[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*


CCE-35384-7
Configure registry policy processing This policy setting determines when registry policies are updated. This policy setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program impl ...

CCE-34914-2
Network access: Allow anonymous SID/Name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user, or use a SID to obtain its corresponding user name. Disable this policy setting to prevent unauthenticated users from obta ...

CCE-35599-0
Set time limit for disconnected sessions This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Remote De ...

CCE-35116-3
Windows Firewall: Public: Logging: Log dropped packets Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log.

CCE-35300-3
Network access: Remotely accessible registry paths and sub-paths This policy setting determines which registry paths and sub-paths will be accessible when an application or process references the WinReg key to determine access permissions. Note: In Windows XP this setting is called 'Network access: ...

CCE-34776-5
Prevent the computer from joining a homegroup By default, users can add their computer to a homegroup on a home network. If you enable this policy setting, a user on this computer will not be able to add this computer to a homegroup. This setting does not affect other network sharing features. I ...

CCE-35369-8
Perform volume maintenance tasks This policy setting allows users to manage the system's volume or disk configuration, which could allow a user to delete a volume and cause data loss as well as a denial-of-service condition. When configuring a user right in the SCM enter a comma delimited list of ...

CCE-33976-2
Network access: Remotely accessible registry paths This policy setting determines which registry paths will be accessible after referencing the WinReg key to determine access permissions to the paths. Note: This setting does not exist in Windows XP. There was a setting with that name in Windows XP, ...

CCE-34173-5
Deny access to this computer from the network This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on ...

CCE-35421-7
Windows Firewall: Public: Logging: Size limit (KB) Use this option to specify the size limit of the file in which Windows Firewall will write its log information.

CCE-35225-2
Network security: Do not store LAN Manager hash value on next password change This policy setting determines whether the LAN Manager (LM) hash value for the new password is stored when the password is changed. The LM hash is relatively weak and prone to attack compared to the cryptographically stro ...

CCE-33034-0
Accounts: Rename administrator account The built-in local administrator account is a well-known account name that attackers will target. Microsoft recommends to choose another name for this account, and to avoid names that denote administrative or elevated access accounts. Be sure to also change th ...

CCE-35530-5
Audit policy change This policy setting determines whether to audit every incident of a change to user rights assignment policies, Windows Firewall policies, Trust policies, or changes to the Audit policy itself. The recommended settings would let you see any account privileges that an attacker att ...

CCE-32957-3
Prohibit non-administrators from applying vendor signed updates This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. Non-administrator updates provide a mechanism for the author of an application to create digitally s ...

CCE-33143-9
Turn off Internet download for Web publishing and online ordering wizards This policy setting controls whether Windows will download a list of providers for the Web publishing and online ordering wizards.

CCE-33734-5
Windows Firewall: Public: Logging: Log successful connections Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log.

CCE-33069-6
Windows Firewall: Public: Inbound connections This setting determines the behavior for inbound connections that do not match an inbound firewall rule. The default behavior is to block connections unless there are firewall rules to allow the connection.

CCE-33046-4
Audit: Shut down system immediately if unable to log security audits This policy setting determines whether the system shuts down if it is unable to log Security events. It is a requirement for Trusted Computer System Evaluation Criteria (TCSEC)-C2 and Common Criteria certification to prevent audit ...

CCE-35083-5
Windows Firewall: Domain: Logging: Size limit (KB) Use this option to specify the size limit of the file in which Windows Firewall will write its log information.

CCE-34874-8
Prevent Automatic Updates Prevents users from being prompted to update Windows Media Player. This policy prevents the Player from being updated and prevents users with administrator rights from being prompted to update the Player if an updated version is available. The Check for Player Updates com ...

CCE-35640-2
Allow log on locally This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Servic ...

CCE-34897-9
Increase a process working set This privilege determines which user accounts can increase or decrease the size of a process?s working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an a ...

CCE-32945-8
Turn off handwriting personalization data sharing Turns off data sharing from the handwriting recognition personalization tool. The handwriting recognition personalization tool tool enables Tablet PC users to adapt handwriting recognition to their own writing style by providing writing samples. ...

CCE-34972-0
Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with Support Provider Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. If you leave this policy setting enabled, Users will be able to use MSDT to collect and send diagn ...

CCE-35531-3
Audit Policy: Account Management: Distribution Group Management This subcategory reports each event of distribution group management, such as when a distribution group is created, changed, or deleted or when a member is added to or removed from a distribution group. If you enable this Audit policy ...

CCE-33975-4
Specify the maximum log file size (KB) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte incremen ...

CCE-34172-7
Audit Policy: Object Access: File System This subcategory reports when file system objects are accessed. Only file system objects with SACLs cause audit events to be generated, and only when they are accessed in a manner matching their SACL. By itself, this policy setting will not cause auditing of ...

CCE-35698-0
Audit Policy: Policy Change: Other Policy Change Events This subcategory reports other types of security policy changes such as configuration of the Trusted Platform Module (TPM) or cryptographic providers. Events for this subcategory include: ? 4909: The local policy settings for the TBS were chan ...

CCE-34908-4
Microsoft network client: Digitally sign communications (if server agrees) This policy setting determines whether the SMB client will attempt to negotiate SMB packet signing. The implementation of digital signing in Windows?based networks helps to prevent sessions from being hijacked. If you enable ...

CCE-33779-0
Create a token object This policy setting allows a process to create an access token, which may provide elevated rights to access sensitive data. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local or located in Active Directory, they can ...

CCE-32933-4
Audit Policy: Object Access: Certification Services This subcategory reports when Certification Services operations are performed. Events for this subcategory include: ? 4868: The certificate manager denied a pending certificate request. ? 4869: Certificate Services received a resubmitted certific ...

CCE-35554-5
Require domain users to elevate when setting a network's location This policy setting determines whether to require domain users to elevate when setting a network's location. If you enable this policy setting, domain users must elevate when setting a network's location. If you disable or do not c ...

CCE-33068-8
Windows Firewall: Public: Display a notification Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. Note When the Apply local firewall rules setting is configured to No, Microsoft recom ...

CCE-35410-0
Network security: Allow LocalSystem NULL session fallback Allow NTLM to fall back to NULL session when used with LocalSystem. The default is TRUE up to Windows Vista and FALSE in Windows 7.

CCE-35641-0
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing This policy setting determines whether the Transport Layer Security/Secure Sockets Layer (TLS/SSL) Security Provider supports only the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. Although this policy setting inc ...

CCE-35770-7
Turn off Automatic Root Certificates Update Specifies whether to automatically update root certificates using the Windows Update Web site. Typically, a certificate is used when you use a secure Web site or when you send and receive secure e-mail. Anyone can issue certificates, but to have transac ...

CCE-34898-7
Interactive logon: Do not display last user name This policy setting determines whether the account name of the last user to log on to the client computers in your organization will be displayed in each computer's respective Windows logon screen. Enable this policy setting to prevent intruders from ...

