Microsoft Security Baselines (SCT) 2602
AllInternet Explorer 11 - ComputerInternet Explorer 11 - UserWindows Server 2025 - Defender AntivirusWindows Server 2025 - Domain ControllerWindows Server 2025 - Domain Controller Virtualization Based SecurityWindows Server 2025 - Domain SecurityWindows Server 2025 - Member ServerWindows Server 2025 - Member Server Credential Guard
| Ref | Title | Text | |
|---|---|---|---|
| RunThisTimeEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\RunThisTimeEnabled | REG_DWORD = 0 | |
| VersionCheckEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\VersionCheckEnabled | REG_DWORD = 1 | |
| CheckExeSignatures | HKLM\Software\Policies\Microsoft\Internet Explorer\Download\CheckExeSignatures | REG_SZ = yes | |
| RunInvalidSignatures | HKLM\Software\Policies\Microsoft\Internet Explorer\Download\RunInvalidSignatures | REG_DWORD = 0 | |
| DisableEPMCompat | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableEPMCompat | REG_DWORD = 1 | |
| DisableInternetExplorerLaunchViaCOM | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableInternetExplorerLaunchViaCOM | REG_DWORD = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\iexplore.exe | REG_SZ = 1 | |
| (Reserved) | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\(Reserved) | REG_SZ = 1 | |
| explorer.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\explorer.exe | REG_SZ = 1 | |
| iexplore.exe | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\iexplore.exe | REG_SZ = 1 | |
| Isolation | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\Isolation | REG_SZ = PMEM | |
| Isolation64Bit | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\Isolation64Bit | REG_DWORD = 1 | |
| EnabledV9 | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 | REG_DWORD = 1 | |
| PreventOverride | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverride | REG_DWORD = 1 | |
| PreventOverrideAppRepUnknown | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverrideAppRepUnknown | REG_DWORD = 1 | |
| NoCrashDetection | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoCrashDetection | REG_DWORD = 1 | |
| BlockNonAdminActiveXInstall | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX\BlockNonAdminActiveXInstall | REG_DWORD = 1 | |
| DisableSecuritySettingsCheck | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck | REG_DWORD = 0 | |
| OnlyUseAXISForActiveXInstall | HKLM\Software\Policies\Microsoft\Windows\AxInstaller\OnlyUseAXISForActiveXInstall | REG_DWORD = 1 | |
| CertificateRevocation | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation | REG_DWORD = 1 | |
| EnableSSL3Fallback | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSSL3Fallback | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1C00 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1C00 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1C00 | REG_DWORD = 0 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\2301 | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1C00 | REG_DWORD = 0 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\2301 | REG_DWORD = 0 | |
| PreventIgnoreCertErrors | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\PreventIgnoreCertErrors | REG_DWORD = 1 | |
| SecureProtocols | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols | REG_DWORD = 2560 | |
| Security_HKLM_only | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only | REG_DWORD = 1 | |
| Security_options_edit | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_options_edit | REG_DWORD = 1 | |
| Security_zones_map_edit | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_zones_map_edit | REG_DWORD = 1 | |
| WarnOnBadCertRecving | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving | REG_DWORD = 1 | |
| UNCAsIntranet | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet | REG_DWORD = 0 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1C00 | REG_DWORD = 0 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\270C | REG_DWORD = 0 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201 | REG_DWORD = 3 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1C00 | REG_DWORD = 65536 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\270C | REG_DWORD = 0 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1201 | REG_DWORD = 3 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1C00 | REG_DWORD = 65536 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\270C | REG_DWORD = 0 | |
| 1001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001 | REG_DWORD = 3 | |
| 1004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004 | REG_DWORD = 3 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201 | REG_DWORD = 3 | |
| 1206 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1206 | REG_DWORD = 3 | |
| 1209 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1209 | REG_DWORD = 3 | |
| 120b | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120b | REG_DWORD = 3 | |
