adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-26 15:37:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

new policies

Browse Source
This commit is contained in:
abrown38 committed 2024-08-05 18:35:04 +01:00
1 parent 95df907e64
commit 35da1bba41
6 files changed
+1354
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/AdmPwd.admx
+63
View File
@@ -0,0 +1,63 @@
<policyDefinitions revision="1.0" schemaVersion="1.0">
<policyNamespaces>
<target prefix="fullarmor" namespace="FullArmor.Policies.C9E1D975_EA58_48C3_958E_3BC214D89A2E" />
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
</policyNamespaces>
<supersededAdm fileName="" />
<resources minRequiredRevision="1.0" />
<supportedOn>
<definitions>
<definition name="SUPPORTED_WindowsVista" displayName="$(string.SUPPORTED_WindowsVista)" />
</definitions>
</supportedOn>
<categories>
<category name="CAT_AdmPwd" displayName="$(string.CAT_AdmPwd)" />
</categories>
<policies>
<policy name="POL_AdmPwd_Enabled" class="Machine" displayName="$(string.POL_AdmPwd_Enabled)" explainText="$(string.POL_AdmPwd_Enabled_Help)" key="Software\Policies\Microsoft Services\AdmPwd" valueName="AdmPwdEnabled" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}">
<parentCategory ref="CAT_AdmPwd" />
<supportedOn ref="SUPPORTED_WindowsVista" />
</policy>
<policy name="POL_AdmPwd" class="Machine" displayName="$(string.POL_AdmPwd)" explainText="$(string.POL_AdmPwd_Help)" presentation="$(presentation.POL_AdmPwd)" key="Software\Policies\Microsoft Services\AdmPwd">
<parentCategory ref="CAT_AdmPwd" />
<supportedOn ref="SUPPORTED_WindowsVista" />
<elements>
<enum id="ELM_AdmPwd_PasswordComplexity" key="Software\Policies\Microsoft Services\AdmPwd" valueName="PasswordComplexity" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}">
<item displayName="$(string.ITM_AdmPwd_PwdComplexity_1)">
<value>
<decimal value="1" />
</value>
</item>
<item displayName="$(string.ITM_AdmPwd_PwdComplexity_2)">
<value>
<decimal value="2" />
</value>
</item>
<item displayName="$(string.ITM_AdmPwd_PwdComplexity_3)">
<value>
<decimal value="3" />
</value>
</item>
<item displayName="$(string.ITM_AdmPwd_PwdComplexity_4)">
<value>
<decimal value="4" />
</value>
</item>
</enum>
<decimal id="ELM_AdmPwd_PasswordLength" key="Software\Policies\Microsoft Services\AdmPwd" valueName="PasswordLength" minValue="8" maxValue="64" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}" />
<decimal id="ELM_AdmPwd_PasswordAgeDays" key="Software\Policies\Microsoft Services\AdmPwd" valueName="PasswordAgeDays" minValue="1" maxValue="365" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}" />
</elements>
</policy>
<policy name="POL_AdmPwd_AdminName" class="Machine" displayName="$(string.POL_AdmPwd_AdminName)" explainText="$(string.POL_AdmPwd_AdminName_Help)" presentation="$(presentation.POL_AdmPwd_AdminName)" key="Software\Policies\Microsoft Services\AdmPwd">
<parentCategory ref="CAT_AdmPwd" />
<supportedOn ref="SUPPORTED_WindowsVista" />
<elements>
<text id="TXT_AdminAccountName" key="Software\Policies\Microsoft Services\AdmPwd" valueName="AdminAccountName" maxLength="64" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}" />
</elements>
</policy>
<policy name="POL_AdmPwd_DontAllowPwdExpirationBehindPolicy" class="Machine" displayName="$(string.POL_AdmPwd_DontAllowPwdExpirationBehindPolicy)" explainText="$(string.POL_AdmPwd_DontAllowPwdExpirationBehindPolicy_Help)" key="Software\Policies\Microsoft Services\AdmPwd" valueName="PwdExpirationProtectionEnabled" clientExtension="{D76B9641-3288-4f75-942D-087DE603E3EA}">
<parentCategory ref="CAT_AdmPwd" />
<supportedOn ref="SUPPORTED_WindowsVista" />
</policy>
</policies>
</policyDefinitions>
ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/MSS-legacy.admx
+292
View File
@@ -0,0 +1,292 @@
<policyDefinitions revision="1.0" schemaVersion="1.0">
<policyNamespaces>
<target prefix="MSS" namespace="Microsoft.Policies.MSS" />
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
</policyNamespaces>
<resources minRequiredRevision="1.0" />
<categories>
<category name="Cat_MSS" displayName="$(string.MSS)" />
</categories>
<policies>
<policy name="Pol_MSS_AutoAdminLogon" class="Machine" displayName="$(string.DisableAutoLogon)" explainText="$(string.DisableAutoLogon_Help)" key="Software\Microsoft\Windows NT\CurrentVersion\Winlogon" valueName="AutoAdminLogon">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<string>1</string>
</enabledValue>
<disabledValue>
<string>0</string>
</disabledValue>
</policy>
<policy name="Pol_MSS_AutoReboot" class="Machine" displayName="$(string.AutoReboot)" explainText="$(string.AutoReboot_Help)" key="SYSTEM\CurrentControlSet\Control\CrashControl" valueName="AutoReboot">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_AutoShareWks" class="Machine" displayName="$(string.AdminShares)" explainText="$(string.AdminShares_Help)" key="System\CurrentControlSet\Services\LanmanServer\Parameters" valueName="AutoShareWks">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_AutoShareServer" class="Machine" displayName="$(string.AdminSharesServer)" explainText="$(string.AdminSharesServer_Help)" key="System\CurrentControlSet\Services\LanmanServer\Parameters" valueName="AutoShareServer">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_DisableSavePassword" class="Machine" displayName="$(string.DisableSavePassword)" explainText="$(string.DisableSavePassword_Help)" key="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" valueName="DisableSavePassword">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_EnableDeadGWDetect" class="Machine" displayName="$(string.EnableDeadGWDetect)" explainText="$(string.EnableDeadGWDetect_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="EnableDeadGWDetect">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_EnableICMPRedirect" class="Machine" displayName="$(string.EnableICMPRedirect)" explainText="$(string.EnableICMPRedirect_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="EnableICMPRedirect">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_HideFromBrowseList" class="Machine" displayName="$(string.HideFromBrowseList)" explainText="$(string.HideFromBrowseList_Help)" key="System\CurrentControlSet\Services\Lanmanserver\Parameters" valueName="Hidden">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_NoNameReleaseOnDemand" class="Machine" displayName="$(string.NoNameReleaseOnDemand)" explainText="$(string.NoNameReleaseOnDemand_Help)" key="System\CurrentControlSet\Services\Netbt\Parameters" valueName="NoNameReleaseOnDemand">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_PerformRouterDiscovery" class="Machine" displayName="$(string.PerformRouterDiscovery)" explainText="$(string.PerformRouterDiscovery_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="PerformRouterDiscovery">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_SafeDllSearchMode" class="Machine" displayName="$(string.SafeDllSearchMode)" explainText="$(string.SafeDllSearchMode_Help)" key="SYSTEM\CurrentControlSet\Control\Session Manager" valueName="SafeDllSearchMode">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_MSS_ScreenSaverGracePeriod" class="Machine" displayName="$(string.ScreenSaverGracePeriod)" explainText="$(string.ScreenSaverGracePeriod_Help)" presentation="$(presentation.ScreenSaverGracePeriod)" key="Software\Microsoft\Windows NT\CurrentVersion\Winlogon">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<decimal id="ScreenSaverGracePeriod" storeAsText="true" valueName="ScreenSaverGracePeriod"/>