CCE-33744-4
Turn Off the Display (On Battery) Specifies the period of inactivity before Windows turns off the display. If you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. If you disable this policy or do not config ...

CCE-35488-6
Accounts: Rename guest account The built-in local guest account is another well-known name to attackers. Microsoft recommends to rename this account to something that does not indicate its purpose. Even if you disable this account, which is recommended, ensure that you rename it for added security. ...

CCE-35499-3
Audit Policy: Account Management: User Account Management This subcategory reports each event of user account management, such as when a user account is created, changed, or deleted; a user account is renamed, disabled, or enabled; or a password is set or changed. If you enable this Audit policy se ...

CCE-34909-2
Microsoft network server: Amount of idle time required before suspending session This policy setting allows you to specify the amount of continuous idle time that must pass in an SMB session before the session is suspended because of inactivity. Administrators can use this policy setting to control ...

CCE-33778-2
Enable computer and user accounts to be trusted for delegation This policy setting allows users to change the Trusted for Delegation setting on a computer object in Active Directory. Abuse of this privilege could allow unauthorized users to impersonate other users on the network. When configuring ...

CCE-32936-7
Audit Policy: System: Other System Events This subcategory reports on other system events. Events for this subcategory include: ? 5024 : The Windows Firewall Service has started successfully. ? 5025 : The Windows Firewall Service has been stopped. ? 5027 : The Windows Firewall Service was unable ...

CCE-33168-6
Screen saver timeout If the Screen Saver Timeout setting is enabled, then the screen saver will be launched when the specified amount of time has passed since the last user action. Valid values range from 1 to 89,400 seconds (24 hours). The setting has no effect if the wait time is set to zero or n ...

CCE-35367-2
Network access: Let Everyone permissions apply to anonymous users This policy setting determines what additional permissions are assigned for anonymous connections to the computer. If you enable this policy setting, anonymous Windows users are allowed to perform certain activities, such as enumerat ...

CCE-35430-8
Audit Policy: Privilege Use: Other Privilege Use Events This subcategory is not used.

CCE-33513-3
Always use classic logon This setting forces the user to log on to the computer using the classic logon screen. By default, a workgroup is set to use the simple logon screen. This setting only works when the computer is not on a domain.

CCE-34622-1
MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) The registry value entry TCPMaxDataRetransmissions for IPv6 was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6 \Parameters\ registry ...

CCE-35005-8
Shutdown: Clear virtual memory pagefile This policy setting determines whether the virtual memory pagefile is cleared when the system is shut down. When this policy setting is enabled, the system pagefile is cleared each time that the system shuts down properly. If you enable this security setting, ...

CCE-34876-3
Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. ...

CCE-34986-0
Domain member: Disable machine account password changes This policy setting determines whether a domain member can periodically change its computer account password. If you enable this policy setting, the domain member will be prevented from changing its computer account password. If you disable th ...

CCE-33012-6
Report when logon server was not available during user logon This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information. If enabled, a notification popup will be di ...

CCE-35091-8
Specify the maximum log file size (KB) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte incremen ...

CCE-33035-7
Allow log on through Remote Desktop Services This policy setting determines which users or groups have the right to log on as a Terminal Services client. Remote desktop users require this user right. If your organization uses Remote Assistance as part of its help desk strategy, create a group and a ...

CCE-33777-4
Password must meet complexity requirements This policy setting checks all new passwords to ensure that they meet basic requirements for strong passwords. When this policy is enabled, passwords must meet the following minimum requirements: - Not contain the user's account name or parts of the user's ...

CCE-33169-4
Allow Standby States (S1-S3) When Sleeping (On Battery) Dictates whether or not Windows is allowed to use standby states when sleeping the computer. When this policy is enabled, Windows may use standby states to sleep the computer. If this policy is disabled, the only sleep state a compute ...

CCE-35784-8
Turn off handwriting recognition error reporting Turns off the handwriting recognition error reporting tool. The handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a ...

CCE-32935-9
Audit Policy: Object Access: SAM This subcategory reports when SAM objects are accessed. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default ...

CCE-35080-1
Do not send a Windows error report when a generic driver is installed on a device This policy setting allows you to specify whether to send a Windows error report when a generic driver is installed on a device. If you enable this policy setting, a Windows error report is not sent when a generic dr ...

CCE-33047-2
Bypass traverse checking This policy setting allows users who do not have the Traverse Folder access permission to pass through folders when they browse an object path in the NTFS file system or the registry. This user right does not allow users to list the contents of a folder. When configuring a ...

CCE-35431-6
Allow user control over installs This policy setting permits users to change installation options that typically are available only to system administrators. If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations to complete t ...

CCE-34491-1
Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box This policy setting allows you to manage whether the 'Install Updates and Shut Down' option is allowed to be the default choice in the Shut Down Windows dialog. Note that this policy setting has no impac ...

CCE-35004-1
Shut down the system This policy setting determines which users who are logged on locally to the computers in your environment can shut down the operating system with the Shut Down command. Misuse of this user right can result in a denial of service condition. When configuring a user right in the ...

CCE-33731-1
Log on as a service This policy setting allows accounts to launch network services or to register a process as a service running on the system. This user right should be restricted on any computer in a high security environment, but because many applications may require this privilege, it should be ...

CCE-33789-9
Minimum password length This policy setting determines the least number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps 'pass phrase' is a better term than 'password.' In Mic ...

CCE-33157-9
Debug programs This policy setting determines which user accounts will have the right to attach a debugger to any process or to the kernel, which provides complete access to sensitive and critical operating system components. Developers who are debugging their own applications do not need to be ass ...

CCE-34623-9
MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) The registry value entry TCPMaxDataRetransmissions was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip \Parameters\ registry key. The entry ...

CCE-34527-2
Do not send additional data If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user.

CCE-34022-4
MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) The registry value entry SafeDllSearchMode was added to the template file in the HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Control\Session Manager\ registry key. The entry appears as MSS: (SafeDllSearchMode) Enable Safe DLL searc ...

CCE-34757-5
Recovery console: Allow floppy copy and access to all drives and all folders This policy setting makes the Recovery Console SET command available, which allows you to set the following recovery console environment variables: - AllowWildCards. Enables wildcard support for some commands (such as the ...

CCE-33972-1
Allow remote access to the Plug and Play interface This policy setting allows you to allow or deny remote access to the Plug and Play interface. If you enable this policy setting, remote connections to the Plug and Play interface are allowed. If you disable or do not configure this p ...

CCE-35448-0
Turn Off the Display (Plugged In) Specifies the period of inactivity before Windows turns off the display. If you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display. If you disable this policy or do not config ...

CCE-34177-6
Windows Firewall: Private: Logging: Log successful connections Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log.

CCE-33776-6
Audit Policy: Policy Change: Filtering Platform Policy Change This subcategory reports the addition and removal of objects from WFP, including startup filters. These events can be very high in volume. Events for this subcategory include: ? 4709: IPsec Services was started. ? 4710: IPsec Services w ...

