Microsoft Security Baselines (SCT) 2602
AllInternet Explorer 11 - ComputerInternet Explorer 11 - UserWindows Server 2025 - Defender AntivirusWindows Server 2025 - Domain ControllerWindows Server 2025 - Domain Controller Virtualization Based SecurityWindows Server 2025 - Domain SecurityWindows Server 2025 - Member ServerWindows Server 2025 - Member Server Credential Guard
| Ref | Title | Text | |
|---|---|---|---|
| Audit Security State Change | Audit policy: Audit Security State Change | Success | |
| Audit Security System Extension | Audit policy: Audit Security System Extension | Success | |
| Audit System Integrity | Audit policy: Audit System Integrity | Success and Failure | |
| Audit Other System Events | Audit policy: Audit Other System Events | Success and Failure | |
| Audit Logon | Audit policy: Audit Logon | Success and Failure | |
| Audit Account Lockout | Audit policy: Audit Account Lockout | Failure | |
| Audit Special Logon | Audit policy: Audit Special Logon | Success | |
| Audit Other Logon/Logoff Events | Audit policy: Audit Other Logon/Logoff Events | Success and Failure | |
| Audit File Share | Audit policy: Audit File Share | Success and Failure | |
| Audit Other Object Access Events | Audit policy: Audit Other Object Access Events | Success and Failure | |
| Audit Sensitive Privilege Use | Audit policy: Audit Sensitive Privilege Use | Success and Failure | |
| Audit Process Creation | Audit policy: Audit Process Creation | Success | |
| Audit Audit Policy Change | Audit policy: Audit Audit Policy Change | Success and Failure | |
| Audit Authentication Policy Change | Audit policy: Audit Authentication Policy Change | Success | |
| Audit Authorization Policy Change | Audit policy: Audit Authorization Policy Change | Success | |
| Audit MPSSVC Rule-Level Policy Change | Audit policy: Audit MPSSVC Rule-Level Policy Change | Success and Failure | |
| Audit Other Policy Change Events | Audit policy: Audit Other Policy Change Events | Failure | |
| Audit User Account Management | Audit policy: Audit User Account Management | Success and Failure | |
| Audit Computer Account Management | Audit policy: Audit Computer Account Management | Success | |
| Audit Security Group Management | Audit policy: Audit Security Group Management | Success | |
| Audit Other Account Management Events | Audit policy: Audit Other Account Management Events | Success | |
| Audit Directory Service Access | Audit policy: Audit Directory Service Access | Failure | |
| Audit Directory Service Changes | Audit policy: Audit Directory Service Changes | Success | |
| Audit Credential Validation | Audit policy: Audit Credential Validation | Success and Failure | |
| Audit Kerberos Service Ticket Operations | Audit policy: Audit Kerberos Service Ticket Operations | Failure | |
| Audit Kerberos Authentication Service | Audit policy: Audit Kerberos Authentication Service | Success and Failure | |
| Audit Detailed File Share | Audit policy: Audit Detailed File Share | Failure | |
| Audit Removable Storage | Audit policy: Audit Removable Storage | Success and Failure | |
| Audit PNP Activity | Audit policy: Audit PNP Activity | Success | |
| Audit Group Membership | Audit policy: Audit Group Membership | Success | |
| NoAutorun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoAutorun | REG_DWORD = 1 | |
| NoDriveTypeAutoRun | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun | REG_DWORD = 255 | |
| ProcessCreationIncludeCmdLine_Enabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled | REG_DWORD = 1 | |
| AllowEncryptionOracle | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\AllowEncryptionOracle | REG_DWORD = 0 | |
| DisableAutomaticRestartSignOn | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAutomaticRestartSignOn | REG_DWORD = 1 | |
| PKINITHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKINITSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1 | REG_DWORD = 1 | |
| PKINITSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256 | REG_DWORD = 3 | |
| PKINITSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384 | REG_DWORD = 3 | |
| PKINITSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512 | REG_DWORD = 3 | |
| PKInitHashAlgorithmConfigurationEnabled | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabled | REG_DWORD = 1 | |
| PKInitSHA1 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1 | REG_DWORD = 1 | |
| PKInitSHA256 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256 | REG_DWORD = 3 | |
| PKInitSHA384 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384 | REG_DWORD = 3 | |
| PKInitSHA512 | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512 | REG_DWORD = 3 | |