| 120c | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120c | REG_DWORD = 3 | |
| 1406 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1406 | REG_DWORD = 3 | |
| 1407 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1407 | REG_DWORD = 3 | |
| 1409 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1409 | REG_DWORD = 0 | |
| 140C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C | REG_DWORD = 3 | |
| 1606 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1606 | REG_DWORD = 3 | |
| 1607 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1607 | REG_DWORD = 3 | |
| 160A | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\160A | REG_DWORD = 3 | |
| 1802 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1802 | REG_DWORD = 3 | |
| 1804 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804 | REG_DWORD = 3 | |
| 1806 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1806 | REG_DWORD = 1 | |
| 1809 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1809 | REG_DWORD = 0 | |
| 1A00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A00 | REG_DWORD = 65536 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1C00 | REG_DWORD = 0 | |
| 2001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2001 | REG_DWORD = 3 | |
| 2004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004 | REG_DWORD = 3 | |
| 2101 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2101 | REG_DWORD = 3 | |
| 2102 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2102 | REG_DWORD = 3 | |
| 2103 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2103 | REG_DWORD = 3 | |
| 2200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2200 | REG_DWORD = 3 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2301 | REG_DWORD = 0 | |
| 2402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2402 | REG_DWORD = 3 | |
| 2500 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 | REG_DWORD = 0 | |
| 2708 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2708 | REG_DWORD = 3 | |
| 2709 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2709 | REG_DWORD = 3 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\270C | REG_DWORD = 0 | |
| 1001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001 | REG_DWORD = 3 | |
| 1004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004 | REG_DWORD = 3 | |
| 1200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 | REG_DWORD = 3 | |
| 1201 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201 | REG_DWORD = 3 | |
| 1206 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1206 | REG_DWORD = 3 | |
| 1209 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1209 | REG_DWORD = 3 | |
| 120b | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120b | REG_DWORD = 3 | |
| 120c | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120c | REG_DWORD = 3 | |
| 1400 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 | REG_DWORD = 3 | |
| 1402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1402 | REG_DWORD = 3 | |
| 1405 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405 | REG_DWORD = 3 | |
| 1406 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1406 | REG_DWORD = 3 | |
| 1407 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1407 | REG_DWORD = 3 | |
| 1409 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1409 | REG_DWORD = 0 | |
| 140C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\140C | REG_DWORD = 3 | |
| 1606 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1606 | REG_DWORD = 3 | |
| 1607 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1607 | REG_DWORD = 3 | |
| 1608 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1608 | REG_DWORD = 3 | |
| 160A | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\160A | REG_DWORD = 3 | |
| 1802 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1802 | REG_DWORD = 3 | |
| 1803 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1803 | REG_DWORD = 3 | |
| 1804 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804 | REG_DWORD = 3 | |
| 1806 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806 | REG_DWORD = 3 | |
| 1809 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1809 | REG_DWORD = 0 | |
| 1A00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A00 | REG_DWORD = 196608 | |
| 1C00 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1C00 | REG_DWORD = 0 | |
| 2000 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2000 | REG_DWORD = 3 | |
| 2001 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2001 | REG_DWORD = 3 | |
| 2004 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2004 | REG_DWORD = 3 | |
| 2101 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2101 | REG_DWORD = 3 | |
| 2102 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2102 | REG_DWORD = 3 | |
| 2103 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2103 | REG_DWORD = 3 | |
| 2200 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2200 | REG_DWORD = 3 | |