CCE-35511-5
Audit Policy: Logon-Logoff: Special Logon This subcategory reports when a special logon is used. A special logon is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. Events for this subcategory include: ? 4964 : Special groups have been ass ...

CCE-33091-0
Audit Policy: Policy Change: Authentication Policy Change This subcategory reports changes in authentication policy. Events for this subcategory include: ? 4706: A new trust was created to a domain. ? 4707: A trust to a domain was removed. ? 4713: Kerberos policy was changed. ? 4716: Trusted doma ...

CCE-35293-0
Deny log on locally This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the Allow log on locally policy setting if an account is subject to both policies.Important:If you apply this security policy to the Everyone group, no one ...

CCE-35523-0
Audit Policy: Privilege Use: Non Sensitive Privilege Use This subcategory reports when a user account or service uses a non-sensitive privilege. A non-sensitive privilege includes the following user rights: Access Credential Manager as a trusted caller, Access this computer from the network, Add w ...

CCE-35459-7
User Account Control: Virtualize file and registry write failures to per-user locations This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-ti ...

CCE-33027-4
Reschedule Automatic Updates scheduled installations This policy setting determines the amount of time before previously scheduled Automatic Update installations will proceed after system startup. If you configure this policy setting to Enabled, a previously scheduled installation will begin after ...

CCE-33788-1
User Account Control: Run all administrators in Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: - Enabled: (Default) Admin Approval ...

CCE-35391-2
Restrict Unauthenticated RPC clients This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers. This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact ...

CCE-35338-3
User Account Control: Admin Approval Mode for the Built-in Administrator account This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. The options are: - Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operat ...

CCE-35500-8
Audit Policy: Detailed Tracking: RPC Events This subcategory reports remote procedure call (RPC) connection events. Events for this subcategory include: ? 5712: A Remote Procedure Call (RPC) was attempted. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vist ...

CCE-35490-2
Adjust memory quotas for a process This policy setting allows a user to adjust the maximum amount of memory that is available to a process. The ability to adjust memory quotas is useful for system tuning, but it can be abused. In the wrong hands, it could be used to launch a denial of service (DoS) ...

CCE-34965-4
Network access: Named Pipes that can be accessed anonymously This policy setting determines which communication sessions, or pipes, will have attributes and permissions that allow anonymous access. Note: When you configure this setting you specify a list of one or more objects. The delimiter used w ...

CCE-35763-2
Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS) This policy setting allows users who are connected to the Internet to access and search troubleshooting content t ...

CCE-34988-6
Interactive logon: Smart card removal behavior This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader.

CCE-35403-5
Act as part of the operating system This policy setting allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local o ...

CCE-33037-3
Audit Policy: Account Logon: Other Account Logon Events This subcategory reports the events that occur in response to credentials submitted for a user account logon request that do not relate to credential validation or Kerberos tickets. These events occur on the computer that is authoritative for ...

CCE-33764-2
Turn off shell protocol protected mode This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this p ...

CCE-34176-8
Windows Firewall: Domain: Logging: Name Use this option to specify the path and name of the file in which Windows Firewall will write its log information.

CCE-33246-0
Turn off the 'Publish to Web' task for files and folders This policy setting specifies whether the tasks Publish this file to the Web, Publish this folder to the Web, and Publish the selected items to the Web are available from File and Folder Tasks in Windows folders.

CCE-33090-2
Audit Policy: Logon-Logoff: IPsec Extended Mode This subcategory reports the results of AuthIP during Extended Mode negotiations. Events for this subcategory include: ? 4978: During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate ...

CCE-34614-8
MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS) The registry value entry PerformRouterDiscovery was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ registry key. The entry appears ...

CCE-35108-0
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This policy setting determines which behaviors are allowed for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services ...

CCE-34262-6
Turn on Mapper I/O (LLTDIO) driver This policy setting changes the operational behavior of the Mapper I/O network protocol driver. LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth e ...

CCE-35086-8
Prevent Internet Explorer security prompt for Windows Installer scripts This policy setting allows Web-based programs to install software on the computer without notifying the user. If you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tr ...

CCE-34723-7
Network access: Do not allow anonymous enumeration of SAM accounts and shares This policy setting controls the ability of anonymous users to enumerate SAM accounts as well as shares. If you enable this policy setting, anonymous users will not be able to enumerate domain account user names and netwo ...

CCE-33960-6
Always prompt for password upon connection This policy setting specifies whether Terminal Services always prompts the client computer for a password upon connection. You can use this policy setting to enforce a password prompt for users who log on to Terminal Services, even if they already provided ...

CCE-35524-8
Audit Policy: Privilege Use: Sensitive Privilege Use This subcategory reports when a user account or service uses a sensitive privilege. A sensitive privilege includes the following user rights: Act as part of the operating system, Back up files and directories, Create a token object, Debug progra ...

CCE-33787-3
Deny log on through Remote Desktop Services This policy setting determines whether users can log on as Terminal Services clients. After the baseline member server is joined to a domain environment, there is no need to use local accounts to access the server from the network. Domain accounts can acc ...

CCE-35392-0
Enable RPC Endpoint Mapper Client Authentication This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) canno ...

CCE-35501-6
Audit Policy: DS Access: Detailed Directory Service Replication This subcategory reports detailed information about the information replicating between domain controllers. These events can be very high in volume. Events for this subcategory include: ? 4928: An Active Directory replica source naming ...

CCE-35532-1
Audit Policy: Policy Change: MPSSVC Rule-Level Policy Change This subcategory reports changes in policy rules used by the Microsoft Protection Service (MPSSVC.exe). This service is used by Windows Firewall and by Microsoft OneCare. Events for this subcategory include: ? 4944: The following policy w ...

CCE-33431-8
Change the time zone This setting determines which users can change the time zone of the computer. This ability holds no great danger for the computer and may be useful for mobile workers. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either loc ...

CCE-35469-6
MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds The registry value entry KeepAliveTime was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ registry key. The entry appears as MSS: (KeepAliveTime) How often keep-alive ...

CCE-35699-8
Back up files and directories This policy setting allows users to circumvent file and directory permissions to back up the system. This user right is enabled only when an application (such as NTBACKUP) attempts to access a file or directory through the NTFS file system backup application programmin ...

CCE-33740-2
Allow Remote Shell Access This policy setting allows you to manage configuration of remote access to all supported shells to execute scripts and commands.

CCE-34506-6
Do not allow passwords to be saved This policy setting helps prevent Terminal Services clients from saving passwords on a computer. Note If this policy setting was previously configured as Disabled or Not configured, any previously saved passwords will be deleted the first time a Terminal Service ...

CCE-35400-1
Always install with elevated privileges Directs Windows Installer to use system permissions when it installs any program on the system. This setting extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the d ...

CCE-35194-0
Enumerate administrator accounts on elevation By default, all administrator accounts are displayed when you attempt to elevate a running application.

