Change the time zone - - This user right controls who can change the time zone used by the Domain Controller for displaying the local time.
  
  Default: Administrators, Local Service, Server Operators Recommendation: Consider removing Server Operators from the list of groups granted this user right.
12. Create a pagefile - This user right determines which users and groups can call an internal API to create and change the size of a page file on a Domain Controller.
  
  Default: Administrators Recommendation: No change
13. Create a token object - This privilege determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal API to create an access token.
  
  Default: Not Defined Recommendation: No change
14. Create global objects - This user right determines whether users can create global objects that are available to all sessions.
  
  Default: Administrators, Local Service, Network Service, Service Recommendation: No change
15. Create permanent shared objects - This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system.
  
  Default: Not Defined Recommendation: No change
16. Create symbolic links - This privilege determines if a user can create a symbolic link from the computer he/she is logged on to.
  
  Default: Administrators Recommendation: No change
17. Debug programs - Thus privilege determined which users can attack a debugger to any process or to the kernel. This user right provides complete access to sensitive and critical operating system components.
  
  Default: Administrators Recommendation: No change
18. Deny access to this computer from the network - This user right determines which users are prevented from accessing a computer over the network.
  
  Default: Not Defined Recommendation: No change
19. Deny log on as a batch job - This user right determines which accounts are prevented from being able to log on as a batch job. This policy supersedes the Logon as a batch job setting (when a user is subject to both policies.)
  
  Default: Not Defined Recommendation: No change
20. Deny log on as a service - This user right determines which service accounts are prevented from registering a process as a service. This policy supersedes the Logon as a service setting (when an account is subject to both policies.)
  
  Default: Not Defined Recommendation: No change
21. Deny log on locally - This user right determines which users are prevented from logging on to the Domain Controller. It supersedes the Allow log on locally user right (when an account is subject to both policies.)
  
  Default: Not Defined Recommendation: No change
22. Deny log on through Remote Desktop Services - This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services Client.
  
  Default: Not Defined Recommendation: No change
23. Enable computer and user accounts to be trusted for delegation - This privilege determines which users can set the Trusted for Delegation setting on user or computer objects in Active Directory.
  
  Default: Administrators Recommendation: No change
  
  Note - To be able to successfully make this change on user/computer objects, In addition to this user right, the account making the change on a user/computer object should also have Write Property - userAccountControl Active Directory Effective Permissions on these objects.
24. Force shutdown from a remote system - Thus privilege determines which users are allowed to shut down a domain controller from a remote location on the network.
  
  Default: Administrators, Server Operators Recommendation: Consider removing Server Operators from the list of groups granted this user right.
25. Generate security audits - This privilege determines which accounts can be used by a process to add entries to the security log on a Domain Controller.
  
  Default: Local Service, Network Service, RESTRICTED SERVICES\PrintSpoolerService Recommendation: No change
26. Impersonate a client after authentication - Assigning this privilege to a user allows programs running on behalf of that user to impersonate a client.
  
  Default: Local Service, Network Service, Administrators, SERVICE, RESTRICTED SERVICES\PrintSpoolerService Recommendation: Remove RESTRICTED SERVICES\PrintSpoolerService from list of groups granted this right.
  
  Note - As such, it is highly recommended that one disable the PrintSpoolerService on Domain Controllers.
27. Increase a process working set - This privilege determines which user accounts can increase or decrease the size of a process's working set (, which impacts the amount of physical memory available to the rest of the system.)
  
  Default: Users Recommendation: No change
28. Increase scheduling priority - This privilege determines which user accounts can user a process with Write Property access to another process to increase the execution priority assigned to the other process.
  
  Default: Administrators, Window Manager\Windows Manager Group Recommendation: No change
29. Load and unload device drivers - This privilege determines which users can dynamically load and unload device drivers or other code into kernel mode.
  
  Default: Administrators, Print Operators Recommendation: Strongly consider removing Print Operators from the list of groups granted this user right.
30. Lock pages in memory - This privilege determines which accounts can use a process to keep data in physical memory (, which prevents the system from paging the data to virtual memory on disk.)
  
  Default: Not Defined Recommendation: No change
31. Log on as a batch job - This user right allows a user to be logged on by means of a batch-queue facility and is provided for compatability with older versions of Windows.
  
