Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

MSFT Windows Server 2025 v2506 - Member Server
Data collected on: 6/20/2025 5:24:52 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 12/5/2024 8:46:52 PM
Modified | 6/5/2025 12:01:46 PM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 83 (AD), 83 (SYSVOL)
Unique ID | {66D20891-6858-43DF-B3F6-CC7BE11C7EC1}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/User Rights Assignment

Policy | Setting
--- | ---
Access Credential Manager as a trusted caller |
Access this computer from the network | NT AUTHORITY\Authenticated Users, BUILTIN\Administrators
Act as part of the operating system |
Allow log on locally | BUILTIN\Administrators
Back up files and directories | BUILTIN\Administrators
Create a pagefile | BUILTIN\Administrators
Create a token object |
Create global objects | NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\SERVICE, BUILTIN\Administrators
Create permanent shared objects |
Debug programs | BUILTIN\Administrators
Deny access to this computer from the network | NT AUTHORITY\Local account and member of Administrators group, BUILTIN\Guests
Deny log on through Terminal Services | NT AUTHORITY\Local account and member of Administrators group, BUILTIN\Guests
Enable computer and user accounts to be trusted for delegation |
Force shutdown from a remote system | BUILTIN\Administrators
Impersonate a client after authentication | NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\SERVICE, BUILTIN\Administrators
Load and unload device drivers | BUILTIN\Administrators
Lock pages in memory |
Manage auditing and security log | BUILTIN\Administrators
Modify firmware environment values | BUILTIN\Administrators
Perform volume maintenance tasks | BUILTIN\Administrators
Profile single process | BUILTIN\Administrators
Restore files and directories | BUILTIN\Administrators
Take ownership of files or other objects | BUILTIN\Administrators

Local Policies/Security Options
Accounts

Policy | Setting
--- | ---
Accounts: Limit local account use of blank passwords to console logon only | Enabled

Interactive Logon

Policy | Setting
--- | ---
Interactive logon: Smart card removal behavior | Lock Workstation

Microsoft Network Client

Policy | Setting
--- | ---
Microsoft network client: Digitally sign communications (always) | Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled

Network Access

Policy | Setting
--- | ---
Network access: Allow anonymous SID/Name translation | Disabled
Network access: Do not allow anonymous enumeration of SAM accounts | Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled
Network access: Restrict anonymous access to Named Pipes and Shares | Enabled

Network Security

Policy | Setting
--- | ---
Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirements | Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled

System Objects

Policy | Setting
--- | ---
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Enabled

User Account Control

Policy | Setting
--- | ---
User Account Control: Admin Approval Mode for the Built-in Administrator account | Enabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent on the secure desktop
User Account Control: Behavior of the elevation prompt for standard users | Automatically deny elevation requests
User Account Control: Detect application installations and prompt for elevation | Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled
User Account Control: Run all administrators in Admin Approval Mode | Enabled
User Account Control: Virtualize file and registry write failures to per-user locations | Enabled

Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled
Domain member: Digitally encrypt or sign secure channel data (always) | Enabled
Domain member: Digitally encrypt secure channel data (when possible) | Enabled
Domain member: Digitally sign secure channel data (when possible) | Enabled
Domain member: Require strong (Windows 2000 or later) session key | Enabled
Interactive logon: Machine inactivity limit | 900 seconds
Microsoft network server: Digitally sign communications (always) | Enabled
Network access: Restrict clients allowed to make remote calls to SAM | "O:BAG:BAD:(A;;RC;;;BA)"
Network security: Allow LocalSystem NULL session fallback | Disabled

Windows Firewall with Advanced Security
Global Settings

Policy | Setting
--- | ---
Policy version | 2.33
Disable stateful FTP | Not Configured
Disable stateful PPTP | Not Configured
IPsec exempt | Not Configured
IPsec through NAT | Not Configured
Preshared key encoding | Not Configured
SA idle time | Not Configured
Strong CRL check | Not Configured