| 2301 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2301 | REG_DWORD = 0 | |
| 2402 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2402 | REG_DWORD = 3 | |
| 2500 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 | REG_DWORD = 0 | |
| 2708 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2708 | REG_DWORD = 3 | |
| 2709 | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2709 | REG_DWORD = 3 | |
| 270C | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\270C | REG_DWORD = 0 | |
| FormSuggest Passwords | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\FormSuggest Passwords | REG_DWORD = 1 | |
| FormSuggest Passwords | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FormSuggest Passwords | REG_SZ = no | |
| FormSuggest PW Ask | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FormSuggest PW Ask | REG_SZ = no | |
| EngineRing | HKLM\Software\Policies\Microsoft\Windows Defender\EngineRing | REG_DWORD = 5 | |
| HideExclusionsFromLocalAdmins | HKLM\Software\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins | REG_DWORD = 1 | |
| MpCloudBlockLevel | HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel | REG_DWORD = 2 | |
| PlatformRing | HKLM\Software\Policies\Microsoft\Windows Defender\PlatformRing | REG_DWORD = 5 | |
| PUAProtection | HKLM\Software\Policies\Microsoft\Windows Defender\PUAProtection | REG_DWORD = 1 | |
| DisableBehaviorMonitoring | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring | REG_DWORD = 0 | |
| DisableIOAVProtection | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection | REG_DWORD = 0 | |
| DisableRealtimeMonitoring | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring | REG_DWORD = 0 | |
| DisableScriptScanning | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning | REG_DWORD = 0 | |
| OobeEnableRtpAndSigUpdate | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\OobeEnableRtpAndSigUpdate | REG_DWORD = 1 | |
| EnableDynamicSignatureDroppedEventReporting | HKLM\Software\Policies\Microsoft\Windows Defender\Reporting\EnableDynamicSignatureDroppedEventReporting | REG_DWORD = 1 | |
| DisableRemovableDriveScanning | HKLM\Software\Policies\Microsoft\Windows Defender\Scan\DisableRemovableDriveScanning | REG_DWORD = 0 | |
| QuickScanIncludeExclusions | HKLM\Software\Policies\Microsoft\Windows Defender\Scan\QuickScanIncludeExclusions | REG_DWORD = 1 | |
| SignaturesRing | HKLM\Software\Policies\Microsoft\Windows Defender\SignaturesRing | REG_DWORD = 5 | |
| DisableBlockAtFirstSeen | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen | REG_DWORD = 0 | |
| SpynetReporting | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\SpynetReporting | REG_DWORD = 2 | |
| SubmitSamplesConsent | HKLM\Software\Policies\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent | REG_DWORD = 1 | |
| ExploitGuard_ASR_Rules | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ExploitGuard_ASR_Rules | REG_DWORD = 1 | |
| 56a863a9-875e-4185-98a7-b882c64b5ce5 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\56a863a9-875e-4185-98a7-b882c64b5ce5 | REG_SZ = 1 | |
| 5beb7efe-fd9a-4556-801d-275e5ffc04cc | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\5beb7efe-fd9a-4556-801d-275e5ffc04cc | REG_SZ = 1 | |
| 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | REG_SZ = 1 | |
| a8f5898e-1dc8-49a9-9878-85004b8a61e6 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\a8f5898e-1dc8-49a9-9878-85004b8a61e6 | REG_SZ = 1 | |
| b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | REG_SZ = 1 | |
| c1db55ab-c21a-4637-bb3f-a12568109d35 | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\c1db55ab-c21a-4637-bb3f-a12568109d35 | REG_SZ = 1 | |
| d3e037e1-3eb8-44c8-a917-57927947596d | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\d3e037e1-3eb8-44c8-a917-57927947596d | REG_SZ = 1 | |
| e6db77e5-3df2-4cf1-b95a-636979351e5b | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\e6db77e5-3df2-4cf1-b95a-636979351e5b | REG_SZ = 1 | |
| AllowNetworkProtectionOnWinServer | HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection\AllowNetworkProtectionOnWinServer | REG_DWORD = 1 | |
| ConfigureKernelShadowStacksLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureKernelShadowStacksLaunch | REG_DWORD = 0 | |
| ConfigureSystemGuardLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureSystemGuardLaunch | REG_DWORD = 1 | |
| EnableVirtualizationBasedSecurity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity | REG_DWORD = 1 | |
| HVCIMATRequired | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HVCIMATRequired | REG_DWORD = 1 | |
| HypervisorEnforcedCodeIntegrity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity | REG_DWORD = 1 | |
| LsaCfgFlags | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags | REG_DWORD = 0 | |
| MachineIdentityIsolation | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation | REG_DWORD = 3 | |