</elements>
</policy>
<policy name="Pol_MSS_TcpMaxDataRetransmissions" class="Machine" displayName="$(string.TcpMaxDataRetransmissions)" explainText="$(string.TcpMaxDataRetransmissions_Help)" presentation="$(presentation.TcpMaxDataRetransmissions)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<decimal id="TcpMaxDataRetransmissions" valueName="TcpMaxDataRetransmissions"/>
</elements>
</policy>
<policy name="Pol_MSS_TcpMaxDataRetransmissionsIPv6" class="Machine" displayName="$(string.TcpMaxDataRetransmissionsIPv6)" explainText="$(string.TcpMaxDataRetransmissionsIPv6_Help)" presentation="$(presentation.TcpMaxDataRetransmissions)" key="System\CurrentControlSet\Services\Tcpip6\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<decimal id="TcpMaxDataRetransmissions" valueName="TcpMaxDataRetransmissions"/>
</elements>
</policy>
<policy name="Pol_MSS_DisableIPSourceRouting" class="Machine" displayName="$(string.DisableIPSourceRouting)" explainText="$(string.DisableIPSourceRouting_Help)" presentation="$(presentation.DisableIPSourceRouting)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="DisableIPSourceRouting" valueName="DisableIPSourceRouting" required="true">
<item displayName="$(string.DisableIPSourceRouting0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.DisableIPSourceRouting1)"> <value> <decimal value="1"/> </value> </item>
<item displayName="$(string.DisableIPSourceRouting2)"> <value> <decimal value="2"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_DisableIPSourceRoutingIPv6" class="Machine" displayName="$(string.DisableIPSourceRoutingIPv6)" explainText="$(string.DisableIPSourceRoutingIPv6_Help)" presentation="$(presentation.DisableIPSourceRoutingIPv6)" key="System\CurrentControlSet\Services\Tcpip6\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="DisableIPSourceRoutingIPv6" valueName="DisableIPSourceRouting" required="true">
<item displayName="$(string.DisableIPSourceRouting0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.DisableIPSourceRouting1)"> <value> <decimal value="1"/> </value> </item>
<item displayName="$(string.DisableIPSourceRouting2)"> <value> <decimal value="2"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_NtfsDisable8dot3NameCreation" class="Machine" displayName="$(string.NtfsDisable8dot3NameCreation)" explainText="$(string.NtfsDisable8dot3NameCreation_Help)" presentation="$(presentation.NtfsDisable8dot3NameCreation)" key="System\CurrentControlSet\Control\FileSystem">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="NtfsDisable8dot3NameCreation" valueName="NtfsDisable8dot3NameCreation" required="true">
<item displayName="$(string.NtfsDisable8dot3NameCreation0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.NtfsDisable8dot3NameCreation1)"> <value> <decimal value="1"/> </value> </item>
<item displayName="$(string.NtfsDisable8dot3NameCreation2)"> <value> <decimal value="2"/> </value> </item>
<item displayName="$(string.NtfsDisable8dot3NameCreation3)"> <value> <decimal value="3"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_KeepAliveTime" class="Machine" displayName="$(string.KeepAliveTime)" explainText="$(string.KeepAliveTime_Help)" presentation="$(presentation.KeepAliveTime)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="KeepAliveTime" valueName="KeepAliveTime" required="true">
<item displayName="$(string.KeepAliveTime0)"> <value> <decimal value="150000"/> </value> </item>
<item displayName="$(string.KeepAliveTime1)"> <value> <decimal value="300000"/> </value> </item>
<item displayName="$(string.KeepAliveTime2)"> <value> <decimal value="600000"/> </value> </item>
<item displayName="$(string.KeepAliveTime3)"> <value> <decimal value="1200000"/> </value> </item>
<item displayName="$(string.KeepAliveTime4)"> <value> <decimal value="2400000"/> </value> </item>
<item displayName="$(string.KeepAliveTime5)"> <value> <decimal value="3600000"/> </value> </item>
<item displayName="$(string.KeepAliveTime6)"> <value> <decimal value="7200000"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_NoDefaultExempt" class="Machine" displayName="$(string.NoDefaultExempt)" explainText="$(string.NoDefaultExempt_Help)" presentation="$(presentation.NoDefaultExempt)" key="System\CurrentControlSet\Services\IPSEC">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="NoDefaultExempt" valueName="NoDefaultExempt" required="true">
<item displayName="$(string.NoDefaultExempt0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.NoDefaultExempt1)"> <value> <decimal value="1"/> </value> </item>
<item displayName="$(string.NoDefaultExempt2)"> <value> <decimal value="2"/> </value> </item>
<item displayName="$(string.NoDefaultExempt3)"> <value> <decimal value="3"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_SynAttackProtect" class="Machine" displayName="$(string.SynAttackProtect)" explainText="$(string.SynAttackProtect_Help)" presentation="$(presentation.SynAttackProtect)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="SynAttackProtect" valueName="SynAttackProtect" required="true">
<item displayName="$(string.SynAttackProtect0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.SynAttackProtect1)"> <value> <decimal value="1"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_TcpMaxConnectResponseRetransmissions" class="Machine" displayName="$(string.TcpMaxConnectResponseRetransmissions)" explainText="$(string.TcpMaxConnectResponseRetransmissions_Help)" presentation="$(presentation.TcpMaxConnectResponseRetransmissions)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="TcpMaxConnectResponseRetransmissions" valueName="TcpMaxConnectResponseRetransmissions" required="true">
<item displayName="$(string.TcpMaxConnectResponseRetransmissions0)"> <value> <decimal value="0"/> </value> </item>
<item displayName="$(string.TcpMaxConnectResponseRetransmissions1)"> <value> <decimal value="1"/> </value> </item>
<item displayName="$(string.TcpMaxConnectResponseRetransmissions2)"> <value> <decimal value="2"/> </value> </item>
<item displayName="$(string.TcpMaxConnectResponseRetransmissions3)"> <value> <decimal value="3"/> </value> </item>
</enum>
</elements>
</policy>
<policy name="Pol_MSS_WarningLevel" class="Machine" displayName="$(string.WarningLevel)" explainText="$(string.WarningLevel_Help)" presentation="$(presentation.WarningLevel)" key="SYSTEM\CurrentControlSet\Services\Eventlog\Security">
<parentCategory ref="Cat_MSS" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<elements>
<enum id="WarningLevel" valueName="WarningLevel" required="true">
<item displayName="$(string.WarningLevel0)"> <value> <decimal value="50"/> </value> </item>
<item displayName="$(string.WarningLevel1)"> <value> <decimal value="60"/> </value> </item>
<item displayName="$(string.WarningLevel2)"> <value> <decimal value="70"/> </value> </item>
<item displayName="$(string.WarningLevel3)"> <value> <decimal value="80"/> </value> </item>