  Default: Administrators, Backup Operators, Performance Log Users Recommendation: No change
32. Log on as a service - This user right allows a security principal to logon as a service.
  
  Default: NT SERVICE\ALL SERVICES, RESTRICTED SERVICE\ALL RESTRICTED SERVICES Recommendation: No change
  
  Note - Services running as Local System, Local Service or Network Service have a built-in right to logon as a service.
33. Manage auditing and security log - Thus privilege controls which users can specify object access auditing options for individual securable resources, such as files, Active Directory objects and registry keys.
  
  Default: Administrators Recommendation: No change
34. Modify an object label - This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users.
  
  Default: Not Defined Recommendation: No change
35. Modify firmware environment values - This privilege controls who can modify firmware environment variables.
  
  Default: Administrators Recommendation: No change
36. Obtain an impersonation token for another user in the same session - Assigning this privilege to a user allows programs running on behalf of that user to obtain an impersonation token of other uses who interactively logged on with the same session provided the caller has an impersonation token of the session user.
  
  Default: Administrators, Local Service, Network Service, Service Recommendation: No change
37. Perform volume maintenance tasks - Thus user right determines which users and groups can run maintenance tasks (e.g. defragmentation) on a volume.
  
  Default: Administrators Recommendation: No change
38. Profile single process - This privilege determines which users can use performance monitoring tools to monitor the performance of non system processes.
  
  Default: Administrators Recommendation: No change
39. Profile system performance - This privilege determines which users can use performance monitoring tools to monitor the performance of system processes.
  
  Default: Administrators, NT Service\WdiServiceHost Recommendation: No change
40. Remove computer from docking station - This privilege determines whether a user can undock a portable cmputer from its docking station without logging in.
  
  Default: Administrators Recommendation: No change
41. Replace a process level token - This privilege determines which user accounts can call the CreatProcessAsUser() API so that once service can start another.
  
  Default: Local Service, Network Service Recommendation: No change
42. Restore files and directories - This privilege determines which users can bypass directory, registry and other persistent object permissions for the purposes of restoring a system.
  
  Default: Administrators, Backup Operators, Server Operators
  Recommendation: Consider removing Server Operators from the list of groups granted this user right.
43. Shut down the system - This privilege controls which users who are logged on locally on to a Domain Controlloer can shut down the Domain Controller using the Shut Down command.
  
  Default: Administrators, Backup Operators, Server Operators, Print Operators
  Recommendation: Consider removing Server Operators and Print Operators from the list of groups granted this user right.
44. Synchronize directory service data - This privilege determines which users and groups have the authority to synchronize all directory service data.
  
  Default: Not Defined Recommendation: No change
45. Take ownership of files or other objects - This privilege determines which users can take ownership pf any securable object in the system, including Active Directory objects i.e. the contents of Active Directory.
  
  Default: Administrators Recommendation: No change

SECURITY OPTIONS
1. Accounts: Administrator account status - This setting determines if the local Administrator account is enabled or disabled.
  
  Default: Not Defined Recommendation: No change
2. Accounts: Block Microsoft accounts - This setting determines whether the Settings app can be used to add a Microsoft account for single sign-on (SSO) to Microsoft Services and some background services, or other apps and services.
  
  Default: Not Defined Recommendation: No change
3. Accounts: Guest account status - This setting determines if the Guest account is enabled or disabled.
  
  Default: Not Defined Recommendation: No change
4. Accounts: Limit local account use of blank passwords to console logon only - This setting determines whether local accounts that are not password protected can be used to logon from locations other than the physical computer console.
  
  Default: Not Defined Recommendation: Enabled
5. Accounts: Rename administrator account - This setting determines whether a different account name is associated with the security identifier (SID) for the well-known account Administrator.
  
  Default: Not Defined Recommendation: No change
6. Accounts: Rename guest account - This setting determines whether a different account name is associated with the security identifier (SID) for the well-known account Guest.
  
  Default: Not Defined Recommendation: No change
7. Audit: Audit the access of global system objects - This setting determines whether to audit the access of global system objects.
  