| RequirePlatformSecurityFeatures | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures | REG_DWORD = 1 | |
| Audit Security State Change | Audit policy: Audit Security State Change | Success | |
| Audit Security System Extension | Audit policy: Audit Security System Extension | Success | |
| Audit System Integrity | Audit policy: Audit System Integrity | Success and Failure | |
| Audit Other System Events | Audit policy: Audit Other System Events | Success and Failure | |
| Audit Logon | Audit policy: Audit Logon | Success and Failure | |
| Audit Account Lockout | Audit policy: Audit Account Lockout | Failure | |
| Audit Special Logon | Audit policy: Audit Special Logon | Success | |
| Audit Other Logon/Logoff Events | Audit policy: Audit Other Logon/Logoff Events | Success and Failure | |
| Audit File Share | Audit policy: Audit File Share | Success and Failure | |
| Audit Other Object Access Events | Audit policy: Audit Other Object Access Events | Success and Failure | |
| Audit Sensitive Privilege Use | Audit policy: Audit Sensitive Privilege Use | Success and Failure | |
| Audit Process Creation | Audit policy: Audit Process Creation | Success | |
| Audit Audit Policy Change | Audit policy: Audit Audit Policy Change | Success and Failure | |
| Audit Authentication Policy Change | Audit policy: Audit Authentication Policy Change | Success | |
| Audit Authorization Policy Change | Audit policy: Audit Authorization Policy Change | Success | |
| Audit MPSSVC Rule-Level Policy Change | Audit policy: Audit MPSSVC Rule-Level Policy Change | Success and Failure | |
| Audit Other Policy Change Events | Audit policy: Audit Other Policy Change Events | Failure | |
| Audit User Account Management | Audit policy: Audit User Account Management | Success and Failure | |
| Audit Computer Account Management | Audit policy: Audit Computer Account Management | Success | |
| Audit Security Group Management | Audit policy: Audit Security Group Management | Success | |
| Audit Other Account Management Events | Audit policy: Audit Other Account Management Events | Success | |
| Audit Directory Service Access | Audit policy: Audit Directory Service Access | Failure | |
| Audit Directory Service Changes | Audit policy: Audit Directory Service Changes | Success | |
| Audit Credential Validation | Audit policy: Audit Credential Validation | Success and Failure | |
| Audit Kerberos Service Ticket Operations | Audit policy: Audit Kerberos Service Ticket Operations | Failure | |
| Audit Kerberos Authentication Service | Audit policy: Audit Kerberos Authentication Service | Success and Failure | |
| Audit Detailed File Share | Audit policy: Audit Detailed File Share | Failure | |
| Audit Removable Storage | Audit policy: Audit Removable Storage | Success and Failure | |
| Audit PNP Activity | Audit policy: Audit PNP Activity | Success | |
| Audit Group Membership | Audit policy: Audit Group Membership | Success | |
| NoAutorun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoAutorun | REG_DWORD = 1 | |
| NoDriveTypeAutoRun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun | REG_DWORD = 255 | |
| ProcessCreationIncludeCmdLine_Enabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled | REG_DWORD = 1 | |
| AllowEncryptionOracle | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\AllowEncryptionOracle | REG_DWORD = 0 | |
| DisableAutomaticRestartSignOn | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn | REG_DWORD = 1 | |
| PKINITHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKINITSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1 | REG_DWORD = 1 | |
| PKINITSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256 | REG_DWORD = 3 | |
| PKINITSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384 | REG_DWORD = 3 | |
| PKINITSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512 | REG_DWORD = 3 | |
| PKInitHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKInitSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1 | REG_DWORD = 1 | |
| PKInitSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256 | REG_DWORD = 3 | |
| PKInitSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384 | REG_DWORD = 3 | |
| PKInitSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512 | REG_DWORD = 3 | |
| SamNGCKeyROCAValidation | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM\SamNGCKeyROCAValidation | REG_DWORD = 2 | |
| EnhancedAntiSpoofing | HKLM\Software\Policies\Microsoft\Biometrics\FacialFeatures\EnhancedAntiSpoofing | REG_DWORD = 1 | |
| DisableInternetExplorerLaunchViaCOM | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableInternetExplorerLaunchViaCOM | REG_DWORD = 1 | |
| EnableMulticast | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast | REG_DWORD = 0 | |
| EnableNetbios | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableNetbios | REG_DWORD = 0 | |