<item displayName="$(string.WarningLevel4)"> <value> <decimal value="90"/> </value> </item>
</enum>
</elements>
</policy>
</policies>
</policyDefinitions>
<!--
;========= Start of MSS Registry Values =========
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon,1,%DisableAutoLogon%,0
MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\AutoReboot,4,%AutoReboot%,0
MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks,4,%AdminShares%,0
MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer,4,%AdminSharesServer%,0
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting,4,%DisableIPSourceRouting%,3,0|%DisableIPSourceRouting0%,1|%DisableIPSourceRouting1%,2|%DisableIPSourceRouting2%
MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableSavePassword,4,%DisableSavePassword%,0
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnableDeadGWDetect,4,%EnableDeadGWDetect%,0
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect,4,%EnableICMPRedirect%,0
MACHINE\System\CurrentControlSet\Services\Lanmanserver\Parameters\Hidden,4,%HideFromBrowseList%,0
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime,4,%KeepAliveTime%,3,150000|%KeepAliveTime0%,300000|%KeepAliveTime1%,600000|%KeepAliveTime2%,1200000|%KeepAliveTime3%,2400000|%KeepAliveTime4%,3600000|%KeepAliveTime5%,7200000|%KeepAliveTime6%
MACHINE\System\CurrentControlSet\Services\IPSEC\NoDefaultExempt,4,%NoDefaultExempt%,3,0|%NoDefaultExempt0%,1|%NoDefaultExempt1%,2|%NoDefaultExempt2%,3|%NoDefaultExempt3%
MACHINE\System\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand,4,%NoNameReleaseOnDemand%,0
MACHINE\System\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation,4,%NtfsDisable8dot3NameCreation%,3,0|%NtfsDisable8dot3NameCreation0%,1|%NtfsDisable8dot3NameCreation1%,2|%NtfsDisable8dot3NameCreation2%,3|%NtfsDisable8dot3NameCreation3%
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\PerformRouterDiscovery,4,%PerformRouterDiscovery%,0
MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode,4,%SafeDllSearchMode%,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScreenSaverGracePeriod,1,%ScreenSaverGracePeriod%,1
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\SynAttackProtect,4,%SynAttackProtect%,3,0|%SynAttackProtect0%,1|%SynAttackProtect1%
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxConnectResponseRetransmissions,4,%TcpMaxConnectResponseRetransmissions%,3,0|%TcpMaxConnectResponseRetransmissions0%,1|%TcpMaxConnectResponseRetransmissions1%,2|%TcpMaxConnectResponseRetransmissions2%,3|%TcpMaxConnectResponseRetransmissions3%
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions,4,%TcpMaxDataRetransmissions%,1
MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel,4,%WarningLevel%,3,50|%WarningLevel0%,60|%WarningLevel1%,70|%WarningLevel2%,80|%WarningLevel3%,90|%WarningLevel4%
MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting,4,%DisableIPSourceRoutingIPv6%,3,0|%DisableIPSourceRouting0%,1|%DisableIPSourceRouting1%,2|%DisableIPSourceRouting2%
MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\TcpMaxDataRetransmissions ,4,%TcpMaxDataRetransmissionsIPv6%,1
;========= End of MSS Registry Values =========
-->
ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/SecGuide.admx
+547
View File
@@ -0,0 +1,547 @@
<?xml version="1.0" encoding="utf-8"?>
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
revision="1.0"
schemaVersion="1.0"
xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<policyNamespaces>
<target prefix="SecGuide" namespace="Microsoft.Policies.SecGuide" />
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
</policyNamespaces>
<resources minRequiredRevision="1.0" />
<supportedOn>
<definitions>
<definition name="SUPPORTED_preWin81_2012R2" displayName="$(string.SUPPORTED_preWin81_2012R2)" />
<definition name="SUPPORTED_WindowsServer2008AndNewer" displayName="$(string.SUPPORTED_WindowsServer2008AndNewer)" />
</definitions>
</supportedOn>
<categories>
<category name="Cat_SecGuide" displayName="$(string.Cat_SecGuide)"/>
</categories>
<policies>
<!-- Configure Print Driver Restriction-->
<policy name="Pol_SecGuide_0721_Print_Driver"
class="Machine"
displayName="$(string.Pol_SecGuide_PrintDriver)"
explainText="$(string.Pol_SecGuide_PrintDriver_Help)"
key="Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
valueName="RestrictDriverInstallationToAdministrators"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows7" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<!-- Configure SMBv1 -->
<policy name="Pol_SecGuide_0001_SMBv1_Server"
class="Machine"
displayName="$(string.Pol_SecGuide_SMBv1Server)"
explainText="$(string.Pol_SecGuide_SMBv1Server_Help)"
key="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
valueName="SMB1"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows7" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_SecGuide_0002_SMBv1_ClientDriver"
class="Machine"
displayName="$(string.Pol_SecGuide_SMBv1ClientDriver)"
explainText="$(string.Pol_SecGuide_SMBv1ClientDriver_Help)"
key="SYSTEM\CurrentControlSet\Services\MrxSmb10"
presentation="$(presentation.Pol_SecGuide_SMBv1ClientDriver)"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows7" />
<elements>
<enum id="Pol_SecGuide_SMB1ClientDriver" key="SYSTEM\CurrentControlSet\Services\MrxSmb10" valueName="Start">
<item displayName="$(string.SMB1DriverDisable)">
<value>
<decimal value="4"/>
</value>
</item>
<item displayName="$(string.SMB1DriverManualStart)">
<value>
<decimal value="3"/>
</value>
</item>
<item displayName="$(string.SMB1DriverAutomaticStart)">
<value>
<decimal value="2"/>
</value>
</item>
</enum>
</elements>
</policy>
<policy name="Pol_SecGuide_0003_SMBv1_ClientLMWkstaDepends"
class="Machine"
displayName="$(string.Pol_SecGuide_SMBv1ClientLMWkstaDepends)"
explainText="$(string.Pol_SecGuide_SMBv1ClientLMWkstaDepends_Help)"
key="SYSTEM\CurrentControlSet\Services\LanmanWorkstation"
presentation="$(presentation.Pol_SecGuide_SMBv1ClientWin7)"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="SUPPORTED_preWin81_2012R2" />
<elements>
<multiText id="Pol_SecGuide_SMB1Win7LMSDepends" valueName="DependOnService"/>
</elements>
</policy>
<!-- NetBT NodeType configuration -->
<policy name="Pol_SecGuide_0050_NetbtNodeTypeConfig"
class="Machine"
displayName="$(string.Pol_SecGuide_NetbtNodeTypeCfg)"
explainText="$(string.Pol_SecGuide_NetbtNodeTypeCfg_Help)"
key="SYSTEM\CurrentControlSet\Services\NetBT\Parameters"
presentation="$(presentation.Pol_SecGuide_NetbtNodeTypeCfg)"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows7" />
<elements>
<enum id="Pol_SecGuide_SecGuide_NetbtNodeTypeCfg" key="SYSTEM\CurrentControlSet\Services\NetBT\Parameters" valueName="NodeType">
<item displayName="$(string.NetBtNodeTypeB)">
<value>
<decimal value="1"/>
</value>
</item>
<item displayName="$(string.NetBtNodeTypeP)">
<value>
<decimal value="2"/>
</value>
</item>
<item displayName="$(string.NetBtNodeTypeM)">
<value>
<decimal value="4"/>
</value>
</item>
<item displayName="$(string.NetBtNodeTypeH)">
<value>
<decimal value="8"/>
</value>
</item>
</enum>
</elements>
</policy>
<!-- LdapEnforceChannelBinding (DC only) -->
<policy name="Pol_SecGuide_0100_LdapEnforceChannelBinding"
class="Machine"
displayName="$(string.Pol_SecGuide_LdapEnforceChannelBinding)"
