Computer Configuration\Administrative Templates\System\Audit Process Creation Include command line in process creation events N/A Not Configured Enable only when needed; otherwise it provides an attacker with admin rights a lot of data, potentially including passwords (e.g., from a NET USE command line). Computer Configuration\Administrative Templates\System\Logon Do not display network selection UI N/A Enabled Unauthenticated user should not be able to switch networks. (Tampering) Computer Configuration\Administrative Templates\Windows Components\App runtime Allow Microsoft accounts to be optional N/A Enabled Enterprises have to be able to enable app use without tying to an MSA or automatically uploading data to SkyDrive. Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options Sign-in last interactive user automatically after a system-initiated restart N/A Disabled Requires Windows to retain credentials during session
Computer Configuration\Windows Settings\Local Policies\User Rights Assignment Deny access to this computer from the network Guests Guests, Local account (for Member Server: Guests, Local account and member of Administrators group) Win8.1/2012R2 introduces two new pseudo groups that a local-account logon can get in its token and that has been backported to Windows 7/2008R2 and newer with . Guests and local accounts should be denied network logon on systems. (For Member Server, replace “Local account” with “Local account and member of Administrators group” to avoid breaking failover clustering.) Also, Enterprise Admins and Domain Admins should also be denied all access on all clients and servers except for Domain Controllers and dedicated admin workstations. (Note that EA and DA are
Policy Path Policy Name Old Value New Value Rationale Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows N/A Enabled Increased protection; will break some sites, but applies only when EPM is enforced Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable Enforce the default Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable (stronger than default; with DoD STIG) Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable (stronger than default; with DoD STIG)
All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Executable Rules Firefox FilePublisherRule: Deny Everyone PublisherName="O=MOZILLA CORPORATION, L=MOUNTAIN VIEW, S=CA, C=US" ProductName="FIREFOX" BinaryName="FIREFOX.EXE" Block web browsers on DCs All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Executable Rules Default rules Allow non-admins to run executables in Program Files Allow non-admins to run executables in Windir Allow admins to run executables anywhere Block web browsers on DCs All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\System Services Application Identity (AppIDSvc) Service startup mode = Automatic AppLocker requires AppIDSvc to be running to enforce rules EMET We recommend installing EMET on all workstations and servers, along with these Group Policy settings: Baseline Policy Path Policy Name Old Value New Value Rationale All OS Computer Configuration\Administrative Templates\Windows Components\EMET Default Protections for Internet Explorer N/A Enabled EMET protections All OS Computer Configuration\Administrative Templates\Windows Components\EMET Default Protections for Popular Software N/A Enabled EMET protections
All OS Computer Configuration\Administrative Templates\Windows Components\EMET Default Protections for Recommended Software N/A Enabled EMET protections All OS Computer Configuration\Administrative Templates\Windows Components\EMET ASLR N/A Enabled: Application Opt-In EMET protections All OS Computer Configuration\Administrative Templates\Windows Components\EMET System DEP N/A Enabled: Application Opt-Out EMET protections All OS Computer Configuration\Administrative Templates\Windows Components\EMET System N/A Enabled: Application Opt-Out EMET protections Updated Guidance This section defines settings in all baselines covered by this report that should be added or changed to be consistent with other baselines. Baseline Policy Path Policy Name Old New Value Rationale All Client OS Computer Configuration\Windows Components\Event Log Service\Application Specify the maximum log file size (KB) 20480 32768 Make consistent with Server OS recommendations and increase diagnostic and forensic abilities. All Client OS Computer Configuration\Windows Components\Event Log Service\Security Specify the maximum log file size (KB) 20480 196608 Make consistent with Server OS recommendations and increase diagnostic and forensic abilities.
All Servers Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Network security: Allow Local System to use computer identity for NTLM Not Defined Enabled Added to Member Server baseline to be consistent with client and domain controller baselines All Servers Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Network security: Allow LocalSystem NULL session fallback Not Defined Disabled Added to Member Server baseline to be consistent with client and domain controller baselines All Client OS Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment Access this computer from the network Users, Authenticated Users, Make consistent with Server guidance Advanced Auditing The guidance for Windows 8 and Windows Server 2012 recommends “No Auditing” for many settings where the intent was to specify “Not Defined” and to allow customer decisions. In some cases, “No Auditing” overrode a more secure default. We have tried to fix all those cases here. Baseline Policy Path Policy Name Old Value New Value Rationale All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon Kerberos Authentication Service No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon Audit Kerberos Service Ticket Operations No Auditing Not Defined No security better to allow customers to decide
All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon Audit Other Account Logon Events No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management Application Group Management No Auditing Not Defined No security better to allow customers to decide All Client OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management Audit Computer Account Management No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Account Management Audit Distributed Group Management No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking Audit DPAPI Activity No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Policy\Configuration\Audit Policies\Detailed Tracking Audit Process Termination No Auditing Not Defined No security better to allow customers to decide
All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Logon/Logoff Audit IPSec Extended Mode No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff Audit IPSec Main Mode No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff Audit IPSec Quick Mode No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff Audit Network Policy Server No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff Other Logon/Logoff Events No Auditing Not Defined No security better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Application Generated No Auditing Not Defined No security value; better to allow customers to decide
All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Central Access Policy Staging No Auditing Not Defined No security better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Certification Services No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Detailed File Share No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Object Access File Share No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit File System No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Filtering Platform Connection No Auditing Not Defined No security value; better to allow customers to decide
All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Object Access Filtering Platform Packet Drop No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Object Access Audit Handle Manipulation No Auditing Not Defined No security better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Kernel Object No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Other Object Access Events No Auditing Not Defined No security better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access Audit Registry No Auditing Not Defined No security better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Policy Configuration\Audit Policies\Object Access Audit Removable Storage No Auditing Not Defined No security value; better to allow customers to decide
All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use Other Privilege Use Events No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\System Audit Other System Events No Auditing Success and Failure “No Auditing” was probably a mistaken entry here. Removed Windows Recommendations This section lists settings that we believe should be removed from the Windows recommendations. In many cases, they provide little or no security value. In other cases, the settings are no longer applicable. Baseline Policy Path Policy Name Old Value New Rationale All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Enabled Not Defined Limited security breaks many legitimate use cases; SSL 3.0 and earlier can be disabled through other means. Discussed in more detail here: All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Require Domain Controller authentication to unlock workstation Enabled Not Defined No security value
All OS Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off the Windows Messenger Customer Experience Improvement Program Enabled Not Defined No longer applicable All OS Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off Windows Update device driver searching Enabled Not Defined No security value All OS Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Application Control Event Log behavior when the log file reaches its maximum size Disabled Not Defined No security All OS Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security Control Event Log behavior when the log file reaches its maximum size Disabled Not Defined No security value All OS Computer Configuration\Administrative Templates\Windows Components\Event Log Service\System Control Event Log behavior when the log file reaches its maximum size Disabled Not Defined No security value All OS Computer Configuration\Administrative Templates\Windows Components\Windows Remote Shell Allow Remote Shell Access Enabled Not Defined No security value (opposite!)