  Default: Not Defined Recommendation: No change
8. Audit: Audit the use of Backup and Restore privilege - This setting determines whether to audit the use of all user privileges, including the Backup and Restore, when the Audit privilege use policy is in effect.
  
  Default: Not Defined Recommendation: No change
9. Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings - This setting determines whether to force audit policy subcategory settings to override audit policy default settings.
  
  Default: Not Defined Recommendation: Enabled
10. Audit: Shut down system immediately if unable to log security audits - This setting controls whether or not the system should shut down immediately if unable to log security audits
  
  Default: Not Defined Recommendation: Configuring this option depends on the unique security needs of your organization.
11. DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax - This setting determines which users of groups can access DCOM applications remotely or locally.
  
  Default: Not Defined Recommendation: No change
12. DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax - This setting determines which users of groups can launch or activate DCOM applications remotely or locally.
  
  Default: Not Defined Recommendation: No change
13. Devices: Allow undock without having to log on - This setting determines whether a portable computer can be undocked without having to log on.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - This policy will realistically never impact a production DC because no security conscious organization will deploy a DC on a laptop, which is the only kind of machine that can be undocked from a docking station.
14. Devices: Allowed to format and eject removable media - This setting determines who is allowed to format and eject removable NTFS media.
  
  Default: Not Defined Recommendation: No change
  
  Note - When this setting is disabled, by default, only Administrators have this ability.
15. Devices: Prevent users from installing printer drivers - This setting determines who is allowed to install a printer driver as part of connecting to a shared printer.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer.
16. Devices: Restrict CD-ROM access to locally logged-on user only - This setting determines whether a CD-ROM is accessible to both local and remote users simultaneously.
  
  Default: Not Defined Recommendation: Enabled
17. Devices: Restrict floppy access to locally logged-on user only - This setting determines whether removable floppy media are accessible to both local and remote users simultaneously.
  
  Default: Not Defined Recommendation: Enabled
18. Domain controller: Allow computer account re-use during domain join - This setting determines whether a DC will allow a client identity to attempt to re-use an existing computer account owned by a different identity during domain-join.
  
  Default: Not Defined Recommendation: No change
19. Domain controller: Allow server operators to schedule tasks - This setting determines if Server Operators are allowed to submit jobs by means of the AT schedule facility.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - When this policy is not defined, (as it the case with all undefined policies,) the system treats it as disabled.
20. Domain controller: Allow vulnerable Netlogon secure channel connections - This setting determines whether the DC bypasses secure RPC for Netlogon secure channel connections for specified machine accounts.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - This policy is not configured (defined) by default, and no machines or trust accounts are explicitly exempt from secure RPC with Netlogon secure channel connections enforcement.
21. Domain controller: LDAP server channel binding token requirements - This setting determines whether the LDAP server enforces the validation of Channel Binding Tokens received in LDAP bind requests sent over LDAPS connections.
  
  Default: Not Defined Recommendation: Always
  
  Note - This policy is not defined by default, and its default behavior is as follows - Clients that advertise support for Channel Binding Tokens must provide the correct token when authenticating over TLS/SSL connections.
22. Domain controller: LDAP server signing requirements - This setting determines whether the LAP server requires signing to be negotiated with LDAP clients.
  
  Default: None Recommendation: Require signing
  
  Note - When defined as None, its behaviour is as follows - Data signing is not required in order to bind with the server. If the client requests data signing, the server supports it.
23. Domain controller: LDAP server signing requirements Enforcement - This setting determines whether the LDAP server enforces signing to be negotiated with LDAP clients.
  
  Default: Not Defined Recommendation: No change
  
  Note - This policy will override the Domain Controller: LDAP server signing requirements policy unless it is disabled. If this policy is not defined, its default behaviour is to enforce LDAP Signing regardless of what is set in the LDAP signing policy.
24. Domain controller: Refuse machine account password changes - This setting determines whether Domain Controllers will refuse requests from member computers to change computer account passwords.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - When this policy is not defined, (as it the case with all undefined policies,) the system treats it as disabled.
25. Domain controller: Refuse setting default machine account password - This setting determines whether Domain Controllers will refuse setting default machine account passwords upon creation.
  