explainText="$(string.Pol_SecGuide_LdapEnforceChannelBinding_Help)"
key="System\CurrentControlSet\Services\NTDS\Parameters"
valueName="LdapEnforceChannelBinding"
presentation="$(presentation.Pol_SecGuide_LdapEnforceChannelBinding)"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="SUPPORTED_WindowsServer2008AndNewer" />
<elements>
<enum id="Pol_SecGuide_LdapEnforceChannelBinding" key="System\CurrentControlSet\Services\NTDS\Parameters" valueName="LdapEnforceChannelBinding">
<item displayName="$(string.LdapEnforce_Always)">
<value>
<decimal value="2"/>
</value>
</item>
<item displayName="$(string.LdapEnforce_WhenSupported)">
<value>
<decimal value="1"/>
</value>
</item>
<item displayName="$(string.LdapEnforce_Disabled)">
<value>
<decimal value="0"/>
</value>
</item>
</enum>
</elements>
</policy>
<!-- Windows Defender PUA -->
<policy name="Pol_SecGuide_0101_WDPUA"
class="Machine"
displayName="$(string.Pol_SecGuide_WDPUA)"
explainText="$(string.Pol_SecGuide_WDPUA_Help)"
key="Software\Policies\Microsoft\Windows Defender\MpEngine"
valueName="MpEnablePus">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows_10_0" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<!-- SEHOP -->
<policy name="Pol_SecGuide_0102_SEHOP"
class="Machine"
displayName="$(string.Pol_SecGuide_SEHOP)"
explainText="$(string.Pol_SecGuide_SEHOP_Help)"
key="SYSTEM\CurrentControlSet\Control\Session Manager\kernel"
valueName="DisableExceptionChainValidation">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="0" />
</enabledValue>
<disabledValue>
<decimal value="1" />
</disabledValue>
</policy>
<!-- Credential theft protections -->
<policy name="Pol_SecGuide_0201_LATFP"
class="Machine"
displayName="$(string.Pol_SecGuide_LATFP)"
explainText="$(string.Pol_SecGuide_LATFP_Help)"
key="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
valueName="LocalAccountTokenFilterPolicy">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledValue>
<decimal value="0" />
</enabledValue>
<disabledValue>
<decimal value="1" />
</disabledValue>
</policy>
<policy name="Pol_SecGuide_0202_WDigestAuthn"
class="Machine"
displayName="$(string.Pol_SecGuide_WDigestAuthn)"
explainText="$(string.Pol_SecGuide_WDigestAuthn_Help)"
key="SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
valueName="UseLogonCredential">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows7" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_SecGuide_0203_LsassAudit"
class="Machine"
displayName="$(string.Pol_SecGuide_LsassAudit)"
explainText="$(string.Pol_SecGuide_LsassAudit_Help)"
key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe"
valueName="AuditLevel">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows_6_3" />
<enabledValue>
<decimal value="8" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<policy name="Pol_SecGuide_0204_LsassRunAsPPL"
class="Machine"
displayName="$(string.Pol_SecGuide_LsassRunAsPPL)"
explainText="$(string.Pol_SecGuide_LsassRunAsPPL_Help)"
key="SYSTEM\CurrentControlSet\Control\Lsa"
valueName="RunAsPPL">
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows_6_3" />
<enabledValue>
<decimal value="1" />
</enabledValue>
<disabledValue>
<decimal value="0" />
</disabledValue>
</policy>
<!-- Disable same-desktop credential exposure -->
<policy name="Pol_SecGuide_0301_RemoveRunasdifferentuser"
class="Machine"
displayName="$(string.Pol_SecGuide_RemoveRunasdifferentuser)"
explainText="$(string.Pol_SecGuide_RemoveRunasdifferentuser_Help)"
key="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" >
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
<enabledList>
<item key="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoStartBanner">
<value>
<decimal value="1" />
</value>
</item>
<item key="SOFTWARE\Classes\batfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<!-- 4096 == 0x1000 == REST_STARTBANNER -->
<decimal value="4096" />
</value>
</item>
<item key="SOFTWARE\Classes\cmdfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<!-- 4096 == 0x1000 == REST_STARTBANNER -->
<decimal value="4096" />
</value>
</item>
<item key="SOFTWARE\Classes\exefile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<!-- 4096 == 0x1000 == REST_STARTBANNER -->
<decimal value="4096" />
</value>
</item>
<item key="SOFTWARE\Classes\mscfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<!-- 4096 == 0x1000 == REST_STARTBANNER -->
<decimal value="4096" />
</value>
</item>
</enabledList>
<disabledList>
<item key="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" valueName="NoStartBanner">
<value>
<delete />
</value>
</item>
<item key="SOFTWARE\Classes\batfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<delete />
</value>
</item>
<item key="SOFTWARE\Classes\cmdfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<delete />
</value>
</item>
<item key="SOFTWARE\Classes\exefile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<delete />
</value>
</item>
<item key="SOFTWARE\Classes\mscfile\shell\runasuser" valueName="SuppressionPolicy">
<value>
<delete />
</value>
</item>
</disabledList>
</policy>
<!-- Block Flash in Office documents using Office "kill bit" feature -->
<policy name="Pol_SecGuide_A001_Block_Flash"
class="Machine"
displayName="$(string.Pol_SecGuide_Block_Flash)"
explainText="$(string.Pol_SecGuide_Block_Flash_Help)"
presentation="$(presentation.Pol_SecGuide_Block_Flash)"
key="SOFTWARE\Microsoft\Office\Common\COM Compatibility"
>
<parentCategory ref="Cat_SecGuide"/>
<supportedOn ref="windows:SUPPORTED_Windows7" />
<elements>
<enum id="Pol_SecGuide_Block_Flash" key="SOFTWARE\Microsoft\Office\Common\COM Compatibility" valueName="Comment">
<item displayName="$(string.BlockFlash_BlockActivation)">
<value><string>Block all Flash activation</string></value>
<valueList>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
</valueList>
</item>
<item displayName="$(string.BlockFlash_BlockEmbedded)">
<value><string>Block embedded Flash activation only</string></value>
<valueList>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="1024"/> <!-- hex 400 --> </value>
</item>
</valueList>
</item>
<item displayName="$(string.BlockFlash_AllowAll)">
<value><string>Allow all Flash activation</string></value>
<valueList>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="ActivationFilterOverride">
<value> <decimal value="1"/> </value>
</item>
<item key="SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{D27CDB70-AE6D-11CF-96B8-444553540000}" valueName="Compatibility Flags">
<value> <decimal value="0"/> </value>
</item>
</valueList>
</item>
</enum>
</elements>
</policy>
<!-- Legacy JScript Block for Internet Explorer -->
<policy name="Pol_SecGuide_Legacy_JScript"
class="Machine"
displayName="$(string.Pol_SecGuide_Legacy_JScript)"
explainText="$(string.Pol_SecGuide_Legacy_JScript_Help)"
key="software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE"
presentation="$(presentation.Pol_SecGuide_Legacy_JScript)"
>
<parentCategory ref="Cat_SecGuide" />
<supportedOn ref="windows:SUPPORTED_Windows_10_0_RS4" />
<elements>
