Microsoft Security Baselines (SCT) 2026-10-08
AllInternet Explorer 11 - ComputerInternet Explorer 11 - UserWindows 11 25H2 - BitLockerWindows 11 25H2 - ComputerWindows 11 25H2 - Credential GuardWindows 11 25H2 - Defender AntivirusWindows 11 25H2 - Domain SecurityWindows 11 25H2 - User
| Ref | Title | Text | |
|---|---|---|---|
| RunThisTimeEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\RunThisTimeEnabled | REG_DWORD = 0 | |
| VersionCheckEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\VersionCheckEnabled | REG_DWORD = 1 | |
| CheckExeSignatures | HKLM\Software\Policies\Microsoft\Internet Explorer\Download\CheckExeSignatures | REG_SZ = yes | |
| RunInvalidSignatures | HKLM\Software\Policies\Microsoft\Internet Explorer\Download\RunInvalidSignatures | REG_DWORD = 0 | |
| DisableEPMCompat | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableEPMCompat | REG_DWORD = 1 | |
| DisableInternetExplorerLaunchViaCOM | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableInternetExplorerLaunchViaCOM | REG_DWORD = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\iexplore.exe | REG_SZ = 1 | |
| Isolation | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\Isolation | REG_SZ = PMEM | |
| Isolation64Bit | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\Isolation64Bit | REG_DWORD = 1 | |
| EnabledV9 | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 | REG_DWORD = 1 | |
| PreventOverride | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverride | REG_DWORD = 1 | |
| PreventOverrideAppRepUnknown | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverrideAppRepUnknown | REG_DWORD = 1 | |
| NoCrashDetection | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoCrashDetection | REG_DWORD = 1 | |
| BlockNonAdminActiveXInstall | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX\BlockNonAdminActiveXInstall | REG_DWORD = 1 | |
| DisableSecuritySettingsCheck | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck | REG_DWORD = 0 | |
| OnlyUseAXISForActiveXInstall | HKLM\Software\Policies\Microsoft\Windows\AxInstaller\OnlyUseAXISForActiveXInstall | REG_DWORD = 1 | |
| CertificateRevocation | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation | REG_DWORD = 1 | |
| EnableSSL3Fallback | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSSL3Fallback | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1C00 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1C00 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1C00 | REG_DWORD = 0 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\2301 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1C00 | REG_DWORD = 0 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\2301 | REG_DWORD = 0 | |
| PreventIgnoreCertErrors | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\PreventIgnoreCertErrors | REG_DWORD = 1 | |
| SecureProtocols | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols | REG_DWORD = 2560 | |
| Security_HKLM_only | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only | REG_DWORD = 1 | |
| Security_options_edit | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_options_edit | REG_DWORD = 1 | |
| Security_zones_map_edit | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_zones_map_edit | REG_DWORD = 1 | |
| WarnOnBadCertRecving | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving | REG_DWORD = 1 | |
| UNCAsIntranet | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1C00 | REG_DWORD = 0 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\270C | REG_DWORD = 0 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201 | REG_DWORD = 3 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1C00 | REG_DWORD = 65536 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\270C | REG_DWORD = 0 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1201 | REG_DWORD = 3 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1C00 | REG_DWORD = 65536 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\270C | REG_DWORD = 0 | |
| 1001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001 | REG_DWORD = 3 | |
| 1004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004 | REG_DWORD = 3 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201 | REG_DWORD = 3 | |
| 1206 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1206 | REG_DWORD = 3 | |
| 1209 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1209 | REG_DWORD = 3 | |
| 120b | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120b | REG_DWORD = 3 | |
| 120c | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120c | REG_DWORD = 3 | |
| 1406 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1406 | REG_DWORD = 3 | |
| 1407 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1407 | REG_DWORD = 3 | |
| 1409 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1409 | REG_DWORD = 0 | |
| 140C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C | REG_DWORD = 3 | |