CCE-34141-2
Turn off Windows Update device driver searching This policy setting specifies whether Windows will search Windows Update for device drivers when no local drivers for a device are present. Note See also Turn off Windows Update device driver search prompt in Administrative Templates/System, which ...

CCE-33093-6
Audit: Audit the access of global system objects This policy setting creates a default system access control list (SACL) for system objects such as mutexes (mutual exclusive), events, semaphores, and MS-DOS devices, and causes access to these system objects to be audited. If the Audit: Audit the ac ...

CCE-33070-4
Windows Firewall: Public: Outbound connections This setting determines the behavior for outbound connections that do not match an outbound firewall rule. The default behavior is to allow connections unless there are firewall rules that block the connection. Important If you set Outbound connecti ...

CCE-35302-9
Network security: LAN Manager authentication level LAN Manager (LM) is a family of early Microsoft client/server software that allows users to link personal computers together on a single network. Network capabilities include transparent file and print sharing, user security features, and network a ...

CCE-35171-8
Prevent device metadata retrieval from the Internet This policy setting allows you to prevent Windows from retrieving device metadata from the Internet. If you enable this policy setting, Windows does not retrieve device metadata for installed devices from the Internet. This policy setti ...

CCE-32932-6
Audit Policy: Account Management: Application Group Management This subcategory reports each event of application group management on a computer, such as when an application group is created, changed, or deleted or when a member is added to or removed from an application group. If you enable this A ...

CCE-35411-8
Network Security: Allow PKU2U authentication requests to this computer to use online identities Windows 7 and Windows Server 2008 R2 introduce an extension to the Negotiate authentication package, Spnego.dll. In previous versions of Windows, Negotiate decides whether to use Kerberos or NTLM for aut ...

CCE-35009-0
Take ownership of files or other objects This policy setting allows users to take ownership of files, folders, registry keys, processes, or threads. This user right bypasses any permissions that are in place to protect objects to give ownership to the specified user. When configuring a user right ...

CCE-34130-5
Allow Standby States (S1-S3) When Sleeping (Plugged In) Dictates whether or not Windows is allowed to use standby states when sleeping the computer. When this policy is enabled, Windows may use standby states to sleep the computer. If this policy is disabled, the only sleep state a compute ...

CCE-33786-5
User Account Control: Only elevate executables that are signed and validated This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to ru ...

CCE-35521-4
Audit Policy: Policy Change: Audit Policy Change This subcategory reports changes in audit policy including SACL changes. Events for this subcategory include: ? 4715: The audit policy (SACL) on an object was changed. ? 4719: System audit policy was changed. ? 4902: The Per-user audit policy table ...

CCE-35183-3
Modify firmware environment values This policy setting allows users to configure the system-wide environment variables that affect hardware configuration. This information is typically stored in the Last Known Good Configuration. Modification of these values and could lead to a hardware failure tha ...

CCE-34021-6
Impersonate a client after authentication The policy setting allows programs that run on behalf of a user to impersonate that user (or another specified account) so that they can act on behalf of the user. If this user right is required for this kind of impersonation, an unauthorized user will not ...

CCE-33039-9
Audit Policy: Detailed Tracking: DPAPI Activity This subcategory reports encrypt or decrypt calls into the data protections application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. Events for this subcategory include: ? 4692: Backup of ...

CCE-35117-1
Windows Firewall: Public: Logging: Name Use this option to specify the path and name of the file in which Windows Firewall will write its log information.

CCE-33432-6
Log on as a batch job This policy setting allows accounts to log on using the task scheduler service. Because the task scheduler is often used for administrative purposes, it may be needed in enterprise environments. However, its use should be restricted in high security environments to prevent mis ...

CCE-33807-9
Lock pages in memory This policy setting allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. If this user right is assigned, significant degradation of system performance can occur. When configuring a user right in the SCM ent ...

CCE-35401-9
User Account Control: Only elevate UIAccess applications that are installed in secure locations This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations ...

CCE-35447-2
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This policy setting determines which behaviors are allowed for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services ...

CCE-35228-6
Recovery console: Allow automatic administrative logon The recovery console is a command-line environment that is used to recover from system problems. If you enable this policy setting, the administrator account is automatically logged on to the recovery console when it is invoked during startup.

CCE-35533-9
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings This policy setting allows administrators to enable the more precise auditing capabilities present in Windows Vista. The Audit Policy settings available in Windows Server 2003 Active ...

CCE-35510-7
Audit Policy: Logon-Logoff: Other Logon/Logoff Events This subcategory reports other logon/logoff-related events, such as Terminal Services session disconnects and reconnects, using RunAs to run processes under a different account, and locking and unlocking a workstation. Events for this subcategor ...

CCE-35458-9
User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. - Enab ...

CCE-35008-2
System objects: Require case insensitivity for non-Windows subsystems This policy setting determines whether case insensitivity is enforced for all subsystems. The Microsoft Win32? subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as the Portabl ...

CCE-33785-7
User Account Control: Behavior of the elevation prompt for standard users This policy setting controls the behavior of the elevation prompt for standard users. The options are: - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administra ...

CCE-35182-5
Microsoft network server: Digitally sign communications (if client agrees) This policy setting determines if the server side SMB service is able to sign SMB packets if it is requested to do so by a client that attempts to establish a connection. If no signing request comes from the client, a connec ...

CCE-33410-2
Audit Policy: Account Management: Computer Account Management This subcategory reports each event of computer account management, such as when a computer account is created, changed, deleted, renamed, disabled, or enabled. Events for this subcategory include: ? 4741: A computer account was created. ...

CCE-35406-8
MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning The registry value entry WarningLevel was added to the template file in the HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Services\Eventlog\Security\ registry key. The entry appears as MSS ...

CCE-35429-0
User Account Control: Detect application installations and prompt for elevation This policy setting controls the behavior of application installation detection for the computer. The options are: - Enabled: (Default for home) When an application installation package is detected that requires eleva ...

CCE-35493-6
Audit object access Earlier security GPOs from Microsoft include settings that configure the audit categories in previous versions of Windows. These earlier GPOs do not apply to computers running Windows Vista. The GPOs intended for use in enterprise environments have been designed to work with Win ...

CCE-35515-6
Audit Policy: Object Access: Filtering Platform Connection This subcategory reports when connections are allowed or blocked by WFP. These events can be high in volume. Events for this subcategory include: ? 5031: The Windows Firewall Service blocked an application from accepting incoming connection ...

CCE-33095-1
Create global objects This policy setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that ...

CCE-34354-1
Audit Policy: Object Access: Registry This subcategory reports when registry objects are accessed. Only registry objects with SACLs cause audit events to be generated, and only when they are accessed in a manner matching their SACL. By itself, this policy setting will not cause auditing of any even ...

CCE-35177-5
Domain member: Require strong (Windows 2000 or later) session key When this policy setting is enabled, a secure channel can only be established with domain controllers that are capable of encrypting secure channel data with a strong (128-bit) session key. To enable this policy setting, all domain c ...