<decimal id="POL_SG_excel" valueName="excel.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_mspub" valueName="mspub.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_powerpnt" valueName="powerpnt.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_onenote" valueName="onenote.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_visio" valueName="visio.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_winproj" valueName="winproj.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_winword" valueName="winword.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_outlook" valueName="outlook.exe" maxValue="99999" storeAsText="false" />
<decimal id="POL_SG_msaccess" valueName="msaccess.exe" maxValue="99999" storeAsText="false" />
</elements>
</policy>
</policies>
</policyDefinitions>
ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/AdmPwd.adml
+66
View File
@@ -0,0 +1,66 @@
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
<displayName>
</displayName>
<description>
</description>
<resources>
<stringTable>
<string id="CAT_AdmPwd">LAPS</string>
<string id="POL_AdmPwd_Enabled">Enable local admin password management</string>
<string id="POL_AdmPwd_Enabled_Help">
Enables management of password for local administrator account
If you enable this setting, local administrator password is managed
If you disable or not configure this setting, local administrator password is NOT managed
</string>
<string id="POL_AdmPwd">Password Settings</string>
<string id="POL_AdmPwd_Help">
Configures password parameters
Password complexity: which characters are used when generating a new password
Default: Large letters + small letters + numbers + special characters
Password length
Minimum: 8 characters
Maximum: 64 characters
Default: 14 characters
Password age in days
Minimum: 1 day
Maximum: 365 days
Default: 30 days
</string>
<string id="SUPPORTED_WindowsVista">At least Microsoft Windows Vista or Windows Server 2003 family</string>
<string id="ITM_AdmPwd_PwdComplexity_1">Large letters</string>
<string id="ITM_AdmPwd_PwdComplexity_2">Large letters + small letters</string>
<string id="ITM_AdmPwd_PwdComplexity_3">Large letters + small letters + numbers</string>
<string id="ITM_AdmPwd_PwdComplexity_4">Large letters + small letters + numbers + specials</string>
<string id="POL_AdmPwd_AdminName">Name of administrator account to manage</string>
<string id="POL_AdmPwd_AdminName_Help">
Administrator account name: name of the local account you want to manage password for.
DO NOT configure when you use built-in admin account. Built-in admin account is auto-detected by well-known SID, even when renamed
DO configure when you use custom local admin account
</string>
<string id="POL_AdmPwd_DontAllowPwdExpirationBehindPolicy">Do not allow password expiration time longer than required by policy</string>
<string id="POL_AdmPwd_DontAllowPwdExpirationBehindPolicy_Help">
When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password expiration is set according to policy.
When you disable or not configure this setting, password expiration time may be longer than required by "Password Settings" policy.
</string>
</stringTable>
<presentationTable>
<presentation id="POL_AdmPwd">
<dropdownList refId="ELM_AdmPwd_PasswordComplexity" defaultItem="3">Password Complexity</dropdownList>
<decimalTextBox refId="ELM_AdmPwd_PasswordLength" defaultValue="14">Password Length</decimalTextBox>
<decimalTextBox refId="ELM_AdmPwd_PasswordAgeDays" defaultValue="30">Password Age (Days)</decimalTextBox>
</presentation>
<presentation id="POL_AdmPwd_AdminName">
<textBox refId="TXT_AdminAccountName">
<label>Administrator account name</label>
</textBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/MSS-legacy.adml
+173
View File
@@ -0,0 +1,173 @@
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
<displayName>MSS (Legacy)</displayName>
<description>The legacy "MSS" settings that had been exposed in Secpol, Security Options, using LocalGPO.wsf /ConfigSCE.</description>
<resources>
<stringTable>
<string id="MSS">MSS (Legacy)</string>
<string id="AdminShares">MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)</string>
<string id="AdminShares_Help">MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)</string>
<string id="AdminSharesServer">MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)</string>
<string id="AdminSharesServer_Help">MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)</string>
<string id="AutoReboot">MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)</string>
<string id="AutoReboot_Help">MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)</string>
<string id="DisableAutoLogon">MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)</string>
<string id="DisableAutoLogon_Help">MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)</string>
<string id="DisableIPSourceRouting">MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)</string>
<string id="DisableIPSourceRouting_Help">MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)</string>
<string id="DisableIPSourceRouting0">No additional protection, source routed packets are allowed</string>
<string id="DisableIPSourceRouting1">Medium, source routed packets ignored when IP forwarding is enabled</string>
<string id="DisableIPSourceRouting2">Highest protection, source routing is completely disabled</string>
<string id="DisableIPSourceRoutingIPv6">MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)</string>
<string id="DisableIPSourceRoutingIPv6_Help">MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)</string>
<string id="DisableSavePassword">MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)</string>
<string id="DisableSavePassword_Help">MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)</string>
<string id="EnableDeadGWDetect">MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)</string>
<string id="EnableDeadGWDetect_Help">MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)</string>
<string id="EnableICMPRedirect">MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes</string>
<string id="EnableICMPRedirect_Help">MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes</string>
<string id="HideFromBrowseList">MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)</string>
<string id="HideFromBrowseList_Help">MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)</string>
<string id="KeepAliveTime">MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds</string>
<string id="KeepAliveTime_Help">MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds</string>
<string id="KeepAliveTime0">150000 or 2.5 minutes</string>
<string id="KeepAliveTime1">300000 or 5 minutes (recommended) </string>
<string id="KeepAliveTime2">600000 or 10 minutes</string>
<string id="KeepAliveTime3">1200000 or 20 minutes</string>
<string id="KeepAliveTime4">2400000 or 40 minutes</string>
<string id="KeepAliveTime5">3600000 or 1 hour</string>
<string id="KeepAliveTime6">7200000 or 2 hours (default value)</string>
<string id="NoDefaultExempt">MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. </string>
<string id="NoDefaultExempt_Help">MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. </string>
<string id="NoDefaultExempt0">Allow all exemptions (least secure).</string>
<string id="NoDefaultExempt1">Multicast, broadcast, &amp; ISAKMP exempt (best for Windows XP).</string>
<string id="NoDefaultExempt2">RSVP, Kerberos, and ISAKMP are exempt.</string>