| 1606 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1606 | REG_DWORD = 3 | |
| 1607 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1607 | REG_DWORD = 3 | |
| 160A | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\160A | REG_DWORD = 3 | |
| 1802 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1802 | REG_DWORD = 3 | |
| 1804 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804 | REG_DWORD = 3 | |
| 1806 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1806 | REG_DWORD = 1 | |
| 1809 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1809 | REG_DWORD = 0 | |
| 1A00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A00 | REG_DWORD = 65536 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1C00 | REG_DWORD = 0 | |
| 2001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2001 | REG_DWORD = 3 | |
| 2004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004 | REG_DWORD = 3 | |
| 2101 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2101 | REG_DWORD = 3 | |
| 2102 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2102 | REG_DWORD = 3 | |
| 2103 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2103 | REG_DWORD = 3 | |
| 2200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2200 | REG_DWORD = 3 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2301 | REG_DWORD = 0 | |
| 2402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2402 | REG_DWORD = 3 | |
| 2500 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 | REG_DWORD = 0 | |
| 2708 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2708 | REG_DWORD = 3 | |
| 2709 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2709 | REG_DWORD = 3 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\270C | REG_DWORD = 0 | |
| 1001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001 | REG_DWORD = 3 | |
| 1004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004 | REG_DWORD = 3 | |
| 1200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 | REG_DWORD = 3 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201 | REG_DWORD = 3 | |
| 1206 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1206 | REG_DWORD = 3 | |
| 1209 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1209 | REG_DWORD = 3 | |
| 120b | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120b | REG_DWORD = 3 | |
| 120c | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120c | REG_DWORD = 3 | |
| 1400 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 | REG_DWORD = 3 | |
| 1402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1402 | REG_DWORD = 3 | |
| 1405 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405 | REG_DWORD = 3 | |
| 1406 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1406 | REG_DWORD = 3 | |
| 1407 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1407 | REG_DWORD = 3 | |
| 1409 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1409 | REG_DWORD = 0 | |
| 140C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\140C | REG_DWORD = 3 | |
| 1606 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1606 | REG_DWORD = 3 | |
| 1607 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1607 | REG_DWORD = 3 | |
| 1608 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1608 | REG_DWORD = 3 | |
| 160A | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\160A | REG_DWORD = 3 | |
| 1802 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1802 | REG_DWORD = 3 | |
| 1803 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1803 | REG_DWORD = 3 | |
| 1804 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804 | REG_DWORD = 3 | |
| 1806 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806 | REG_DWORD = 3 | |
| 1809 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1809 | REG_DWORD = 0 | |
| 1A00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A00 | REG_DWORD = 196608 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1C00 | REG_DWORD = 0 | |
| 2000 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2000 | REG_DWORD = 3 | |
| 2001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2001 | REG_DWORD = 3 | |
| 2004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2004 | REG_DWORD = 3 | |
| 2101 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2101 | REG_DWORD = 3 | |
| 2102 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2102 | REG_DWORD = 3 | |
| 2103 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2103 | REG_DWORD = 3 | |
| 2200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2200 | REG_DWORD = 3 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2301 | REG_DWORD = 0 | |
| 2402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2402 | REG_DWORD = 3 | |
| 2500 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 | REG_DWORD = 0 | |
| 2708 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2708 | REG_DWORD = 3 | |
| 2709 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2709 | REG_DWORD = 3 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\270C | REG_DWORD = 0 | |