  Default: Not Defined Recommendation: No change
26. Domain member: Digitally encrypt or sign secure channel data (always) - This setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted
  
  Default: Enabled Recommendation: No change
  
  Note - If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting.
27. Domain member: Digitally encrypt secure channel data (when possible) - This setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - Since the policy Digitally encrypt or sign secure channel data (always) is enabled, this policy is assumed to be enabled even if it is not defined.
28. Domain member: Digitally sign secure channel data (when possible) - This setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - Since the policy Digitally encrypt or sign secure channel data (always) is enabled, this policy is assumed to be enabled even if it is not defined.
29. Domain member: Disable machine account password changes - This setting determines whether a domain member periodically changes its computer account password.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - When this policy is not defined, (as it the case with all undefined policies,) the system treats it as disabled.
30. Domain member: Maximum machine account password age - This setting determines how often a domain member will attempt to change its computer account password.
  
  Default: Not Defined Recommendation: 30 days
  
  Note - When this policy is not defined, the default value of this setting is 30 days.
31. Domain member: Require strong (Windows 2000 or later) session key - This setting determines whether 128-bit encryption key strength is required for encrypted secure channel data.
  
  Default: Not Defined Recommendation: Enabled
32. Interactive logon: Display user information when the session is locked - This setting controls whether details such as email address or domain\username appear with the username on the sign-in screen.
  
  Default: Not Defined Recommendation: No change
33. Interactive logon: Do not require CTRL+ALT+DEL - This setting determines whether pressing the CTRL+ALT+DEL is required before a user logon
  
  Default: Not Defined Recommendation: Disabled
34. Interactive logon: Don't display last signed-in - This setting determines whether the Windows sign-in screen will show the username of the last person who signed on to this PC.
  
  Default: Not Defined Recommendation: Enabled
35. Interactive logon: Don't display username at sign-in - This setting determines whether the username of the person signing in to this PC appears at Windows sign-in after credentials are entered and before the desktop is shown.
  
  Default: Not Defined Recommendation: No change
  
  Note - When this policy is not defined, (as it the case with all undefined policies,) the system treats it as disabled.
36. Interactive logon: Machine account lockout threshold - This setting determines the number of failed logon attempts that causes the machine to reboot.
  
  Default: Not Defined Recommendation: No change
  
  Note - Machines with Bitlocker enabled for protecting operating system volumes will be locked out and can only be recovered by providing a recovery key at console. The default value is 0, and when the value is 0, the machine will never be locked out.
37. Interactive logon: Machine inactivity limit - This setting determines the amount of inactive time after which a screen saver will run, locking a logon session.
  
  Default: Not Defined Recommendation: 900 seconds
38. Interactive logon: Message text for users attempting to log on - This setting specifies a text message (e.g. a legal warning etc.) that is displayed to users when they log on.
  
  Default: Not Defined Recommendation: It is advisable to display a legal warning message, ideally one that has been approved by the organization's HR and legal departments.
39. Interactive logon: Message title for users attempting to log on - This setting allows the specification of a title to appear in the title bar of the window that contains the interative logon message text for users attempting to log on.
  
  Default: Not Defined Recommendation: The value of this field should be determined in conjunction with the message configured to be displayed in the previous setting (Interactive logon: Message text for users attempting to log on).
40. Interactive logon: Number of previous logons to cache (in case domain controller is not available) - This setting determines the number of previous logons to cache in the event that no DC is available to process the log on.
  
  Default: Not Defined Recommendation: No change
41. Interactive logon: Prompt user to change password before expiration - This setting determines how far in advance (in days) users are warned that their password is about to expire.
  
  Default: Not Defined Recommendation: No change
  
  Note - When this policy is not defined, the default value is 5 days.
42. Interactive logon: Require Domain Controller authentication to unlock workstation - This setting determines whether a DC must be contacted to unlock a computer. If disabled, a user can unlock the computer using cached credentials.
  
  Default: Not Defined Recommendation: Enabled
43. Interactive logon: Require Windows Hello for Business or smart card - This setting determines whether users are required to sign-in to a device using Windows Hello for Business or a smart card.
  