<string id="NoDefaultExempt3">Only ISAKMP is exempt (recommended for Windows Server 2003). </string>
<string id="NoNameReleaseOnDemand">MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers</string>
<string id="NoNameReleaseOnDemand_Help">MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers</string>
<string id="NtfsDisable8dot3NameCreation">MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames</string>
<string id="NtfsDisable8dot3NameCreation_Help">MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames</string>
<string id="NtfsDisable8dot3NameCreation0">Enable 8Dot3 Creation on all Volumes</string>
<string id="NtfsDisable8dot3NameCreation1">Disable 8Dot3 Creation on all Volumes</string>
<string id="NtfsDisable8dot3NameCreation2">Set 8dot3 name creation per volume using FSUTIL (Windows 7 or later)</string>
<string id="NtfsDisable8dot3NameCreation3">Disable 8Dot3 name creation on all volumes except system volume (Windows 7 or later)</string>
<string id="PerformRouterDiscovery">MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)</string>
<string id="PerformRouterDiscovery_Help">MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)</string>
<string id="SafeDllSearchMode">MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)</string>
<string id="SafeDllSearchMode_Help">MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)</string>
<string id="ScreenSaverGracePeriod">MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)</string>
<string id="ScreenSaverGracePeriod_Help">MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)</string>
<string id="SynAttackProtect">MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)</string>
<string id="SynAttackProtect_Help">MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)</string>
<string id="SynAttackProtect0">No additional protection, use default settings</string>
<string id="SynAttackProtect1">Connections time out sooner if a SYN attack is detected</string>
<string id="TcpMaxConnectResponseRetransmissions">MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged</string>
<string id="TcpMaxConnectResponseRetransmissions_Help">MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged</string>
<string id="TcpMaxConnectResponseRetransmissions0">No retransmission, half-open connections dropped after 3 seconds</string>
<string id="TcpMaxConnectResponseRetransmissions1">3 seconds, half-open connections dropped after 9 seconds</string>
<string id="TcpMaxConnectResponseRetransmissions2">3 &amp; 6 seconds, half-open connections dropped after 21 seconds</string>
<string id="TcpMaxConnectResponseRetransmissions3">3, 6, &amp; 9 seconds, half-open connections dropped after 45 seconds</string>
<string id="TcpMaxDataRetransmissions">MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)</string>
<string id="TcpMaxDataRetransmissions_Help">MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)</string>
<string id="TcpMaxDataRetransmissionsIPv6">MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)</string>
<string id="TcpMaxDataRetransmissionsIPv6_Help">MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)</string>
<string id="WarningLevel">MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning</string>
<string id="WarningLevel_Help">MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning</string>
<string id="WarningLevel0">50%</string>
<string id="WarningLevel1">60%</string>
<string id="WarningLevel2">70%</string>
<string id="WarningLevel3">80%</string>
<string id="WarningLevel4">90%</string>
</stringTable>
<presentationTable>
<presentation id="DisableIPSourceRouting">
<dropdownList refId="DisableIPSourceRouting" noSort="true" defaultItem="1">DisableIPSourceRouting</dropdownList>
</presentation>
<presentation id="DisableIPSourceRoutingIPv6">
<dropdownList refId="DisableIPSourceRoutingIPv6" noSort="true" defaultItem="1">DisableIPSourceRoutingIPv6</dropdownList>
</presentation>
<presentation id="KeepAliveTime">
<dropdownList refId="KeepAliveTime" noSort="true" defaultItem="1">KeepAliveTime</dropdownList>
</presentation>
<presentation id="NoDefaultExempt">
<dropdownList refId="NoDefaultExempt" noSort="true" defaultItem="1">NoDefaultExempt</dropdownList>
</presentation>
<presentation id="NtfsDisable8dot3NameCreation">
<dropdownList refId="NtfsDisable8dot3NameCreation" noSort="true" defaultItem="0">NtfsDisable8dot3NameCreation</dropdownList>
</presentation>
<presentation id="ScreenSaverGracePeriod">
<decimalTextBox refId="ScreenSaverGracePeriod" spinStep="1" defaultValue="5">ScreenSaverGracePeriod</decimalTextBox>
</presentation>
<presentation id="SynAttackProtect">
<dropdownList refId="SynAttackProtect" noSort="true" defaultItem="0">SynAttackProtect</dropdownList>
</presentation>
<presentation id="TcpMaxConnectResponseRetransmissions">
<dropdownList refId="TcpMaxConnectResponseRetransmissions" noSort="true" defaultItem="0">TcpMaxConnectResponseRetransmissions</dropdownList>
</presentation>
<presentation id="TcpMaxDataRetransmissions">
<decimalTextBox refId="TcpMaxDataRetransmissions" spinStep="1" defaultValue="5">TcpMaxDataRetransmissions</decimalTextBox>
</presentation>
<presentation id="WarningLevel">
<dropdownList refId="WarningLevel" noSort="true" defaultItem="4">WarningLevel</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>
<!--
;========= Start of MSS Strings Values =========
DisableAutoLogon = "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)"
AutoReboot = "MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)"
AdminShares = "MSS: (AutoShareWks) Enable Administrative Shares (recommended except for highly secure environments)"
AdminSharesServer = "MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)"
DisableIPSourceRouting = "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)"
DisableIPSourceRoutingIPv6 = "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)"
DisableIPSourceRouting0 = "No additional protection, source routed packets are allowed"
DisableIPSourceRouting1 = "Medium, source routed packets ignored when IP forwarding is enabled"
DisableIPSourceRouting2 = "Highest protection, source routing is completely disabled"
DisableSavePassword = "MSS: (DisableSavePassword) Prevent the dial-up passsword from being saved (recommended)"
EnableDeadGWDetect = "MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS)"
EnableICMPRedirect = "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes"
HideFromBrowseList = "MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)"
KeepAliveTime = "MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds"
KeepAliveTime0 ="150000 or 2.5 minutes"
KeepAliveTime1 ="300000 or 5 minutes (recommended)"
KeepAliveTime2 ="600000 or 10 minutes"
KeepAliveTime3 ="1200000 or 20 minutes"
KeepAliveTime4 ="2400000 or 40 minutes"
KeepAliveTime5 ="3600000 or 1 hour"
KeepAliveTime6 ="7200000 or 2 hours (default value)"
NoDefaultExempt = "MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic."
NoDefaultExempt0 = "Allow all exemptions (least secure)."
NoDefaultExempt1 = "Multicast, broadcast, & ISAKMP exempt (best for Windows XP)."
NoDefaultExempt2 = "RSVP, Kerberos, and ISAKMP are exempt."
NoDefaultExempt3 = "Only ISAKMP is exempt (recommended for Windows Server 2003)."