| SamNGCKeyROCAValidation | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM\SamNGCKeyROCAValidation | REG_DWORD = 2 | |
| EnhancedAntiSpoofing | HKLM\Software\Policies\Microsoft\Biometrics\FacialFeatures\EnhancedAntiSpoofing | REG_DWORD = 1 | |
| DisableInternetExplorerLaunchViaCOM | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableInternetExplorerLaunchViaCOM | REG_DWORD = 1 | |
| EnableMulticast | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast | REG_DWORD = 0 | |
| EnableNetbios | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableNetbios | REG_DWORD = 0 | |
| RestrictDriverInstallationToAdministrators | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators | REG_DWORD = 1 | |
| ForceKerberosForRpc | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\ForceKerberosForRpc | REG_DWORD = 0 | |
| RpcAuthentication | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcAuthentication | REG_DWORD = 1 | |
| RpcProtocols | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcProtocols | REG_DWORD = 5 | |
| RpcUseNamedPipeProtocol | HKLM\Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcUseNamedPipeProtocol | REG_DWORD = 0 | |
| DisablePasswordSaving | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\DisablePasswordSaving | REG_DWORD = 1 | |
| fDisableCdm | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fDisableCdm | REG_DWORD = 1 | |
| fEncryptRPCTraffic | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fEncryptRPCTraffic | REG_DWORD = 1 | |
| fPromptForPassword | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\fPromptForPassword | REG_DWORD = 1 | |
| MinEncryptionLevel | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\MinEncryptionLevel | REG_DWORD = 3 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\Bowser\EnableMailslots | REG_DWORD = 0 | |
| AllowProtectedCreds | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowProtectedCreds | REG_DWORD = 1 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application\MaxSize | REG_DWORD = 32768 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security\MaxSize | REG_DWORD = 196608 | |
| MaxSize | HKLM\Software\Policies\Microsoft\Windows\EventLog\System\MaxSize | REG_DWORD = 32768 | |
| DisableMotWOnInsecurePathCopy | HKLM\Software\Policies\Microsoft\Windows\Explorer\DisableMotWOnInsecurePathCopy | REG_DWORD = 0 | |
| NoAutoplayfornonVolume | HKLM\Software\Policies\Microsoft\Windows\Explorer\NoAutoplayfornonVolume | REG_DWORD = 1 | |
| NoBackgroundPolicy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoBackgroundPolicy | REG_DWORD = 0 | |
| NoGPOListChanges | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoGPOListChanges | REG_DWORD = 0 | |
| AlwaysInstallElevated | HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated | REG_DWORD = 0 | |
| EnableUserControl | HKLM\Software\Policies\Microsoft\Windows\Installer\EnableUserControl | REG_DWORD = 0 | |
| DeviceEnumerationPolicy | HKLM\Software\Policies\Microsoft\Windows\Kernel DMA Protection\DeviceEnumerationPolicy | REG_DWORD = 0 | |
| AuditClientDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditClientDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning | REG_DWORD = 1 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| EnableAuthRateLimiter | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter | REG_DWORD = 1 | |
| InvalidAuthenticationDelayTimeInMs | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs | REG_DWORD = 2000 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanServer\MinSmb2Dialect | REG_DWORD = 768 | |
| AllowInsecureGuestAuth | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AllowInsecureGuestAuth | REG_DWORD = 0 | |
| AuditInsecureGuestLogon | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon | REG_DWORD = 1 | |
| AuditServerDoesNotSupportEncryption | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption | REG_DWORD = 1 | |
| AuditServerDoesNotSupportSigning | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning | REG_DWORD = 1 | |
| MinSmb2Dialect | HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\MinSmb2Dialect | REG_DWORD = 768 | |
| EnableMailslots | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\EnableMailslots | REG_DWORD = 0 | |
| \\*\NETLOGON | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\NETLOGON | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| \\*\SYSVOL | HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\\\*\SYSVOL | REG_SZ = RequireMutualAuthentication=1,RequireIntegrity=1 | |
| NoLockScreenCamera | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenCamera | REG_DWORD = 1 | |
| NoLockScreenSlideshow | HKLM\Software\Policies\Microsoft\Windows\Personalization\NoLockScreenSlideshow | REG_DWORD = 1 | |
| **del.EnableScriptBlockInvocationLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\**del.EnableScriptBlockInvocationLogging | REG_SZ = | |
| EnableScriptBlockLogging | HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging | REG_DWORD = 1 | |
| Software\Policies\Microsoft\Windows\Safer | HKLM\Software\Policies\Microsoft\Windows\Safer\ | REG_NONE = | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\a9e18c21-ff8f-43cf-b9fc-db40eed693ba\Value | REG_SZ = <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="(Default Rule) All signed packaged apps" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="A | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\AllowWindows | REG_DWORD = 0 | |
| EnforcementMode | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx\EnforcementMode | REG_DWORD = 1 | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Dll\AllowWindows | REG_DWORD = 0 | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\61bd6501-5227-446f-b233-faffc7620c58\Value | REG_SZ = <FilePublisherRule Id="61bd6501-5227-446f-b233-faffc7620c58" Name="Block Google Chrome" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CALIF | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\61cc3c42-eee8-438a-8c78-a80da093d621\Value | REG_SZ = <FilePublisherRule Id="61cc3c42-eee8-438a-8c78-a80da093d621" Name="Block Microsoft Edge" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\6676be6c-419b-41a8-8943-39715b98f77a\Value | REG_SZ = <FilePublisherRule Id="6676be6c-419b-41a8-8943-39715b98f77a" Name="Block Mozilla Firefox" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MOZILLA CORPORATION, L=MOUNTAIN VI | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\881d54fe-3848-4d6a-95fd-42d48ebe60b8\Value | REG_SZ = <FilePublisherRule Id="881d54fe-3848-4d6a-95fd-42d48ebe60b8" Name="Block Microsoft Internet Explorer" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"><Conditions><FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\921cc481-6e17-4653-8f75-050b80acca20\Value | REG_SZ = <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\a61c8b2c-a319-4cd0-9690-d2177cad7b51\Value | REG_SZ = <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." Us | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\AllowWindows | REG_DWORD = 0 | |
| EnforcementMode | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\EnforcementMode | REG_DWORD = 1 | |
| Value | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe\fd686d83-a829-4351-8ff4-27c7de5755d2\Value | REG_SZ = <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"><Condition | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Msi\AllowWindows | REG_DWORD = 0 | |
| AllowWindows | HKLM\Software\Policies\Microsoft\Windows\SrpV2\Script\AllowWindows | REG_DWORD = 0 | |
| Enabled | HKLM\Software\Policies\Microsoft\Windows\Sudo\Enabled | REG_DWORD = 0 | |
| AllowCustomSSPsAPs | HKLM\Software\Policies\Microsoft\Windows\System\AllowCustomSSPsAPs | REG_DWORD = 0 | |
| EnableSmartScreen | HKLM\Software\Policies\Microsoft\Windows\System\EnableSmartScreen | REG_DWORD = 1 | |
| RunAsPPL | HKLM\Software\Policies\Microsoft\Windows\System\RunAsPPL | REG_DWORD = 1 | |
| ShellSmartScreenLevel | HKLM\Software\Policies\Microsoft\Windows\System\ShellSmartScreenLevel | REG_SZ = Block | |
| AllowIndexingEncryptedStoresOrItems | HKLM\Software\Policies\Microsoft\Windows\Windows Search\AllowIndexingEncryptedStoresOrItems | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic | REG_DWORD = 0 | |
| AllowDigest | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| AllowBasic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic | REG_DWORD = 0 | |
| AllowUnencryptedTraffic | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic | REG_DWORD = 0 | |
| DisableRunAs | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\DisableRunAs | REG_DWORD = 1 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging\ | REG_NONE = | |
| PolicyVersion | HKLM\Software\Policies\Microsoft\WindowsFirewall\PolicyVersion | REG_DWORD = 545 | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging\ | REG_NONE = | |
| DefaultInboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultInboundAction | REG_DWORD = 1 | |
| DefaultOutboundAction | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\DefaultOutboundAction | REG_DWORD = 0 | |
| EnableFirewall | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\EnableFirewall | REG_DWORD = 1 | |
| Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging | HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging\ | REG_NONE = | |
| DisableExceptionChainValidation | HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation | REG_DWORD = 0 | |
| DriverLoadPolicy | HKLM\SYSTEM\CurrentControlSet\Policies\EarlyLaunch\DriverLoadPolicy | REG_DWORD = 3 | |