| RestrictDriverInstallationToAdministrators | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators | REG_DWORD = 1 | |
| ForceKerberosForRpc | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\ForceKerberosForRpc | REG_DWORD = 0 | |
| RpcAuthentication | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcAuthentication | REG_DWORD = 1 | |
| RpcProtocols | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcProtocols | REG_DWORD = 5 | |
| RpcUseNamedPipeProtocol | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcUseNamedPipeProtocol | REG_DWORD = 0 | |
| DisablePasswordSaving | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\DisablePasswordSaving | REG_DWORD = 1 | |
| fDisableCdm | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fDisableCdm | REG_DWORD = 1 | |
| fEncryptRPCTraffic | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fEncryptRPCTraffic | REG_DWORD = 1 | |
| fPromptForPassword | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fPromptForPassword | REG_DWORD = 1 | |
| MinEncryptionLevel | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\MinEncryptionLevel | REG_DWORD = 3 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\Bowser\EnableMailslots | REG_DWORD = 0 | |
| AllowProtectedCreds | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowProtectedCreds | REG_DWORD = 1 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application\MaxSize | REG_DWORD = 32768 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security\MaxSize | REG_DWORD = 196608 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\System\MaxSize | REG_DWORD = 32768 | |
| DisableMotWOnInsecurePathCopy | HKLM\Software\Policies\Microsoft\Windows\Explorer\DisableMotWOnInsecurePathCopy | REG_DWORD = 0 | |
| NoAutoplayfornonVolume | HKLM\Software\Policies\Microsoft\Windows\Explorer\NoAutoplayfornonVolume | REG_DWORD = 1 | |
| NoBackgroundPolicy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoBackgroundPolicy | REG_DWORD = 0 | |
| NoGPOListChanges | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoGPOListChanges | REG_DWORD = 0 | |
| AlwaysInstallElevated | HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated | REG_DWORD = 0 | |
| EnableUserControl | HKLM\Software\Policies\Microsoft\Windows\Installer\EnableUserControl | REG_DWORD = 0 | |
| DeviceEnumerationPolicy | HKLM\Software\Policies\Microsoft\Windows\Kernel DMA Protection\DeviceEnumerationPolicy | REG_DWORD = 0 | |
| AuditClientDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditClientDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning | REG_DWORD = 1 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| EnableAuthRateLimiter | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter | REG_DWORD = 1 | |
| InvalidAuthenticationDelayTimeInMs | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs | REG_DWORD = 2000 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\MinSmb2Dialect | REG_DWORD = 768 | |
| AllowInsecureGuestAuth | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AllowInsecureGuestAuth | REG_DWORD = 0 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| AuditServerDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditServerDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning | REG_DWORD = 1 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\MinSmb2Dialect | REG_DWORD = 768 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\EnableMailslots | REG_DWORD = 0 | |
| \\*\NETLOGON | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\NETLOGON | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| \\*\SYSVOL | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\SYSVOL | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| NoLockScreenCamera | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenCamera | REG_DWORD = 1 | |
| NoLockScreenSlideshow | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenSlideshow | REG_DWORD = 1 | |
| **del.EnableScriptBlockInvocationLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\**del.EnableScriptBlockInvocationLogging | REG_SZ = | |
| EnableScriptBlockLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging | REG_DWORD = 1 | |
| Software\Policies\Microsoft\Windows\Safer | HKLM\Software\Policies\Microsoft\Windows\Safer\ | REG_NONE = | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\a9e18c21-ff8f-43cf-b9fc-db40eed693ba\Value | REG_SZ = <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="(Default Rule) All signed packaged apps" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="A | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\AllowWindows | REG_DWORD = 0 | |