  Default: Not Defined Recommendation: If your organization utilizes PKI (e.g. Active Directory Certificate Services) and uses Smart cards for client authentication, especially for administrative personnel, enable this policy.
44. Interactive logon: Smart card removal behavior - This setting determines what happens when the smart card for a logged-on user is removed from the smart card reader.
  
  Default: Not Defined Recommendation: Force logoff
  
  Note - When enabled, the options for this policy setting include - No Action, Lock Workstation, Force Logoff and Disconnect (if logged on over a Remote Desktop Services session). The default is No Action.
45. Microsoft network client: Digitally sign communications (always) - This setting determines whether packet signing is required by the SMB client component.
  
  Default: Not Defined Recommendation: Enabled
46. Microsoft network client: Digitally sign communications (if server agrees) - This setting determines whether the SMB client attempts to negotiate SMB packet signing.
  
  Default: Not Defined Recommendation: No change
47. Microsoft network client: Send unencrypted password to third-party SMB servers - This setting determines whether the SMB redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.
  
  Default: Not Defined Recommendation: Disabled
48. Microsoft network server: Amount of idle time required before suspending session - This setting determines the amount of continuous idle time that must pass in a SMB session before the session is suspended due to inactivity.
  
  Default: Not Defined Recommendation: 15 minutes
  
  Note - When this policy is not defined, the default value is 15 minutes for servers.
49. Microsoft network server: Attempt S4U2Self to obtain claim information - This setting determines whether the local file server will attempt to use Kerberos S4U2Self functionality to obtain a network client's principal's lcimas from the client's account domain.
  
  Default: Not Defined Recommendation: No change
50. Microsoft network server: Digitally sign communications (always) - This setting determines whether packet signing is required by default by the SMB server component.
  
  Default: Enabled Recommendation: No change
51. Microsoft network server: Digitally sign communications (if client agrees) - This setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.
  
  Default: Enabled Recommendation: No change
  
  Note - This policy only affects SMBv1 behavior. SMBv1 has been deprecated in Windows. This is effecively replaced by the policy Microsoft network server: Digitally sign communications (always).
52. Microsoft network server: Disconnect clients when logon hours expire - This setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours.
  
  Default: Not Defined Recommendation: Enabled
53. Microsoft network server: Server SPN target name validation level - This setting controls the level of validation that a server performs on the SPN that is provided by a client computer when it establishes a session using the SMB protocol.
  
  Default: Not Defined Recommendation: No change
54. Network access: Allow anonymous SID/Name translation - This setting determines whether an anonymous user can request Security Identifier (SID) attributes for another user.
  
  Default: Disabled Recommendation: Disabled
55. Network access: Do not allow anonymous enumeration of SAM accounts - This setting determines what additional permissions will be granted for anonymous connections to a computer.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - This policy has no impact on Domain Controllers.
56. Network access: Do not allow anonymous enumeration of SAM accounts and shares - This setting determines whether anonymous enumeration of SAM accounts and shares is allowed.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - This policy has no impact on Domain Controllers.
57. Network access: Do not allow storage of passwords and credentials for network authentication - This setting determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication.
  
  Default: Not Defined Recommendation: Enabled
58. Network access: Let Everyone permissions apply to anonymous users - This setting determines what additional permissions are granted for anonymous connections to the computer.
  
  Default: Not Defined Recommendation: Disabled
59. Network access: Named Pipes that can be accessed anonymously - This setting determines which communication sessions (pipes) will have attributes and permissions that allow anonymous access.
  
  Default: Not Defined Recommendation: Netlogon, samr, lsarpc
60. Network access: Remotely accessible registry paths - This setting determines which registry keys can be accessed over the network, regardless of the users or groups listed in the ACL of the winreg registry key.
  
  Default: Not Defined Recommendation: No change
  
  Note - By default, the following registry keys can be accessed remotely - System\CurrentControlSet\Control\ProductOptions, System\CurrentControlSet\Control\Server Applications, Software\Microsoft\Windows NT\CurrentVersion
61. Network access: Remotely accessible registry paths and sub-paths - This setting determines which registry paths and subpaths can be accessed over the network, regardless of the users or groups listed in the ACL of the winreg registry key.
  