CCE-35361-5
Prevent Windows from sending an error report when a device driver requests additional software during installation This policy allows you to prevent Windows from sending an error report when a device driver requests additional software during installation. If you enable this policy setting, Window ...

CCE-35602-2
Audit Policy: Object Access: Application Generated This subcategory reports when applications attempt to generate audit events by using the Windows auditing application programming interfaces (APIs). Events for this subcategory include: ? 4665: An attempt was made to create an application client co ...

CCE-35274-0
Interactive logon: Prompt user to change password before expiration This policy setting determines how far in advance users are warned that their password will expire. Microsoft recommends that you configure this policy setting to 14 days to sufficiently warn users when their passwords will expire.

CCE-33784-0
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Elevate without prompting: Allows privileged accounts to perform an operation that requires ele ...

CCE-34911-8
Microsoft network server: Disconnect clients when logon hours expire This policy setting determines whether to disconnect users who are connected to the local computer outside their user account?s valid logon hours. It affects the SMB component. If you enable this policy setting, client sessions wi ...

CCE-33061-3
Windows Firewall: Domain: Apply local firewall rules This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy.

CCE-35504-0
Audit Policy: Logon-Logoff: Account Lockout This subcategory reports when a user's account is locked out as a result of too many failed logon attempts. Events for this subcategory include: ? 4625: An account failed to log on. Refer to the Microsoft Knowledgebase article ?Description of security ev ...

CCE-35319-3
Enable indexing uncached Exchange folders Enabling this policy allows indexing of mail items on a Microsoft Exchange server when Microsoft Outlook is not running in cached mode. The default behavior for search is to not index uncached Exchange folders. Disabling this policy will block any indexing ...

CCE-34628-8
Shutdown: Allow system to be shut down without having to log on This policy setting determines whether a computer can be shut down when a user is not logged on. If this policy setting is enabled, the shutdown command is available on the Windows logon screen. Microsoft recommends to disable this pol ...

CCE-35527-1
Audit Policy: System: System Integrity This subcategory reports on violations of integrity of the security subsystem. Events for this subcategory include: ? 4612 : Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. ? 4615 : Inval ...

CCE-35494-4
Audit Policy: Account Logon: Credential Validation This subcategory reports the results of validation tests on credentials submitted for a user account logon request. These events occur on the computer that is authoritative for the credentials. For domain accounts, the domain controller is authorit ...

CCE-33204-9
Turn off Internet File Association service Specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. When a user opens a file that has an extension that is not associated with any applications on the machine, the user is given ...

CCE-33816-0
MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) The registry value entry DisableIPSourceRouting was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ registry key. The entry appears as MSS: (D ...

CCE-33094-4
Change the system time This policy setting determines which users and groups can change the time and date on the internal clock of the computers in your environment. Users who are assigned this user right can affect the appearance of event logs. When a computer?s time setting is changed, logged eve ...

CCE-33949-9
Accounts: Guest account status This policy setting determines whether the Guest account is enabled or disabled. The Guest account allows unauthenticated network users to gain access to the system. Note that this setting will have no impact when applied to the domain controller organizational unit v ...

CCE-33719-6
Network access: Sharing and security model for local accounts This policy setting determines how network logons that use local accounts are authenticated. The Classic option allows precise control over access to resources, including the ability to assign different types of access to different users ...

CCE-35516-4
Audit Policy: Object Access: Handle Manipulation This subcategory reports when a handle to an object is opened or closed. Only objects with SACLs cause these events to be generated, and only if the attempted handle operation matches the SACL. Handle Manipulation events are only generated for object ...

CCE-33215-5
Set 6to4 State This policy setting allows you to configure 6to4, an address assignment and router-to-router automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 sites and hosts across the IPv4 Internet. 6to4 uses the global address prefix: 2002:WWXX:YYZZ::/4 ...

CCE-35603-0
Audit Policy: Object Access: Filtering Platform Packet Drop This subcategory reports when packets are dropped by Windows Filtering Platform (WFP). These events can be very high in volume. Events for this subcategory include: ? 5152: The Windows Filtering Platform blocked a packet. ? 5153: A more r ...

CCE-33817-8
Turn off Search Companion content file updates This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches.

CCE-35252-6
Windows Firewall: Domain: Logging: Log dropped packets Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log.

CCE-33783-2
Turn off printing over HTTP This policy setting allows you to disable the client computer?s ability to print over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.

CCE-35505-7
Audit Policy: Logon-Logoff: IPsec Main Mode This subcategory reports the results of Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. Events for this subcategory include: ? 4646: IKE DoS-prevention mode started. ? 4650: An IPsec Main Mo ...

CCE-35275-7
Manage auditing and security log This policy setting determines which users can change the auditing options for files and directories and clear the Security log. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local or located in Active Dir ...

CCE-35067-8
Restore files and directories This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on computers that run Windows Vista in your environment. This user right also determines which users ...

CCE-33060-5
Windows Firewall: Domain: Allow unicast response This option is useful if you need to control whether this computer receives unicast responses to its outgoing multicast or broadcast messages.

CCE-32929-2
Accounts: Limit local account use of blank passwords to console logon only This policy setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If you enable this policy setting, local accounts that have ...

CCE-33160-3
Windows Firewall: Domain: Firewall state Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rule ...

CCE-33729-5
Control Event Log behavior when the log file reaches its maximum size This policy setting controls Event Log behavior when the log file reaches its maximum size. If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. If y ...

CCE-34356-6
Windows Firewall: Private: Logging: Size limit (KB) Use this option to specify the size limit of the file in which Windows Firewall will write its log information.

CCE-34901-9
Interactive logon: Number of previous logons to cache (in case domain controller is not available) This policy setting determines whether a user can log on to a Windows domain using cached account information. Logon information for domain accounts can be cached locally to allow users to log on even ...

CCE-33815-2
User Account Control: Switch to the secure desktop when prompting for elevation This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. The options are: - Enabled: (Default) All elevation requests go to the secure des ...

CCE-33608-1
Turn off Data Execution Prevention for Explorer Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer.

CCE-35701-2
Windows Firewall: Domain: Apply local connection security rules This setting controls whether local administrators are allowed to create connection security rules that apply together with connection security rules configured by Group Policy.

CCE-33563-8
Network access: Restrict anonymous access to Named Pipes and Shares When enabled, this policy setting restricts anonymous access to only those shares and pipes that are named in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymou ...

CCE-33051-4
Create a pagefile This policy setting allows users to change the size of the pagefile. By making the pagefile extremely large or extremely small, an attacker could easily affect the performance of a compromised computer. When configuring a user right in the SCM enter a comma delimited list of acco ...

CCE-35536-2
Windows Firewall: Private: Allow unicast response This option is useful if you need to control whether this computer receives unicast responses to its outgoing multicast or broadcast messages.

CCE-34619-7
MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended) The registry value entry ScreenSaverGracePeriod was added to the template file in the HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\ Windows NT\CurrentVersion\Winlogon\ registry key. The en ...