| EnforcementMode | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\EnforcementMode | REG_DWORD = 1 | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Dll\AllowWindows | REG_DWORD = 0 | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\61bd6501-5227-446f-b233-faffc7620c58\Value | REG_SZ = <FilePublisherRule Id="61bd6501-5227-446f-b233-faffc7620c58" Name="Block Google Chrome" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CALIF | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\61cc3c42-eee8-438a-8c78-a80da093d621\Value | REG_SZ = <FilePublisherRule Id="61cc3c42-eee8-438a-8c78-a80da093d621" Name="Block Microsoft Edge" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\6676be6c-419b-41a8-8943-39715b98f77a\Value | REG_SZ = <FilePublisherRule Id="6676be6c-419b-41a8-8943-39715b98f77a" Name="Block Mozilla Firefox" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MOZILLA CORPORATION, L=MOUNTAIN VI | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\881d54fe-3848-4d6a-95fd-42d48ebe60b8\Value | REG_SZ = <FilePublisherRule Id="881d54fe-3848-4d6a-95fd-42d48ebe60b8" Name="Block Microsoft Internet Explorer" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\921cc481-6e17-4653-8f75-050b80acca20\Value | REG_SZ = <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\a61c8b2c-a319-4cd0-9690-d2177cad7b51\Value | REG_SZ = <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." Us | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\AllowWindows | REG_DWORD = 0 | |
| EnforcementMode | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\EnforcementMode | REG_DWORD = 1 | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\fd686d83-a829-4351-8ff4-27c7de5755d2\Value | REG_SZ = <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"><Condition | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Msi\AllowWindows | REG_DWORD = 0 | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Script\AllowWindows | REG_DWORD = 0 | |
| Enabled | HKLM\Software\Policies\Microsoft\Windows\Sudo\Enabled | REG_DWORD = 0 | |
| AllowCustomSSPsAPs | HKLM\Software\Policies\Microsoft\Windows\System\AllowCustomSSPsAPs | REG_DWORD = 0 | |
| EnableSmartScreen | HKLM\Software\Policies\Microsoft\Windows\System\EnableSmartScreen | REG_DWORD = 1 | |
| RunAsPPL | HKLM\Software\Policies\Microsoft\Windows\System\RunAsPPL | REG_DWORD = 1 | |
| ShellSmartScreenLevel | HKLM\Software\Policies\Microsoft\Windows\System\ShellSmartScreenLevel | REG_SZ = Block | |
| AllowIndexingEncryptedStoresOrItems | HKLM\Software\Policies\Microsoft\Windows\Windows Search\AllowIndexingEncryptedStoresOrItems | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic | REG_DWORD = 0 | |
| AllowDigest | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| DisableRunAs | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\DisableRunAs | REG_DWORD = 1 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging\ | REG_NONE = | |
| PolicyVersion | HKLM\Software\Policies\Microsoft\WindowsFirewall\PolicyVersion | REG_DWORD = 545 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\ | REG_NONE = | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\ | REG_NONE = | |
| DisableExceptionChainValidation | HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation | REG_DWORD = 0 | |
| DriverLoadPolicy | HKLM\SYSTEM\CurrentControlSet\Policies\EarlyLaunch\DriverLoadPolicy | REG_DWORD = 3 | |
| SMB1 | HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 | REG_DWORD = 0 | |
| Start | HKLM\SYSTEM\CurrentControlSet\Services\MrxSmb10\Start | REG_DWORD = 4 | |
| NodeType | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NodeType | REG_DWORD = 2 | |
| NoNameReleaseOnDemand | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand | REG_DWORD = 1 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| EnableICMPRedirect | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect | REG_DWORD = 0 | |
| SeBackupPrivilege | Privilege Rights: SeBackupPrivilege | *S-1-5-32-544 | |
| SeCreateGlobalPrivilege | Privilege Rights: SeCreateGlobalPrivilege | *S-1-5-20,*S-1-5-19,*S-1-5-6,*S-1-5-32-544 | |
| SeCreatePagefilePrivilege | Privilege Rights: SeCreatePagefilePrivilege | *S-1-5-32-544 | |
| SeCreatePermanentPrivilege | Privilege Rights: SeCreatePermanentPrivilege | ||
| SeCreateTokenPrivilege | Privilege Rights: SeCreateTokenPrivilege | ||
| SeDebugPrivilege | Privilege Rights: SeDebugPrivilege | *S-1-5-32-544 | |
| SeDenyRemoteInteractiveLogonRight | Privilege Rights: SeDenyRemoteInteractiveLogonRight | *S-1-5-32-546 | |
| SeEnableDelegationPrivilege | Privilege Rights: SeEnableDelegationPrivilege | *S-1-5-32-544 | |
| SeImpersonatePrivilege | Privilege Rights: SeImpersonatePrivilege | *S-1-5-6,*S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229,*S-1-5-20,*S-1-5-19,*S-1-5-32-544 | |
| SeInteractiveLogonRight | Privilege Rights: SeInteractiveLogonRight | *S-1-5-9,*S-1-5-32-544 | |
| SeLoadDriverPrivilege | Privilege Rights: SeLoadDriverPrivilege | *S-1-5-32-544 | |
| SeLockMemoryPrivilege | Privilege Rights: SeLockMemoryPrivilege | ||
| SeManageVolumePrivilege | Privilege Rights: SeManageVolumePrivilege | *S-1-5-32-544 | |
| SeNetworkLogonRight | Privilege Rights: SeNetworkLogonRight | *S-1-5-9,*S-1-5-11,*S-1-5-32-544 | |