NoNameReleaseOnDemand = "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers"
NtfsDisable8dot3NameCreation = "MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames"
NtfsDisable8dot3NameCreation0 = "Enable 8Dot3 Creation on all Volumes"
NtfsDisable8dot3NameCreation1 = "Disable 8Dot3 Creation on all Volumes"
NtfsDisable8dot3NameCreation2 = "Set 8dot3 name creation per volume using FSUTIL (Windows 7 or later)
NtfsDisable8dot3NameCreation3 = "Disable 8Dot3 name creation on all volumes except system volume (Windows 7 or later)"
PerformRouterDiscovery = "MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)"
SafeDllSearchMode = "MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)"
ScreenSaverGracePeriod = "MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)"
SynAttackProtect = "MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)"
SynAttackProtect0 = "No additional protection, use default settings"
SynAttackProtect1 = "Connections time out sooner if a SYN attack is detected"
TcpMaxConnectResponseRetransmissions = "MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged"
TcpMaxConnectResponseRetransmissions0 = "No retransmission, half-open connections dropped after 3 seconds"
TcpMaxConnectResponseRetransmissions1 = "3 seconds, half-open connections dropped after 9 seconds"
TcpMaxConnectResponseRetransmissions2 = "3 & 6 seconds, half-open connections dropped after 21 seconds"
TcpMaxConnectResponseRetransmissions3 = "3, 6, & 9 seconds, half-open connections dropped after 45 seconds"
TcpMaxDataRetransmissions = "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)"
TcpMaxDataRetransmissionsIPv6 = "MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)"
WarningLevel = "MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning"
WarningLevel0 = "50%"
WarningLevel1 = "60%"
WarningLevel2 = "70%"
WarningLevel3 = "80%"
WarningLevel4 = "90%"
;========= End of MSS Strings Values =========
-->
ansible/roles/win_domain_controller/files/policy_templates/PolicyDefinitions/en-us/SecGuide.adml
+213
View File
@@ -0,0 +1,213 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2014-2018 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>MS Security Guide</displayName>
<description>MS Security Guide mitigations</description>
<resources>
<stringTable>
<string id="SUPPORTED_preWin81_2012R2">Only Windows 7, Windows Server 2008, Windows Server 2008R2, Windows Server 2012</string>
<string id="SUPPORTED_WindowsServer2008AndNewer">Windows Server 2008 and newer</string>
<string id="Cat_SecGuide">MS Security Guide</string>
<string id="Pol_SecGuide_LATFP">Apply UAC restrictions to local accounts on network logons</string>
<string id="Pol_SecGuide_LATFP_Help">This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.). Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Enabling this policy significantly reduces that risk.
Enabled (recommended): Applies UAC token-filtering to local accounts on network logons. Membership in powerful group such as Administrators is disabled and powerful privileges are removed from the resulting access token. This configures the LocalAccountTokenFilterPolicy registry value to 0. This is the default behavior for Windows.
Disabled: Allows local accounts to have full administrative rights when authenticating via network logon, by configuring the LocalAccountTokenFilterPolicy registry value to 1.
For more information about local accounts and credential theft, see "Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques": http://www.microsoft.com/en-us/download/details.aspx?id=36036.
For more information about LocalAccountTokenFilterPolicy, see http://support.microsoft.com/kb/951016.
</string>
<string id="Pol_SecGuide_WDigestAuthn">WDigest Authentication (disabling may require KB2871997)</string>
<string id="Pol_SecGuide_WDigestAuthn_Help">When WDigest authentication is enabled, Lsass.exe retains a copy of the user's plaintext password in memory, where it can be at risk of theft. Microsoft recommends disabling WDigest authentication unless it is needed.
If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server.
Update KB2871997 must first be installed to disable WDigest authentication using this setting in Windows 7, Windows 8, Windows Server 2008 R2 and Windows Server 2012.
Enabled: Enables WDigest authentication.
Disabled (recommended): Disables WDigest authentication. For this setting to work on Windows 7, Windows 8, Windows Server 2008 R2 or Windows Server 2012, KB2871997 must first be installed.
For more information, see http://support.microsoft.com/kb/2871997 and http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx .
</string>
<string id="Pol_SecGuide_LsassAudit">Lsass.exe audit mode</string>
<string id="Pol_SecGuide_LsassAudit_Help">Enable auditing of Lsass.exe to evaluate feasibility of enabling LSA protection. For more information, see http://technet.microsoft.com/en-us/library/dn408187.aspx</string>
<string id="Pol_SecGuide_LsassRunAsPPL">LSA Protection</string>
<string id="Pol_SecGuide_LsassRunAsPPL_Help">Enable LSA protection. For more information, see http://technet.microsoft.com/en-us/library/dn408187.aspx</string>
<string id="Pol_SecGuide_RemoveRunasdifferentuser">Remove "Run As Different User" from context menus</string>
<string id="Pol_SecGuide_RemoveRunasdifferentuser_Help">This setting controls whether "Run As Different User" appears on the Shift+RightClick context menu for .bat, .cmd, .exe, and .msc files.
Enabled (recommended): Keeps "Run As Different User" from appearing in the context menu when the user holds Shift while right-clicking on a .bat, .cmd, .exe, or .msc file in Explorer.
Disabled: Restores the Windows default behavior for "Run As Different User."
</string>
<string id="Pol_SecGuide_WDPUA">Turn on Windows Defender protection against Potentially Unwanted Applications (DEPRECATED)</string>
<string id="Pol_SecGuide_WDPUA_Help">Beginning with Windows 10 v1809 and Windows Server v1809, this functionality should instead be configured through the following Group Policy setting:
Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Configure detection for potentially unwanted applications.
</string>
<string id="Pol_SecGuide_SEHOP">Enable Structured Exception Handling Overwrite Protection (SEHOP)</string>
<string id="Pol_SecGuide_SEHOP_Help">If this setting is enabled, SEHOP is enforced. For more information, see https://support.microsoft.com/en-us/help/956607/how-to-enable-structured-exception-handling-overwrite-protection-sehop-in-windows-operating-systems.
If this setting is disabled or not configured, SEHOP is not enforced for 32-bit processes.
</string>
<string id="Pol_SecGuide_PrintDriver">Limits print driver installation to Administrators</string>
<string id="Pol_SecGuide_PrintDriver_Help">
Determines whether users that aren't Administrator can install print drivers on this computer.
By default, users that aren't Administrators can't install print drivers on this computer.
If you enable this setting or do not configure it, the system will limit installation of print drivers to Administrators of this computer.
If you disable this setting, the system will not limit installation of print drivers to this computer.
Additional Information: https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7 for additional information.
</string>
<string id="Pol_SecGuide_SMBv1Server">Configure SMB v1 server</string>
<string id="Pol_SecGuide_SMBv1Server_Help">Disabling this setting disables server-side processing of the SMBv1 protocol. (Recommended.)
Enabling this setting enables server-side processing of the SMBv1 protocol. (Default.)
Changes to this setting require a reboot to take effect.
For more information, see https://support.microsoft.com/kb/2696547
</string>
<string id="Pol_SecGuide_SMBv1ClientDriver">Configure SMB v1 client driver</string>
<string id="Pol_SecGuide_SMBv1ClientDriver_Help">Configures the SMB v1 client driver's start type.
To disable client-side processing of the SMBv1 protocol, select the "Enabled" radio button, then select "Disable driver" from the dropdown.
WARNING: DO NOT SELECT THE "DISABLED" RADIO BUTTON UNDER ANY CIRCUMSTANCES!
For Windows 7 and Servers 2008, 2008R2, and 2012, you must also configure the "Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)" setting.
To restore default SMBv1 client-side behavior, select "Enabled" and choose the correct default from the dropdown:
* "Manual start" for Windows 7 and Windows Servers 2008, 2008R2, and 2012;
* "Automatic start" for Windows 8.1 and Windows Server 2012R2 and newer.
Changes to this setting require a reboot to take effect.