| SMB1 | HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 | REG_DWORD = 0 | |
| Start | HKLM\SYSTEM\CurrentControlSet\Services\MrxSmb10\Start | REG_DWORD = 4 | |
| NodeType | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NodeType | REG_DWORD = 2 | |
| NoNameReleaseOnDemand | HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand | REG_DWORD = 1 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| DisableIPSourceRouting | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting | REG_DWORD = 2 | |
| EnableICMPRedirect | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect | REG_DWORD = 0 | |
| SeBackupPrivilege | Privilege Rights: SeBackupPrivilege | *S-1-5-32-544 | |
| SeCreateGlobalPrivilege | Privilege Rights: SeCreateGlobalPrivilege | *S-1-5-20,*S-1-5-19,*S-1-5-6,*S-1-5-32-544 | |
| SeCreatePagefilePrivilege | Privilege Rights: SeCreatePagefilePrivilege | *S-1-5-32-544 | |
| SeCreatePermanentPrivilege | Privilege Rights: SeCreatePermanentPrivilege | ||
| SeCreateTokenPrivilege | Privilege Rights: SeCreateTokenPrivilege | ||
| SeDebugPrivilege | Privilege Rights: SeDebugPrivilege | *S-1-5-32-544 | |
| SeDenyRemoteInteractiveLogonRight | Privilege Rights: SeDenyRemoteInteractiveLogonRight | *S-1-5-32-546 | |
| SeEnableDelegationPrivilege | Privilege Rights: SeEnableDelegationPrivilege | *S-1-5-32-544 | |
| SeImpersonatePrivilege | Privilege Rights: SeImpersonatePrivilege | *S-1-5-6,*S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229,*S-1-5-20,*S-1-5-19,*S-1-5-32-544 | |
| SeInteractiveLogonRight | Privilege Rights: SeInteractiveLogonRight | *S-1-5-9,*S-1-5-32-544 | |
| SeLoadDriverPrivilege | Privilege Rights: SeLoadDriverPrivilege | *S-1-5-32-544 | |
| SeLockMemoryPrivilege | Privilege Rights: SeLockMemoryPrivilege | ||
| SeManageVolumePrivilege | Privilege Rights: SeManageVolumePrivilege | *S-1-5-32-544 | |
| SeNetworkLogonRight | Privilege Rights: SeNetworkLogonRight | *S-1-5-9,*S-1-5-11,*S-1-5-32-544 | |
| SeProfileSingleProcessPrivilege | Privilege Rights: SeProfileSingleProcessPrivilege | *S-1-5-32-544 | |
| SeRemoteInteractiveLogonRight | Privilege Rights: SeRemoteInteractiveLogonRight | *S-1-5-32-544 | |
| SeRemoteShutdownPrivilege | Privilege Rights: SeRemoteShutdownPrivilege | *S-1-5-32-544 | |
| SeRestorePrivilege | Privilege Rights: SeRestorePrivilege | *S-1-5-32-544 | |
| SeSystemEnvironmentPrivilege | Privilege Rights: SeSystemEnvironmentPrivilege | *S-1-5-32-544 | |
| SeTakeOwnershipPrivilege | Privilege Rights: SeTakeOwnershipPrivilege | *S-1-5-32-544 | |
| SeTcbPrivilege | Privilege Rights: SeTcbPrivilege | ||
| SeTrustedCredManAccessPrivilege | Privilege Rights: SeTrustedCredManAccessPrivilege | ||
| MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | Registry Values: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption | 1,"1" | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin | 4,2 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser | 4,0 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken | 4,1 | |
| MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | Registry Values: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs | 4,900 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel | 4,5 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback | 4,0 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic | 4,2 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec | 4,537395200 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | Registry Values: MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy | 4,1 | |
| MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | Registry Values: MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | Registry Values: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword | 4,0 | |
| MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | Registry Values: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | Registry Values: MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain | 4,7 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorseal | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkey | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannel | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | Registry Values: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannel | 4,1 | |
| MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding | Registry Values: MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding | 4,2 | |
| MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity | Registry Values: MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity | 4,1 | |
| "AppIDSvc",2,"" | Service General Setting: "AppIDSvc",2,"" | ||
| LSAAnonymousNameLookup | System Access: LSAAnonymousNameLookup | 0 |
196 of 564.