| FormSuggest Passwords | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\FormSuggest Passwords | REG_DWORD = 1 | |
| FormSuggest Passwords | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FormSuggest Passwords | REG_SZ = no | |
| FormSuggest PW Ask | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FormSuggest PW Ask | REG_SZ = no | |
| DisableExternalDMAUnderLock | HKLM\SOFTWARE\Policies\Microsoft\FVE\DisableExternalDMAUnderLock | REG_DWORD = 1 | |
| RDVDenyCrossOrg | HKLM\SOFTWARE\Policies\Microsoft\FVE\RDVDenyCrossOrg | REG_DWORD = 0 | |
| UseEnhancedPin | HKLM\SOFTWARE\Policies\Microsoft\FVE\UseEnhancedPin | REG_DWORD = 1 | |
| ACSettingIndex | HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab\ACSettingIndex | REG_DWORD = 0 | |
| DCSettingIndex | HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab\DCSettingIndex | REG_DWORD = 0 | |
| DenyDeviceClasses | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses | REG_DWORD = 1 | |
| **delvals. | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses\**delvals. | REG_SZ = | |
| 1 | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses\1 | REG_SZ = {d48179be-ec20-11d1-b6b8-00c04fa372a7} | |
| DenyDeviceClassesRetroactive | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClassesRetroactive | REG_DWORD = 1 | |
| RDVDenyWriteAccess | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\RDVDenyWriteAccess | REG_DWORD = 1 | |
| Audit Security State Change | Audit policy: Audit Security State Change | Success | |
| Audit Security System Extension | Audit policy: Audit Security System Extension | Success | |
| Audit System Integrity | Audit policy: Audit System Integrity | Success and Failure | |
| Audit Other System Events | Audit policy: Audit Other System Events | Success and Failure | |
| Audit Logon | Audit policy: Audit Logon | Success and Failure | |
| Audit Account Lockout | Audit policy: Audit Account Lockout | Failure | |
| Audit Special Logon | Audit policy: Audit Special Logon | Success | |
| Audit Other Logon/Logoff Events | Audit policy: Audit Other Logon/Logoff Events | Success and Failure | |
| Audit File Share | Audit policy: Audit File Share | Success and Failure | |
| Audit Other Object Access Events | Audit policy: Audit Other Object Access Events | Success and Failure | |
| Audit Sensitive Privilege Use | Audit policy: Audit Sensitive Privilege Use | Success | |
| Audit Process Creation | Audit policy: Audit Process Creation | Success | |
| Audit Audit Policy Change | Audit policy: Audit Audit Policy Change | Success | |
| Audit Authentication Policy Change | Audit policy: Audit Authentication Policy Change | Success | |
| Audit MPSSVC Rule-Level Policy Change | Audit policy: Audit MPSSVC Rule-Level Policy Change | Success and Failure | |
| Audit Other Policy Change Events | Audit policy: Audit Other Policy Change Events | Failure | |
| Audit User Account Management | Audit policy: Audit User Account Management | Success and Failure | |
| Audit Security Group Management | Audit policy: Audit Security Group Management | Success | |
| Audit Credential Validation | Audit policy: Audit Credential Validation | Success and Failure | |
| Audit Detailed File Share | Audit policy: Audit Detailed File Share | Failure | |
| Audit Removable Storage | Audit policy: Audit Removable Storage | Success and Failure | |
| Audit PNP Activity | Audit policy: Audit PNP Activity | Success | |
| Audit Group Membership | Audit policy: Audit Group Membership | Success | |
| AutoConnectAllowedOEM | HKLM\Software\Microsoft\WcmSvc\wifinetworkmanager\config\AutoConnectAllowedOEM | REG_DWORD = 0 | |
| EnumerateAdministrators | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators | REG_DWORD = 0 | |
| NoAutorun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoAutorun | REG_DWORD = 1 | |
| NoDriveTypeAutoRun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun | REG_DWORD = 255 | |
| NoWebServices | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebServices | REG_DWORD = 1 | |
| ADBackupDSRMPassword | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\ADBackupDSRMPassword | REG_DWORD = 1 | |
| ADPasswordEncryptionEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\ADPasswordEncryptionEnabled | REG_DWORD = 1 | |
| BackupDirectory | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS\BackupDirectory | REG_DWORD = 2 | |
| ProcessCreationIncludeCmdLine_Enabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled | REG_DWORD = 1 | |
| AllowEncryptionOracle | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\AllowEncryptionOracle | REG_DWORD = 0 | |
| DisableAutomaticRestartSignOn | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn | REG_DWORD = 1 | |
| EnableMPR | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableMPR | REG_DWORD = 0 | |
| PKINITHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKINITSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1 | REG_DWORD = 0 | |
| PKINITSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256 | REG_DWORD = 3 | |
| PKINITSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384 | REG_DWORD = 3 | |
| PKINITSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512 | REG_DWORD = 3 | |
| PKInitHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKInitSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1 | REG_DWORD = 0 | |
| PKInitSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256 | REG_DWORD = 3 | |
| PKInitSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384 | REG_DWORD = 3 | |
| PKInitSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512 | REG_DWORD = 3 | |
| LocalAccountTokenFilterPolicy | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy | REG_DWORD = 0 | |
| MSAOptional | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\MSAOptional | REG_DWORD = 1 | |
| EnhancedAntiSpoofing | HKLM\Software\Policies\Microsoft\Biometrics\FacialFeatures\EnhancedAntiSpoofing | REG_DWORD = 1 | |
| DisableEnclosureDownload | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds\DisableEnclosureDownload | REG_DWORD = 1 | |
| ACSettingIndex | HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ACSettingIndex | REG_DWORD = 1 | |
| DCSettingIndex | HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\DCSettingIndex | REG_DWORD = 1 | |
| EnableMulticast | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast | REG_DWORD = 0 | |
| EnableNetbios | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableNetbios | REG_DWORD = 0 | |
| CopyFilesPolicy | HKLM\Software\Policies\Microsoft\Windows NT\Printers\CopyFilesPolicy | REG_DWORD = 1 | |
| DisableWebPnPDownload | HKLM\Software\Policies\Microsoft\Windows NT\Printers\DisableWebPnPDownload | REG_DWORD = 1 | |
| RestrictDriverInstallationToAdministrators | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators | REG_DWORD = 1 | |
| RedirectionGuardPolicy | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RedirectionGuardPolicy | REG_DWORD = 1 | |
| ForceKerberosForRpc | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\ForceKerberosForRpc | REG_DWORD = 0 | |
| RpcAuthentication | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcAuthentication | REG_DWORD = 0 | |
| RpcProtocols | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcProtocols | REG_DWORD = 5 | |
| RpcTcpPort | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcTcpPort | REG_DWORD = 0 | |
| RpcUseNamedPipeProtocol | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcUseNamedPipeProtocol | REG_DWORD = 0 | |
| RestrictRemoteClients | HKLM\Software\Policies\Microsoft\Windows NT\Rpc\RestrictRemoteClients | REG_DWORD = 1 | |
| **del.fAllowFullControl | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\**del.fAllowFullControl | REG_SZ = | |
| **del.fUseMailto | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\**del.fUseMailto | REG_SZ = | |
| **del.MaxTicketExpiry | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\**del.MaxTicketExpiry | REG_SZ = | |
| **del.MaxTicketExpiryUnits | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\**del.MaxTicketExpiryUnits | REG_SZ = | |
| DisablePasswordSaving | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\DisablePasswordSaving | REG_DWORD = 1 | |
| fAllowToGetHelp | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fAllowToGetHelp | REG_DWORD = 0 | |
| fDisableCdm | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fDisableCdm | REG_DWORD = 1 | |
| fEncryptRPCTraffic | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fEncryptRPCTraffic | REG_DWORD = 1 | |
| fPromptForPassword | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fPromptForPassword | REG_DWORD = 1 | |
| MinEncryptionLevel | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\MinEncryptionLevel | REG_DWORD = 3 | |
| LetAppsActivateWithVoiceAboveLock | HKLM\Software\Policies\Microsoft\Windows\AppPrivacy\LetAppsActivateWithVoiceAboveLock | REG_DWORD = 2 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\Bowser\EnableMailslots | REG_DWORD = 0 | |
| DisableWindowsConsumerFeatures | HKLM\Software\Policies\Microsoft\Windows\CloudContent\DisableWindowsConsumerFeatures | REG_DWORD = 1 | |
| AllowProtectedCreds | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowProtectedCreds | REG_DWORD = 1 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application\MaxSize | REG_DWORD = 32768 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security\MaxSize | REG_DWORD = 196608 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\System\MaxSize | REG_DWORD = 32768 | |
| DisableMotWOnInsecurePathCopy | HKLM\Software\Policies\Microsoft\Windows\Explorer\DisableMotWOnInsecurePathCopy | REG_DWORD = 0 | |
| NoAutoplayfornonVolume | HKLM\Software\Policies\Microsoft\Windows\Explorer\NoAutoplayfornonVolume | REG_DWORD = 1 | |
| AllowGameDVR | HKLM\Software\Policies\Microsoft\Windows\GameDVR\AllowGameDVR | REG_DWORD = 0 | |