For more information, see https://support.microsoft.com/kb/2696547
</string>
<string id="Pol_SecGuide_SMBv1ClientLMWkstaDepends">Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)</string>
<string id="Pol_SecGuide_SMBv1ClientLMWkstaDepends_Help">APPLIES ONLY TO: Windows 7 and Windows Servers 2008, 2008R2 and 2012 (NOT 2012R2):
To disable client-side processing of the SMBv1 protocol (recommended), do ALL of the following:
* Set the SMBv1 client driver to "Disable driver" using the "Configure SMB v1 client driver" setting;
* Enable this setting;
* In the "Configure LanmanWorkstation dependencies" text box, enter the following three lines of text:
Bowser
MRxSmb20
NSI
To restore the default behavior for client-side SMBv1 protocol processing, do ALL of the following:
* Set the SMBv1 client driver to "Manual start" using the "Configure SMB v1 client driver" setting;
* Enable this setting;
* In the "Configure LanmanWorkstation dependencies" text box, enter the following four lines of text:
Bowser
MRxSmb10
MRxSmb20
NSI
WARNING: DO NOT SELECT THE "DISABLED" RADIO BUTTON UNDER ANY CIRCUMSTANCES!
Changes to this setting require a reboot to take effect.
For more information, see https://support.microsoft.com/kb/2696547
</string>
<string id="SMB1DriverDisable">Disable driver (recommended)</string>
<string id="SMB1DriverManualStart">Manual start (default for Win7/2008/2008R2/2012)</string>
<string id="SMB1DriverAutomaticStart">Automatic start (default for Win8.1/2012R2/newer)</string>
<!-- NetBT NodeTYpe -->
<string id="Pol_SecGuide_NetbtNodeTypeCfg">NetBT NodeType configuration</string>
<string id="Pol_SecGuide_NetbtNodeTypeCfg_Help">The NetBT NodeType setting determines what methods NetBT uses to register and resolve names:
* A B-node computer uses broadcasts.
* A P-node computer uses only point-to-point name queries to a name server (WINS).
* An M-node computer broadcasts first, and then queries the name server.
* An H-node computer queries the name server first, and then broadcasts.
Resolution through LMHOSTS or DNS follows these methods. If the NodeType value is present, it overrides any DhcpNodeType value.
If neither NodeType nor DhcpNodeType is present, the computer uses B-node if there are no WINS servers configured for the network, or H-node if there is at least one WINS server configured.
</string>
<string id="NetBtNodeTypeB">B-node</string>
<string id="NetBtNodeTypeP">P-node (recommended)</string>
<string id="NetBtNodeTypeM">M-node</string>
<string id="NetBtNodeTypeH">H-node</string>
<!-- LdapEnforceChannelBinding -->
<string id="Pol_SecGuide_LdapEnforceChannelBinding">Extended Protection for LDAP Authentication (Domain Controllers only) (DEPRECATED)</string>
<string id="Pol_SecGuide_LdapEnforceChannelBinding_Help">Beginning with the Windows 10 and Windows Server v2004 security baseline this setting has been moved to Security Options\Domain controller: LDAP server channel binding token requirements.
</string>
<string id="LdapEnforce_Always">Enabled, always (recommended)</string>
<string id="LdapEnforce_WhenSupported">Enabled, when supported</string>
<string id="LdapEnforce_Disabled">Disabled</string>
<string id="Pol_SecGuide_Block_Flash">Block Flash activation in Office documents</string>
<string id="Pol_SecGuide_Block_Flash_Help">This policy setting controls whether the Adobe Flash control can be activated by Office documents. Note that activation blocking applies only within Office processes.
If you enable this policy setting, you can choose from three options to control whether and how Flash is blocked from activation:
1. "Block all activation" prevents the Flash control from being loaded, whether directly referenced by the document or indirectly by another embedded object.
2. "Block embedding/linking, allow other activation" prevents the Flash control from being loaded when directly referenced by the document, but does not prevent activation through another object.
3. "Allow all activation" restores Office's default behavior, allowing the Flash control to be activated.
Because this setting is not a true Group Policy setting and "tattoos" the registry, enabling the "Allow all activation" option is the only way to restore default behavior after either of the "Block" options has been applied. We do not recommend configuring this setting to "Disabled," nor to "Not Configured" after it has been enabled.
</string>
<string id="BlockFlash_BlockActivation">Block all activation</string>
<string id="BlockFlash_BlockEmbedded">Block embedding/linking, allow other activation</string>
<string id="BlockFlash_AllowAll">Allow all activation</string>
<string id="Pol_SecGuide_Legacy_JScript">Restrict legacy JScript execution for Office</string>
<string id="Pol_SecGuide_Legacy_JScript_Help">This policy setting controls JScript execution per Security Zone within Internet Explorer and WebBrowser Control (WebOC) for Office applications.
It's important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting.
If Enabled, Office applications will not execute legacy JScript for the Internet or Restricted Sites zones and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones.
If Disabled or Not Configured JScript will function without any restrictions.
The values are set in hexadecimal and should be converted prior to changing the setting value. To learn more about Internet Explorer Feature Control Key and the Restrict JScript process-level policy for Windows, please refer to: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330734(v=vs.85)#restrict-jscript-at-a-process-level </string>
</stringTable>
<presentationTable>
<presentation id="Pol_SecGuide_SMBv1ClientDriver">
<dropdownList refId="Pol_SecGuide_SMB1ClientDriver" noSort="true" defaultItem="0">Configure MrxSmb10 driver</dropdownList>
</presentation>
<presentation id="Pol_SecGuide_SMBv1ClientWin7">
<multiTextBox refId="Pol_SecGuide_SMB1Win7LMSDepends">Configure LanmanWorkstation dependencies</multiTextBox>
</presentation>
<presentation id="Pol_SecGuide_NetbtNodeTypeCfg">
<dropdownList refId="Pol_SecGuide_SecGuide_NetbtNodeTypeCfg" noSort="true" defaultItem="0">Configure NetBT NodeType</dropdownList>
</presentation>
<presentation id="Pol_SecGuide_LdapEnforceChannelBinding">
<dropdownList refId="Pol_SecGuide_LdapEnforceChannelBinding" noSort="true" defaultItem="0">Configure LdapEnforceChannelBinding</dropdownList>
</presentation>
<presentation id="Pol_SecGuide_Block_Flash">
<dropdownList refId="Pol_SecGuide_Block_Flash" noSort="true" defaultItem="0">Block Flash player in Office</dropdownList>
</presentation>
<presentation id="Pol_SecGuide_Legacy_JScript">
<decimalTextBox refId="POL_SG_excel" defaultValue="69632"> Excel: </decimalTextBox>
<decimalTextBox refId="POL_SG_mspub" defaultValue="69632"> Publisher: </decimalTextBox>
<decimalTextBox refId="POL_SG_powerpnt" defaultValue="69632"> PowerPoint: </decimalTextBox>
<decimalTextBox refId="POL_SG_onenote" defaultValue="69632"> OneNote: </decimalTextBox>
<decimalTextBox refId="POL_SG_visio" defaultValue="69632"> Visio: </decimalTextBox>
<decimalTextBox refId="POL_SG_winproj" defaultValue="69632"> Project: </decimalTextBox>
<decimalTextBox refId="POL_SG_winword" defaultValue="69632"> Word: </decimalTextBox>
<decimalTextBox refId="POL_SG_outlook" defaultValue="69632"> Outlook: </decimalTextBox>
<decimalTextBox refId="POL_SG_msaccess" defaultValue="69632"> Access: </decimalTextBox>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>