CCE-33718-8
Network access: Do not allow storage of passwords and credentials for network authentication This policy setting determines whether the Stored User Names and Passwords feature may save passwords or credentials for later use when it gains domain authentication. If you enable this policy setting, the ...

CCE-35306-0
Windows Firewall: Domain: Logging: Log successful connections Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log.

CCE-33107-4
Prohibit installation and configuration of Network Bridge on your DNS domain network Determines whether a user can install and configure the Network Bridge. Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to w ...

CCE-33216-3
Turn off Registration if URL connection is referring to Microsoft.com Specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration. If you enable this setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register ...

CCE-33717-0
Microsoft network client: Send unencrypted password to third-party SMB servers Disable this policy setting to prevent the SMB redirector from sending plaintext passwords during authentication to third-party SMB servers that do not support password encryption. Microsoft recommends that you disable t ...

CCE-34705-4
Do not process the run once list This policy setting causes the run once list, which is the list of programs that Windows Vista runs automatically when it starts, to be ignored. This policy setting differs from the Do not process the legacy run list setting in that programs on this list will run on ...

CCE-33063-9
Windows Firewall: Domain: Inbound connections This setting determines the behavior for inbound connections that do not match an inbound firewall rule. The default behavior is to block connections unless there are firewall rules to allow the connection.

CCE-35438-1
MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) The registry value entry AutoAdminLogon was added to the template file in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ registry key. The entry appears as MSS: (AutoAdminLogon) Enable Automatic Logon (not ...

CCE-33782-4
Require a Password When a Computer Wakes (On Battery) Specifies whether or not the user is prompted for a password when the system resumes from sleep.

CCE-33040-7
Audit Policy: Detailed Tracking: Process Creation This subcategory reports the creation of a process and the name of the program or user that created it. Events for this subcategory include: ? 4688: A new process has been created. ? 4696: A primary token was assigned to process. Refer to the Micros ...

CCE-34913-4
Modify an object label This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this ...

CCE-35219-5
Enforce password history This policy setting determines the number of renewed, unique passwords that have to be associated with a user account before you can reuse an old password. The value for this policy setting must be between 0 and 24 passwords. The default value for Windows Vista is 0 passwor ...

CCE-35370-6
Store passwords using reversible encryption This policy setting determines whether the operating system stores passwords in a way that uses reversible encryption, which provides support for application protocols that require knowledge of the user's password for authentication purposes. Passwords th ...

CCE-35525-5
Audit Policy: System: IPsec Driver This subcategory reports on the activities of the Internet Protocol security (IPsec) driver. Events for this subcategory include: ? 4960: IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or ...

CCE-35502-4
Audit Policy: DS Access: Directory Service Changes This subcategory reports changes to objects in Active Directory Domain Services (AD DS). The types of changes that are reported are create, modify, move, and undelete operations that are performed on an object. DS Change auditing, where appropriate ...

CCE-35099-1
Interactive logon: Do not require CTRL+ALT+DEL This policy setting determines whether users must press CTRL+ALT+DEL before they log on. If you enable this policy setting, users can log on without this key combination. If you disable this policy setting, users must press CTRL+ALT+DEL before they log ...

CCE-33161-1
Windows Firewall: Private: Inbound connections This setting determines the behavior for inbound connections that do not match an inbound firewall rule. The default behavior is to block connections unless there are firewall rules to allow the connection.

CCE-33728-7
Account lockout threshold This policy setting determines the number of failed logon attempts before a lock occurs. Authorized users can lock themselves out of an account by mistyping their password or by remembering it incorrectly, or by changing their password on one computer while logged on to an ...

CCE-34771-6
Set the default behavior for AutoRun This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines. Prior to Windows Vista, when media containing ...

CCE-33436-7
Windows Firewall: Private: Logging: Log dropped packets Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log.

CCE-35405-0
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers The registry value entry NoNameReleaseOnDemand was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\ Parameters\ registry key. The entry appea ...

CCE-33792-3
MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. The registry value entry NoDefaultExempt was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSEC\ registry key. The entry appears as MSS: (NoDefaultExempt) Configure IPSe ...

CCE-34169-3
Control Event Log behavior when the log file reaches its maximum size This policy setting controls Event Log behavior when the log file reaches its maximum size. If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. If y ...

CCE-34355-8
Devices: Allowed to format and eject removable media This policy setting determines who is allowed to format and eject removable media. You can use this policy setting to prevent unauthorized users from removing data on one computer to access it on another computer on which they have local administ ...

CCE-33814-5
MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments) The registry value entry Hidden was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\Parameters\ registry key. The entry appears as MSS: (Hidde ...

CCE-34902-7
Interactive logon: Require Domain Controller authentication to unlock workstation Logon information is required to unlock a locked computer. For domain accounts, the Interactive logon: Require Domain Controller authentication to unlock workstation setting determines whether it is necessary to conta ...

CCE-33073-8
Configure minimum PIN length for startup This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 2 ...

CCE-35537-0
Windows Firewall: Public: Apply local firewall rules This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy.

CCE-35439-9
Configure Microsoft Active Protection Service Reporting This policy setting allows you to configure membership in Microsoft Active Protection Service. Microsoft Active Protection Service is the online community that helps you choose how to respond to potential threats. The community also helps s ...

CCE-34245-1
Disable Logging If this setting is enabled Windows Error Reporting events will not be logged to the system event log.

CCE-34597-5
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes The registry value entry EnableICMPRedirect was added to the template file in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ registry key. The entry appears as MSS: (EnableICMPRedirect) Allo ...

CCE-35601-4
Audit Policy: Detailed Tracking: Process Termination This subcategory reports when a process terminates. Events for this subcategory include: ? 4689: A process has exited. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for t ...

CCE-35065-2
Microsoft network server: Digitally sign communications (always) This policy setting determines if the server side SMB service is required to perform SMB packet signing. Enable this policy setting in a mixed environment to prevent downstream clients from using the workstation as a network server.

CCE-33062-1
Windows Firewall: Domain: Display a notification Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. Note When the Apply local firewall rules setting is configured to No, Microsoft recom ...

CCE-35503-2
Audit Policy: DS Access: Directory Service Replication This subcategory reports when replication between two domain controllers begins and ends. Events for this subcategory include: ? 4932: Synchronization of a replica of an Active Directory naming context has begun. ? 4933: Synchronization of a re ...

CCE-35526-3
Audit Policy: System: Security System Extension This subcategory reports the loading of extension code such as authentication packages by the security subsystem. Events for this subcategory include: ? 4610: An authentication package has been loaded by the Local Security Authority. ? 4611: A truste ...

CCE-33957-2
Turn off the Windows Messenger Customer Experience Improvement Program This policy setting specifies whether Windows Messenger can collect anonymous information about how the Windows Messenger software and service is used.

CCE-35090-0
Control Event Log behavior when the log file reaches its maximum size This policy setting controls Event Log behavior when the log file reaches its maximum size. If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. If y ...