  Default: Not Defined Recommendation: No change
  
  Note - By default, the following registry keys can be accessed remotely - System\CurrentControlSet\Control\Print\Printers, System\CurrentControlSet\Services\Eventlog, Software\Microsoft\OLAPServer, Software\Microsoft\WindowsNT\CurrentVersion\Print, Software\Microsoft\WindowsNT\CurrentVersion\Windows, System\CurrentControlSet\Control\ContentIndex, System\CurrentControlSet\Control\Terminal Server, System\CurrentControlSet\Control\Terminal Server\UserConfig, System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration, Software\Microsoft\Windows NT\CurrentVersion\Perflib, System\CurrentControlSet\Services\SysmonLog
62. Network access: Restrict anonymous access to Named Pipes and Shares - This setting determines whether anonymous access is restricted to named pipes and shares.
  
  Default: Not Defined Recommendation: Enabled
63. Network access: Restrict clients allowed to make remote calls to SAM - This setting determines whether remote RPC connections to the Security Accounts Manager (SAM) are restricted.
  
  Default: Not Defined Recommendation: No change. See note below should you wish to enable this setting to make it more restrictive.
  
  Note - Consider using the Audit only mode to identify applications that could be impacted should this policy be enabled. To enable the Audit only mode, set the registry key RestrictRemoteSamAuditOnlyMode with the path, HKLM\System\CurrentControlSet\Control\Lsa. Event IDs that correspond to such recommended auditing include 16962-16969, with the event source being Directory-Service-SAM.
64. Network access: Shares that can be accessed anonymously - This setting determines which network shares can be accessed by anonymous users.
  
  Default: Not Defined Recommendation: No change
65. Network access: Sharing and security model for local accounts - This setting determines determines how network logons that use local accounts are authenticated.
  
  Default: Not Defined Recommendation: No change
  
  Note - This setting does not affect interactive logons that are performed remotely using Telnet or Remote Desktop Services.
66. Network security: Allow Local System to use computer identity for NTLM - This setting determines whether services running as Local System that use Negotiate when reverting to NTLM will use the computer's identity.
  
  Default: Not Defined Recommendation: No change
67. Network security: Allow LocalSystem NULL session fallback - This setting determines whether to allow NTLM to fall back to NULL session when used with LocalSystem.
  
  Default: Not Defined Recommendation: Disabled
68. Network security: Allow PKU2U authentication requests to this computer to use online identities - This setting determines whether PKU2U authentication requests to the computer are allowed to use online identities.
  
  Default: Not Defined Recommendation: No change
69. Network security: Configure encryption types allowed for Kerberos - This setting allows the setting of specific encryption types that Kerberos is allowed to use. If not selected, the encryption type will not be allowed.
  
  Default: Not Defined Recommendation: Ideally, AES128, AES256 and Future encryption types. [This recommendation assumes that your organizations has put in due diligence to determine and ensure that it can move off RC4.]
  
  Note - Options include - DES_CBC_CRC, DES_CBC_MD5, RC4_HMAC_MD5, AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types
70. Network security: Force logoff when logon hours expire - This setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours.
  
  Default: Not Defined Recommendation: No change
  
  Note - For domain accounts, the account policy is pulled from the default Domain policy, and it is enforced on Domain Controllers.
71. Network security: LAN Manager authentication level - This setting determines which authentication protocol is used for network logons, the level of authentication used by clients, the level of session security negotiated and the level of authentication accepted by servers.
  
  Default: Not Defined Recommendation: Send NTLMv2 response only. [Note that any clients that don't support NTLMv2 authentication will not be able to authenticate in the domain access resources by using LM and NTLM.]
  
  Caution - This setting should only be changed once your organization has invested efforts in determining whether or not NTLM can be disabled in your environment, and if so, determining the degree to which it can be disabled in your environment.
  
  Note 2 - Options include - Send LM and NTLM responses, Send LM and NTLM, Send NTLM response only, Send NTLM v2 response only, Send NTLM v2 response only\refuse LM and Send NTLM v2 response only\refuse LM and NTLM
72. Network security: LDAP client encryption requirements - This setting determines the level of data encrytion (negotiate or require) that is requested on behalf of clients issuing LDAP BIND requests.
  