| AlwaysInstallElevated | HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated | REG_DWORD = 0 | |
| EnableUserControl | HKLM\Software\Policies\Microsoft\Windows\Installer\EnableUserControl | REG_DWORD = 0 | |
| DeviceEnumerationPolicy | HKLM\Software\Policies\Microsoft\Windows\Kernel DMA Protection\DeviceEnumerationPolicy | REG_DWORD = 0 | |
| AuditClientDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditClientDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning | REG_DWORD = 1 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| EnableAuthRateLimiter | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter | REG_DWORD = 1 | |
| InvalidAuthenticationDelayTimeInMs | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs | REG_DWORD = 2000 | |
| MaxSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\MaxSmb2Dialect | REG_DWORD = 785 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\MinSmb2Dialect | REG_DWORD = 768 | |
| AllowInsecureGuestAuth | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AllowInsecureGuestAuth | REG_DWORD = 0 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| AuditServerDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditServerDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning | REG_DWORD = 1 | |
| MaxSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\MaxSmb2Dialect | REG_DWORD = 785 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\MinSmb2Dialect | REG_DWORD = 768 | |
| RequireEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\RequireEncryption | REG_DWORD = 0 | |
| NC_ShowSharedAccessUI | HKLM\Software\Policies\Microsoft\Windows\Network Connections\NC_ShowSharedAccessUI | REG_DWORD = 0 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\EnableMailslots | REG_DWORD = 0 | |
| \\*\NETLOGON | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\NETLOGON | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| \\*\SYSVOL | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\SYSVOL | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| NoLockScreenCamera | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenCamera | REG_DWORD = 1 | |
| NoLockScreenSlideshow | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenSlideshow | REG_DWORD = 1 | |
| **del.EnableScriptBlockInvocationLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\**del.EnableScriptBlockInvocationLogging | REG_SZ = | |
| EnableScriptBlockLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging | REG_DWORD = 1 | |
| Enabled | HKLM\Software\Policies\Microsoft\Windows\Sudo\Enabled | REG_DWORD = 0 | |
| AllowCustomSSPsAPs | HKLM\Software\Policies\Microsoft\Windows\System\AllowCustomSSPsAPs | REG_DWORD = 0 | |
| AllowDomainPINLogon | HKLM\Software\Policies\Microsoft\Windows\System\AllowDomainPINLogon | REG_DWORD = 0 | |
| EnableSmartScreen | HKLM\Software\Policies\Microsoft\Windows\System\EnableSmartScreen | REG_DWORD = 1 | |
| EnumerateLocalUsers | HKLM\Software\Policies\Microsoft\Windows\System\EnumerateLocalUsers | REG_DWORD = 0 | |
| RunAsPPL | HKLM\Software\Policies\Microsoft\Windows\System\RunAsPPL | REG_DWORD = 1 | |
| ShellSmartScreenLevel | HKLM\Software\Policies\Microsoft\Windows\System\ShellSmartScreenLevel | REG_SZ = Block | |
| fBlockNonDomain | HKLM\Software\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\fBlockNonDomain | REG_DWORD = 1 | |
| AllowIndexingEncryptedStoresOrItems | HKLM\Software\Policies\Microsoft\Windows\Windows Search\AllowIndexingEncryptedStoresOrItems | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic | REG_DWORD = 0 | |
| AllowDigest | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| DisableRunAs | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\DisableRunAs | REG_DWORD = 1 | |
| NotifyMalicious | HKLM\Software\Policies\Microsoft\Windows\WTDS\Components\NotifyMalicious | REG_DWORD = 1 | |
| NotifyPasswordReuse | HKLM\Software\Policies\Microsoft\Windows\WTDS\Components\NotifyPasswordReuse | REG_DWORD = 1 | |
| NotifyUnsafeApp | HKLM\Software\Policies\Microsoft\Windows\WTDS\Components\NotifyUnsafeApp | REG_DWORD = 1 | |
| ServiceEnabled | HKLM\Software\Policies\Microsoft\Windows\WTDS\Components\ServiceEnabled | REG_DWORD = 1 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| DisableNotifications | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DisableNotifications | REG_DWORD = 1 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall | REG_DWORD = 1 | |
| LogDroppedPackets | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging\LogDroppedPackets | REG_DWORD = 1 | |
| LogFileSize | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging\LogFileSize | REG_DWORD = 16384 | |
| LogSuccessfulConnections | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging\LogSuccessfulConnections | REG_DWORD = 1 | |