CCE-34651-0
Network access: Shares that can be accessed anonymously This policy setting determines which network shares can be accessed by anonymous users. The default configuration for this policy setting has little effect because all users have to be authenticated before they can access shared resources on t ...

CCE-33437-5
Windows Firewall: Private: Logging: Name Use this option to specify the path and name of the file in which Windows Firewall will write its log information.

CCE-33791-5
Turn off Autoplay Autoplay starts to read from a drive as soon as you insert media in the drive, which causes the setup file for programs or audio media to start immediately. An attacker could use this feature to launch a program to damage the computer or data on the computer. You can enable the Tu ...

CCE-35497-7
Audit Policy: Account Management: Other Account Management Events This subcategory reports other account management events. Events for this subcategory include: ? 4782: The password hash an account was accessed. ? 4793: The Password Policy Checking API was called. Refer to the Microsoft Knowledgeba ...

CCE-33053-0
Create symbolic links This policy setting determines which users can create symbolic links. In Windows Vista, existing NTFS file system objects, such as files and folders, can be accessed by referring to a new kind of file system object called a symbolic link. A symbolic link is a pointer (much lik ...

CCE-34903-5
Load and unload device drivers This policy setting allows users to dynamically load a new device driver on a system. An attacker could potentially use this capability to install malicious code that appears to be a device driver. This user right is required for users to add local printers or printer ...

CCE-34697-3
Do not allow drive redirection This policy setting prevents users from sharing the local drives on their client computers to Terminal Servers that they access. Mapped drives appear in the session folder tree in Windows Explorer in the following format: \\TSClient\<driveletter>$ If local drives are ...

CCE-33813-7
No auto-restart with logged on users for scheduled automatic updates installations This policy setting specifies that Automatic Updates will wait for computers to be restarted by the users who are logged on to them to complete a scheduled installation. If you enable the No auto-restart for schedule ...

CCE-32938-3
Password protect the screen saver If the Password protect the screen saver setting is enabled, then all screen savers are password protected, if it is disabled then password protection cannot be set on any screen saver.

CCE-33162-9
Windows Firewall: Private: Outbound connections This setting determines the behavior for outbound connections that do not match an outbound firewall rule. The default behavior is to allow connections unless there are firewall rules that block the connection. Important If you set Outbound connect ...

CCE-35595-8
Set time limit for active but idle Remote Desktop Services sessions This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected. If you enable this policy setting, you m ...

CCE-35703-8
Windows Firewall: Public: Firewall state Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rule ...

CCE-35606-3
Prohibit Access of the Windows Connect Now wizards This policy setting prohibits access to Windows Connect Now (WCN) wizards. If this policy setting is enabled, the wizards are disabled and users will have no access to any of the wizard tasks. All the configuration related tasks, including ?Set up ...

CCE-35399-5
Audit Policy: Object Access: File Share This subcategory reports when a file share is accessed. By itself, this policy setting will not cause auditing of any events. It determines whether to audit the event of a user who accesses a file share object that has a specified system access control list ( ...

CCE-35561-0
Route all traffic through the internal network This policy setting determines whether a remote client computer routes Internet traffic through the internal network or whether the client accesses the Internet directly. When a remote client computer connects to an internal network using DirectAcces ...

CCE-33715-4
Force shutdown from a remote system This policy setting allows users to shut down Windows Vista?based computers from remote locations on the network. Anyone who has been assigned this user right can cause a denial of service (DoS) condition, which would make the computer unavailable to service user ...

CCE-34531-4
Do not use temporary folders per session This policy setting allows you to prevent Remote Desktop Services from creating session-specific temporary folders. You can use this policy setting to disable the creation of separate temporary folders on a remote computer for each session. By default, Remo ...

CCE-35003-3
Replace a process level token This policy setting allows one process or service to start another service or process with a different security access token, which can be used to modify the security access token of that sub-process and result in the escalation of privileges. When configuring a user ...

CCE-33780-8
Create permanent shared objects This user right is useful to kernel-mode components that extend the object namespace. However, components that run in kernel mode have this user right inherently. Therefore, it is typically not necessary to specifically assign this user right. When configuring a use ...

CCE-33065-4
Windows Firewall: Private: Display a notification Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. Note When the Apply local firewall rules setting is configured to No, Microsoft reco ...

CCE-35232-8
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) This policy setting determines the strength of the default discretionary access control list (DACL) for objects. The setting helps secure objects that can be located and shared among processes and its de ...

CCE-33042-3
Audit Policy: Policy Change: Authorization Policy Change This subcategory reports changes in authorization policy including permissions (DACL) changes. Events for this subcategory include: ? 4704: A user right was assigned. ? 4705: A user right was removed. ? 4706: A new trust was created to a do ...

CCE-34893-8
Domain member: Digitally sign secure channel data (when possible) This policy setting determines whether a domain member should attempt to negotiate whether all secure channel traffic that it initiates must be digitally signed. Digital signatures protect the traffic from being modified by anyone wh ...

CCE-35508-1
Audit Policy: Logon-Logoff: Logon This subcategory reports when a user attempts to log on to the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, ...

CCE-33802-0
Network security: LDAP client signing requirements This policy setting determines the level of data signing that is requested on behalf of clients that issue LDAP BIND requests, as follows: - None. The LDAP BIND request is issued with the caller-specified options. - Negotiate signing. If Transport ...

CCE-35366-4
Minimum password age This policy setting determines the number of days that you must use a password before you can change it. The range of values for this policy setting is between 1 and 999 days. (You may also set the value to 0 to allow immediate password changes.) The default value for this sett ...

CCE-33208-0
Turn off Microsoft Peer-to-Peer Networking Services This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working. Peer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution a ...

CCE-33790-7
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) This entry appears as MSS: (DisableIPSourceRouting) IPv6 source routing protection level (protects against packet spoofing) in the SCE. IP source routing is a mechanism that allows the sender to ...

CCE-35498-5
Audit Policy: Account Management: Security Group Management This subcategory reports each event of security group management, such as when a security group is created, changed, or deleted or when a member is added to or removed from a security group. If you enable this Audit policy setting, adminis ...

CCE-33098-5
Windows Firewall: Domain: Outbound connections This setting determines the behavior for outbound connections that do not match an outbound firewall rule. In Windows Vista, the default behavior is to allow connections unless there are firewall rules that block the connection.

CCE-35702-0
Windows Firewall: Private: Apply local firewall rules This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy.

CCE-35222-9
Microsoft network client: Digitally sign communications (always) This policy setting determines whether packet signing is required by the SMB client component. If you enable this policy setting, the Microsoft network client computer cannot communicate with a Microsoft network server unless that ser ...

CCE-34061-2
Turn off the 'Order Prints' picture task Specifies whether the 'Order Prints Online' task is available from Picture Tasks in Windows folders. The 'Order Prints Online' Wizard is used to download a list of providers and allow users to order prints online. If you enable this setting, the task 'Orde ...