| SeProfileSingleProcessPrivilege | Privilege Rights: SeProfileSingleProcessPrivilege | *S-1-5-32-544 | |
| SeRemoteInteractiveLogonRight | Privilege Rights: SeRemoteInteractiveLogonRight | *S-1-5-32-544 | |
| SeRemoteShutdownPrivilege | Privilege Rights: SeRemoteShutdownPrivilege | *S-1-5-32-544 | |
| SeRestorePrivilege | Privilege Rights: SeRestorePrivilege | *S-1-5-32-544 | |
| SeSystemEnvironmentPrivilege | Privilege Rights: SeSystemEnvironmentPrivilege | *S-1-5-32-544 | |
| SeTakeOwnershipPrivilege | Privilege Rights: SeTakeOwnershipPrivilege | *S-1-5-32-544 | |
| SeTcbPrivilege | Privilege Rights: SeTcbPrivilege | ||
| SeTrustedCredManAccessPrivilege | Privilege Rights: SeTrustedCredManAccessPrivilege | ||
| MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | Registry Values: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | 1,"1" | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | 4,2 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | 4,0 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | 4,900 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | 4,5 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | 4,0 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic | 4,2 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | Registry Values: MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | 4,0 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | Registry Values: MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain | 4,7 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding | Registry Values: MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding | 4,2 | |
| MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity | Registry Values: MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity | 4,1 | |
| "AppIDSvc",2,"" | Service General Setting: "AppIDSvc",2,"" | ||
| LSAAnonymousNameLookup | System Access: LSAAnonymousNameLookup | 0 | |
| AllowAdministratorLockout | System Access: AllowAdministratorLockout | 1 | |
| ClearTextPassword | System Access: ClearTextPassword | 0 | |
| LockoutBadCount | System Access: LockoutBadCount | 3 | |
| LockoutDuration | System Access: LockoutDuration | 15 | |
| MinimumPasswordLength | System Access: MinimumPasswordLength | 14 | |
| PasswordComplexity | System Access: PasswordComplexity | 1 | |
| PasswordHistorySize | System Access: PasswordHistorySize | 24 | |
| ResetLockoutCount | System Access: ResetLockoutCount | 15 | |
| ConfigureKernelShadowStacksLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureKernelShadowStacksLaunch | REG_DWORD = 0 | |
| ConfigureSystemGuardLaunch | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureSystemGuardLaunch | REG_DWORD = 1 | |
| EnableVirtualizationBasedSecurity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity | REG_DWORD = 1 | |
| HVCIMATRequired | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HVCIMATRequired | REG_DWORD = 1 | |
| HypervisorEnforcedCodeIntegrity | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity | REG_DWORD = 1 | |
| LsaCfgFlags | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags | REG_DWORD = 1 | |
| MachineIdentityIsolation | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation | REG_DWORD = 3 | |
| RequirePlatformSecurityFeatures | HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures | REG_DWORD = 1 | |
| Audit Security State Change | Audit policy: Audit Security State Change | Success | |
| Audit Security System Extension | Audit policy: Audit Security System Extension | Success | |
| Audit System Integrity | Audit policy: Audit System Integrity | Success and Failure | |
| Audit Other System Events | Audit policy: Audit Other System Events | Success and Failure | |
| Audit Logon | Audit policy: Audit Logon | Success and Failure | |
| Audit Account Lockout | Audit policy: Audit Account Lockout | Failure | |
| Audit Special Logon | Audit policy: Audit Special Logon | Success | |
| Audit Other Logon/Logoff Events | Audit policy: Audit Other Logon/Logoff Events | Success and Failure | |
| Audit File Share | Audit policy: Audit File Share | Success and Failure | |
| Audit Other Object Access Events | Audit policy: Audit Other Object Access Events | Success and Failure | |
| Audit Sensitive Privilege Use | Audit policy: Audit Sensitive Privilege Use | Success and Failure | |
| Audit Process Creation | Audit policy: Audit Process Creation | Success | |
| Audit Audit Policy Change | Audit policy: Audit Audit Policy Change | Success and Failure | |
| Audit Authentication Policy Change | Audit policy: Audit Authentication Policy Change | Success | |
| Audit Authorization Policy Change | Audit policy: Audit Authorization Policy Change | Success | |
| Audit MPSSVC Rule-Level Policy Change | Audit policy: Audit MPSSVC Rule-Level Policy Change | Success and Failure | |
| Audit Other Policy Change Events | Audit policy: Audit Other Policy Change Events | Failure |
Showing 400 of 564; narrow with the search or a family.