| PolicyVersion | HKLM\Software\Policies\Microsoft\WindowsFirewall\PolicyVersion | REG_DWORD = 538 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| DisableNotifications | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DisableNotifications | REG_DWORD = 1 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\EnableFirewall | REG_DWORD = 1 | |
| LogDroppedPackets | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogDroppedPackets | REG_DWORD = 1 | |
| LogFileSize | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogFileSize | REG_DWORD = 16384 | |
| LogSuccessfulConnections | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\LogSuccessfulConnections | REG_DWORD = 1 | |
| AllowLocalIPsecPolicyMerge | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\AllowLocalIPsecPolicyMerge | REG_DWORD = 0 | |
| AllowLocalPolicyMerge | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\AllowLocalPolicyMerge | REG_DWORD = 0 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| DisableNotifications | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DisableNotifications | REG_DWORD = 1 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\EnableFirewall | REG_DWORD = 1 | |
| LogDroppedPackets | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\LogDroppedPackets | REG_DWORD = 1 | |
| LogFileSize | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\LogFileSize | REG_DWORD = 16384 | |
| LogSuccessfulConnections | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\LogSuccessfulConnections | REG_DWORD = 1 | |
| AllowWindowsInkWorkspace | HKLM\Software\Policies\Microsoft\WindowsInkWorkspace\AllowWindowsInkWorkspace | REG_DWORD = 1 | |
| RunAsPPL | HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL | REG_DWORD = 1 | |
| RpcAuthnLevelPrivacyEnabled | HKLM\SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled | REG_DWORD = 1 | |
| DisableExceptionChainValidation | HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation | REG_DWORD = 0 | |
| DriverLoadPolicy | HKLM\SYSTEM\CurrentControlSet\Policies\EarlyLaunch\DriverLoadPolicy | REG_DWORD = 3 | |
| SMB1 | HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 | REG_DWORD = 0 | |
| Start | HKLM\SYSTEM\CurrentControlSet\Services\MrxSmb10\Start | REG_DWORD = 4 | |
| NodeType | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NodeType | REG_DWORD = 2 | |
| NoNameReleaseOnDemand | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand | REG_DWORD = 1 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| EnableICMPRedirect | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect | REG_DWORD = 0 | |
| SeBackupPrivilege | Privilege Rights: SeBackupPrivilege | *S-1-5-32-544 | |
| SeCreateGlobalPrivilege | Privilege Rights: SeCreateGlobalPrivilege | *S-1-5-20,*S-1-5-19,*S-1-5-6,*S-1-5-32-544 | |
| SeCreatePagefilePrivilege | Privilege Rights: SeCreatePagefilePrivilege | *S-1-5-32-544 | |
| SeCreatePermanentPrivilege | Privilege Rights: SeCreatePermanentPrivilege | ||
| SeCreateTokenPrivilege | Privilege Rights: SeCreateTokenPrivilege | ||
| SeDebugPrivilege | Privilege Rights: SeDebugPrivilege | *S-1-5-32-544 | |
| SeDenyNetworkLogonRight | Privilege Rights: SeDenyNetworkLogonRight | *S-1-5-113 | |
| SeDenyRemoteInteractiveLogonRight | Privilege Rights: SeDenyRemoteInteractiveLogonRight | *S-1-5-113 | |
| SeEnableDelegationPrivilege | Privilege Rights: SeEnableDelegationPrivilege | ||
| SeImpersonatePrivilege | Privilege Rights: SeImpersonatePrivilege | *S-1-5-6,*S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229,*S-1-5-20,*S-1-5-19,*S-1-5-32-544 | |
| SeInteractiveLogonRight | Privilege Rights: SeInteractiveLogonRight | *S-1-5-32-545,*S-1-5-32-544 | |
| SeLoadDriverPrivilege | Privilege Rights: SeLoadDriverPrivilege | *S-1-5-32-544 | |
| SeLockMemoryPrivilege | Privilege Rights: SeLockMemoryPrivilege | ||
| SeManageVolumePrivilege | Privilege Rights: SeManageVolumePrivilege | *S-1-5-32-544 | |
| SeNetworkLogonRight | Privilege Rights: SeNetworkLogonRight | *S-1-5-32-555,*S-1-5-32-544 | |
| SeProfileSingleProcessPrivilege | Privilege Rights: SeProfileSingleProcessPrivilege | *S-1-5-32-544 | |
| SeRemoteShutdownPrivilege | Privilege Rights: SeRemoteShutdownPrivilege | *S-1-5-32-544 | |
| SeRestorePrivilege | Privilege Rights: SeRestorePrivilege | *S-1-5-32-544 | |
| SeSecurityPrivilege | Privilege Rights: SeSecurityPrivilege | *S-1-5-32-544 | |
| SeSystemEnvironmentPrivilege | Privilege Rights: SeSystemEnvironmentPrivilege | *S-1-5-32-544 | |
| SeTakeOwnershipPrivilege | Privilege Rights: SeTakeOwnershipPrivilege | *S-1-5-32-544 | |
| SeTcbPrivilege | Privilege Rights: SeTcbPrivilege | ||
| SeTrustedCredManAccessPrivilege | Privilege Rights: SeTrustedCredManAccessPrivilege | ||
| MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | Registry Values: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | 1,"1" | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | 4,2 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorEnhancedAdmin | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorEnhancedAdmin | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | 4,0 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | 4,900 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\TypeOfAdminApprovalMode | 4,2 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | 4,5 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | 4,0 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSAM | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSAM | 1,"O:BAG:BAD:(A;;RC;;;BA)" | |
| MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | Registry Values: MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | 4,0 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | Registry Values: MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange | 4,0 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | 4,1 | |
| "XblAuthManager",4,"" | Service General Setting: "XblAuthManager",4,"" | ||
| "XblGameSave",4,"" | Service General Setting: "XblGameSave",4,"" | ||
| "XboxGipSvc",4,"" | Service General Setting: "XboxGipSvc",4,"" | ||
| "XboxNetApiSvc",4,"" | Service General Setting: "XboxNetApiSvc",4,"" | ||
| LSAAnonymousNameLookup | System Access: LSAAnonymousNameLookup | 0 | |
| ConfigureKernelShadowStacksLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureKernelShadowStacksLaunch | REG_DWORD = 1 | |
| ConfigureSystemGuardLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureSystemGuardLaunch | REG_DWORD = 1 | |
| EnableVirtualizationBasedSecurity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity | REG_DWORD = 1 | |
| HVCIMATRequired | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HVCIMATRequired | REG_DWORD = 1 | |
| HypervisorEnforcedCodeIntegrity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity | REG_DWORD = 1 | |
| LsaCfgFlags | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags | REG_DWORD = 1 | |
| MachineIdentityIsolation | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation | REG_DWORD = 3 | |
| RequirePlatformSecurityFeatures | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures | REG_DWORD = 1 | |
| DisableLocalAdminMerge | HKLM\Software\Policies\Microsoft\Windows Defender\DisableLocalAdminMerge | REG_DWORD = 0 | |
| DisableRoutinelyTakingAction | HKLM\Software\Policies\Microsoft\Windows Defender\DisableRoutinelyTakingAction | REG_DWORD = 0 | |
| PassiveRemediation | HKLM\Software\Policies\Microsoft\Windows Defender\Features\PassiveRemediation | REG_DWORD = 1 | |
| HideExclusionsFromLocalAdmins | HKLM\Software\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins | REG_DWORD = 1 | |
| MpBafsExtendedTimeout | HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout | REG_DWORD = 50 | |
| MpCloudBlockLevel | HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel | REG_DWORD = 2 | |
| EnableConvertWarnToBlock | HKLM\Software\Policies\Microsoft\Windows Defender\NIS\EnableConvertWarnToBlock | REG_DWORD = 1 | |
| PUAProtection | HKLM\Software\Policies\Microsoft\Windows Defender\PUAProtection | REG_DWORD = 1 | |
| DisableBehaviorMonitoring | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring | REG_DWORD = 0 | |
| DisableIOAVProtection | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection | REG_DWORD = 0 | |
| DisableOnAccessProtection | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection | REG_DWORD = 0 | |
| DisableRealtimeMonitoring | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring | REG_DWORD = 0 | |
| DisableScanOnRealtimeEnable | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable | REG_DWORD = 0 | |
| DisableScriptScanning | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning | REG_DWORD = 0 | |
| OobeEnableRtpAndSigUpdate | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\OobeEnableRtpAndSigUpdate | REG_DWORD = 1 | |
| RealtimeScanDirection | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection | REG_DWORD = 0 | |
| EnableDynamicSignatureDroppedEventReporting | HKLM\Software\Policies\Microsoft\Windows Defender\Reporting\EnableDynamicSignatureDroppedEventReporting | REG_DWORD = 1 | |
| DisableRemovableDriveScanning | HKLM\Software\Policies\Microsoft\Windows Defender\Scan\DisableRemovableDriveScanning | REG_DWORD = 0 | |
| QuickScanIncludeExclusions | HKLM\Software\Policies\Microsoft\Windows Defender\Scan\QuickScanIncludeExclusions | REG_DWORD = 1 | |
| DisableBlockAtFirstSeen | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen | REG_DWORD = 0 | |
| SpynetReporting | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\SpynetReporting | REG_DWORD = 2 | |
| SubmitSamplesConsent | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent | REG_DWORD = 3 | |
| ExploitGuard_ASR_Rules | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ExploitGuard_ASR_Rules | REG_DWORD = 1 | |
| 26190899-1602-49e8-8b27-eb1d0a1ce869 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\26190899-1602-49e8-8b27-eb1d0a1ce869 | REG_SZ = 1 |
Showing 400 of 425; narrow with the search or a family.