CCE-33064-7
Windows Firewall: Private: Apply local connection security rules This setting controls whether local administrators are allowed to create connection security rules that apply together with connection security rules configured by Group Policy.

CCE-34894-6
Domain member: Maximum machine account password age This policy setting determines the maximum allowable age for a computer account password. By default, domain members automatically change their domain passwords every 30 days. If you increase this interval significantly or set it to 0 so that the ...

CCE-33041-5
Audit Policy: DS Access: Directory Service Access This subcategory reports when an AD DS object is accessed. Only objects with SACLs cause audit events to be generated, and only when they are accessed in a manner that matches their SACL. These events are similar to the directory service access even ...

CCE-33801-2
Configure Offer Remote Assistance This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer. If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Ass ...

CCE-35331-8
Configure Solicited Remote Assistance This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messag ...

CCE-34073-7
Turn on Responder (RSPNDR) driver This policy setting changes the operational behavior of the Responder network protocol driver. The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a comput ...

CCE-33164-5
Enable screen saver This policy setting allows you to manage whether or not screen savers run. If the Screen Saver setting is disabled screen savers do not run and the screen saver section of the Screen Saver tab in Display in Control Panel is disabled. If this setting is enabled a screen saver wil ...

CCE-35408-4
Reset account lockout counter after This policy setting determines the length of time before the Account lockout threshold resets to zero. The default value for this policy setting is Not Defined. If the Account lockout threshold is defined, this reset time must be less than or equal to the value f ...

CCE-33141-3
Network security: Allow Local System to use computer identity for NTLM When enabled, this policy setting causes Local System services that use Negotiate to use the computer identity when NTLM authentication is selected by the negotiation. This policy is supported on at least Windows 7 or Windows Se ...

CCE-35781-4
Turn off downloading of print drivers over HTTP This policy setting controls whether the computer can download print driver packages over HTTP. To set up HTTP printing, printer drivers that are not available in the standard operating system installation might need to be downloaded over HTTP.

CCE-35288-0
Specify the maximum log file size (KB) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte incremen ...

CCE-35461-3
Deny log on as a batch job This policy setting determines which accounts will not be able to log on to the computer as a batch job. A batch job is not a batch (.bat) file, but rather a batch-queue facility. Accounts that use the Task Scheduler to schedule jobs need this user right. The Deny log on ...

CCE-35363-1
Generate security audits This policy setting determines which users or processes can generate audit records in the Security log. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local or located in Active Directory, they can be groups, user ...

CCE-35517-2
Audit Policy: Object Access: Kernel Object This subcategory reports when kernel objects such as processes and mutexes are accessed. Only kernel objects with SACLs cause audit events to be generated, and only when they are accessed in a manner matching their SACL. Typically kernel objects are only g ...

CCE-34993-6
Network security: Force logoff when logon hours expire This policy setting, which determines whether to disconnect users who are connected to the local computer outside their user account?s valid logon hours, affects the SMB component. If you enable this policy setting, client sessions with the SMB ...

CCE-33428-4
Specify the maximum log file size (KB) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte incremen ...

CCE-33067-0
Windows Firewall: Public: Allow unicast response This option is useful if you need to control whether this computer receives unicast responses to its outgoing multicast or broadcast messages.

CCE-35506-5
Audit Policy: Logon-Logoff: IPsec Quick Mode This subcategory reports the results of IKE protocol and AuthIP during Quick Mode negotiations. ? 4654: An IPsec Quick Mode negotiation failed. Events for this subcategory include: ? 4977: During Quick Mode negotiation, IPsec received an invalid negotiat ...

CCE-32928-4
Access this computer from the network This policy setting allows other users on the network to connect to the computer and is required by various network protocols that include Server Message Block (SMB)?based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus ( ...

CCE-33481-3
Turn on session logging This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance. If you enable this policy setting, log files will be generated. If you disable this policy setting, log files will not be generated. If ...

CCE-34520-7
Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box This policy setting allows you to manage whether the Install Updates and Shut Down option is displayed in the Shut Down Windows dialog box. This policy setting works in conjunction with the following Do not adjust ...

CCE-35409-2
Account lockout duration This policy setting determines the length of time that must pass before a locked account is unlocked and a user can try to log on again. The setting does this by specifying the number of minutes a locked out account will remain unavailable. If the value for this policy sett ...

CCE-35496-9
Audit Policy: Account Logon: Kerberos Service Ticket Operations This subcategory reports generated by Kerberos ticket request processes on the domain controller that is authoritative for the domain account. Events for this subcategory include: ? 4769: A Kerberos service ticket was requested. ? 4770 ...

CCE-34631-2
Network access: Do not allow anonymous enumeration of SAM accounts This policy setting controls the ability of anonymous users to enumerate the accounts in the Security Accounts Manager (SAM). If you enable this policy setting, users with anonymous connections cannot enumerate domain account user n ...

CCE-35462-1
Require a Password When a Computer Wakes (Plugged In) Specifies whether or not the user is prompted for a password when the system resumes from sleep.

CCE-35178-3
Increase scheduling priority This policy setting determines whether users can increase the base priority class of a process. (It is not a privileged operation to increase relative priority within a priority class.) This user right is not required by administrative tools that are supplied with the o ...

CCE-35518-0
Audit Policy: Object Access: Other Object Access Events This subcategory reports other object access-related events such as Task Scheduler jobs and COM+ objects. Events for this subcategory include: ? 4671: An application attempted to access a blocked ordinal through the TBS. ? 4691: Indirect acce ...

CCE-34907-6
Maximum password age This policy setting defines how long a user can use their password before it expires. Values for this policy setting range from 0 to 999 days. If you set the value to 0, the password will never expire. The default value for this policy setting is 42 days. Because attackers can ...

CCE-33043-1
Audit Policy: System: Security State Change This subcategory reports changes in security state of the system, such as when the security subsystem starts and stops. Events for this subcategory include: ? 4608: Windows is starting up. ? 4609: Windows is shutting down. ? 4616: The system time was ch ...

CCE-33066-2
Windows Firewall: Private: Firewall state Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rul ...

CCE-35000-9
Profile single process This policy setting determines which users can use tools to monitor the performance of non-system processes. Typically, you do not need to configure this user right to use the Microsoft Management Console (MMC) Performance snap-in. However, you do need this user right if Syst ...

CCE-35507-3
Audit Policy: Logon-Logoff: Logoff This subcategory reports when a user logs off from the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these ...

CCE-33153-8
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com Specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs). If you enable this setting, the 'Choose a list of Internet Service Providers' path ...

CPE    1
cpe:/o:microsoft:windows_8.1
*XCCDF
xccdf_org.secpod_benchmark_NIST_800_53_r4_Windows_8_1
OVAL    288
oval:org.secpod.oval:def:22617
oval:org.secpod.oval:def:22454
oval:org.secpod.oval:def:22616
oval:org.secpod.oval:def:22615
...

© 2013 SecPod Technologies