  Default: Not Defined Recommendation: Negotiate
73. Network security: LDAP client signing requirements - This setting determines the level of data signing (none, negotiate or require) that is requested on behalf of clients using LDAP BIND requests.
  
  Default: Not Defined Recommendation: Require signing
74. Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - This setting allows a client to require the negotiation of 128-bit encryption and/or NTLM v2 session security.
  
  Default: Not Defined Recommendation: Require NTLM v2 session security AND Require 128-bit encryption
  
  Note - Options include - Require NTLM v2 session security and Require 128-bit encryption
75. Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - This setting allows a server to require the negotiation of 128-bit encryption and/or NTLM v2 session security.
  
  Default: Not Defined Recommendation: Require NTLM v2 session security AND Require 128-bit encryption
  
  Note - Options include - Require NTLM v2 session security and Require 128-bit encryption
76. Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication - This setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remove servers" policy setting is configured.
  
  Default: Not Defined Recommendation: No change. (Can be used once NTLM authentication has been turned off to specify an exception list of remote servers to which client devices will be allowed to use NTLM authentication if the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers security option is configured.)
  
  Note - The naming format for servers on the exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line.
77. Network security: Restrict NTLM: Add server exceptions in this domain - This setting allows you to create an exception list of servers in this domain to which clients are allowed to use NTLM pass-through authentication if the "Network Security: Restrict NTLM: Deny NTLM authentication in this domain" setting is set.
  
  Default: Not Defined Recommendation: No change. (Can be used once NTLM authentication has been turned off to specify an exception list of servers in this domain to which client devices will be allowed to use NTLM pass-through authentication if the Network security: Restrict NTLM: NTLM authentication in this domain security option is configured.)
  
  Note - The naming format for servers on the exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line.
78. Network security: Restrict NTLM: Audit Incoming NTLM Traffic - This setting allows you to audit incoming NTLM traffic.
  
  Default: Not Defined Recommendation: Enable auditing for domain accounts
  
  Note - Options include - Disabled, Enable auditing for domain accounts and Enable auditing for all accounts. Setting the value Enable auditing for domain accounts can help identify clients requesting/relying on NTLM authentication, which can be helpful in efforts to eventually phase out NTLM.
79. Network security: Restrict NTLM: Audit NTLM authentication in this domain - This setting allows you to audit NTLM authentication in a domain.
  
  Default: Not Defined Recommendation: Enable for domain accounts
  
  Note - Options include - Disable, Enable for domain accounts to domain servers and Enable for domain accounts Setting the value Enable auditing for domain accounts can help identify clients requesting/relying on NTLM authentication, which can be helpful in efforts to eventually phase out NTLM.
80. Network security: Restrict NTLM: Incoming NTLM traffic - This setting allows you to deny or allow incoming NTLM traffic.
  
  Default: Not Defined Recommendation: You can set this to Deny all domain accounts once you have ensured (such as by using NTLM auditing to identify and configure sources) that NTLM can be turned off in your environment.
  
  Note - Options include - Allow all, Deny all domain accounts and Deny all accounts
81. Network security: Restrict NTLM: NTLM authentication in this domain - This setting allows you to deny or allow NTLM authentication within a domain.
  
  Default: Not Defined Recommendation: Set accordingly once you have ensured (such as by using NTLM auditing to identify and configure sources) that NTLM can be turned off in your environment.
  Note - Options include -
  1. Disable
  2. Deny for domain accounts to domain servers - This will block NTLM pass-through authentication for any accounts in this domain to any server in the domain
  3. Deny for domain accounts - This will block NTLM pass-through authentication for any accounts in this domain
  4. Deny for domain servers - This will block NTLM pass-through authentication to any server in the domain
  5. Deny all - This will block all NTLM pass-through authentication
82. Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - This setting allows you to deny or audit outgoing NTLM traffic from the domain controller to any Windows remote server.
  
  Default: Not Defined Recommendation: Start with Audit All. Change to Deny all once you have ensured (such as by using NTLM auditing to identify and configure sources) that NTLM can be turned off in your environment.
  
  Note - Options include - Allow all, Audit all and Deny all
83. Recovery console: Allow automatic administrative logon - This setting determines whether or not the password for the Administrator account must be given before access to the system in granted.
  
  Default: Not Defined Recommendation: Disabled
84. Recovery console: Allow floppy copy and access to all drives and all folders - This setting determines whether or not the Recovery Console SET command is vailable for setting specific environment variables.
  
  Default: Not Defined Recommendation: Disabled
  
  Note - If enabled, the following Recovery Console environment variables can be set - AllowWildCards, AllowAllPaths, AllowRemovableMedia and NoCopyPrompt
85. Shutdown: Allow system to be shut down without having to log on - This setting determines whether a computer can be shut down without having to logon to Windows.
  
  Default: Not Defined Recommendation: Disabled
86. Shutdown: Clear virtual memory pagefile - This setting determines whether the virtual memory pagefile is cleared when the system is shut down.
  
  Default: Not Defined Recommendation: Enabled
87. System cryptography: Force strong key protection for user keys stored on the computer - This setting determines if a user's private keys require a password to be used.
  
  Default: Not Defined Recommendation: No change
88. System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing - This setting determines whether FIPS 140 compliant algorithms are used for encryption, hashing and signing.
  
  Default: Not Defined Recommendation: No change
89. System objects: Require case insensitivity for non-Windows subsystems - This setting determines whether or not case insensitivity is enforced for all subsystems.
  
  Default: Not Defined Recommendation: Enabled
90. System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) - This setting determines the strength of the default discretionary access control list (DACL) for objects.
  
  Default: Not Defined Recommendation: Enabled
91. System settings: Optional subsystems - This setting determines which subsystems can optionally be started up to support your applications.
  
  Default: Not Defined Recommendation: No change
92. System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies - This setting determines if digital certificates are processed when a user or process attempts to run software with an .exe file name extension.
  
  Default: Not Defined Recommendation: Enabled
93. User Account Control: Admin Approval Mode for the Built-in Administrator account - This setting controls the behavior of Admin Approval Mode for the built-in Administrator account.
  
  Default: Not Defined Recommendation: Enabled
94. User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop - This setting determines whether User Interface Accessibility programs can automatically disable the secure desktop for elevation prompts used by a standard user.
  
  Default: Not Defined Recommendation: No change
95. User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - This setting controls the behavior of the elevation prompt for administrators.
  
  Default: Not Defined Recommendation: Prompt for consent on the secure desktop
96. User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection - This setting controls the behavior of the elevation prompt for administrators running in Enhanced Privilege Protection Mode.
  
  Default: Not Defined Recommendation: No change
97. User Account Control: Behavior of the elevation prompt for standard users - This setting controls the behavior of the elevation prompt for standard users.
  
  Default: Not Defined Recommendation: Automatically deny elevation requests
98. User Account Control: Configure type of Admin Approval Mode - This setting controls whether enhanced privilege protection is applied to admin approval mode elevations.
  
  Default: Not Defined Recommendation: No change
99. User Account Control: Detect application installations and prompt for elevation - This setting controls the behavior of application installation detection for the computer.
  
  Default: Not Defined Recommendation: Enabled
100. User Account Control: Only elevate executables that are signed and validated - This setting enforces PKI signature checks for any interactive applications that request elevation of privilege.
  
  Default: Not Defined Recommendation: Enabled
101. User Account Control: Only elevate UIAccess applications that are installed in secure locations - This setting controls whether applications that request to run with a User Interface Accessibility integrity level must reside in a secure location in the file system.
  
  Default: Not Defined Recommendation: Enabled
  
  Note - Secure locations are limited to - ...\Program Files\ (including subfolders), ...\Windows\system32\ and ...\Program Files (x86)\ (including subfolders) [for 64-bit versions of Windows]
102. User Account Control: Run all administrators in Admin Approval Mode - This setting controls the behavior of all User Account Control (UAC) policy settings for the computer.
  
  Default: Not Defined Recommendation: Enabled
103. User Account Control: Switch to the secure desktop when prompting for elevation - This setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop.
  
  Default: Not Defined Recommendation: Enabled
104. User Account Control: Virtualize file and registry write failures to per-user locations - This setting controls whether application write failures are redirected to defined registry and file system locations.
  
  Default: Not Defined Recommendation: Enabled