Domain Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Private Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Public Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | No
Allow unicast responses | Not Configured
Log dropped packets | Yes
Log successful connections | Yes
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Connection Security Settings
Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Success, Failure

Account Management

Policy | Setting
--- | ---
Audit Security Group Management | Success
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit PNP Activity | Success
Audit Process Creation | Success

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Failure
Audit Group Membership | Success
Audit Logon | Success, Failure
Audit Other Logon/Logoff Events | Success, Failure
Audit Special Logon | Success

Object Access

Policy | Setting
--- | ---
Audit Detailed File Share | Failure
Audit File Share | Success, Failure
Audit Other Object Access Events | Success, Failure
Audit Removable Storage | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success, Failure
Audit Authentication Policy Change | Success
Audit Authorization Policy Change | Success
Audit MPSSVC Rule-Level Policy Change | Success, Failure
Audit Other Policy Change Events | Failure

Privilege Use

Policy | Setting
--- | ---
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit Other System Events | Success, Failure
Audit Security State Change | Success
Audit Security System Extension | Success
Audit System Integrity | Success, Failure

Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Control Panel/Personalization

Policy | Setting | Comment
--- | --- | ---
Prevent enabling lock screen camera | Enabled |
Prevent enabling lock screen slide show | Enabled |

MS Security Guide

Policy | Setting | Comment
--- | --- | ---
Apply UAC restrictions to local accounts on network logons | Enabled |
Configure SMB v1 client driver | Enabled |
Configure MrxSmb10 driver | Disable driver (recommended)
Policy | Setting | Comment
Configure SMB v1 server | Disabled |
Enable Structured Exception Handling Overwrite Protection (SEHOP) | Enabled |
NetBT NodeType configuration | Enabled |
Configure NetBT NodeType | P-node (recommended)

MSS (Legacy)

Policy | Setting | Comment
--- | --- | ---
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRoutingIPv6 | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRouting | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled |
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Enabled |

Network/DNS Client

Policy | Setting | Comment
--- | --- | ---
Configure NetBIOS settings | Enabled |
Configure NetBIOS options: | Disable NetBIOS name resolution
Policy | Setting | Comment
Turn off multicast name resolution | Enabled |

Network/Lanman Server

Policy | Setting | Comment
--- | --- | ---
Audit client does not support encryption | Enabled |
Audit client does not support signing | Enabled |
Audit insecure guest logon | Enabled |
Enable authentication rate limiter | Enabled |
Enable remote mailslots | Disabled |
Mandate the minimum version of SMB | Enabled |
Select SMB version:
Version: | SMB 3.0.0
Policy | Setting | Comment
Set authentication rate limiter delay (milliseconds) | Enabled |
Value (milliseconds): | 2000

Network/Lanman Workstation

Policy | Setting | Comment
--- | --- | ---
Audit insecure guest logon | Enabled |
Audit server does not support encryption | Enabled |
Audit server does not support signing | Enabled |
Enable insecure guest logons | Disabled |
Enable remote mailslots | Disabled |
Mandate the minimum version of SMB | Enabled |
Select SMB version:
Version: | SMB 3.0.0

Network/Network Connections/Windows Defender Firewall/Domain Profile

Policy | Setting | Comment
--- | --- | ---
Windows Defender Firewall: Allow logging | Enabled |
Log dropped packets | Enabled
Log successful connections | Enabled
Log file path and name: |
Size limit (KB): |
Policy | Setting | Comment
Windows Defender Firewall: Prohibit notifications | Enabled |
Windows Defender Firewall: Protect all network connections | Enabled |

Network/Network Provider

Policy | Setting | Comment
--- | --- | ---
Hardened UNC Paths | Enabled |
Specify hardened network paths. In the name field, type a fully-qualified UNC path for each network resource. To secure all access to a share with a particular name, regardless of the server name, specify a server name of '*' (asterisk). For example, "\\*\NETLOGON". To secure all access to all shares hosted on a server, the share name portion of the UNC path may be omitted. For example, "\\SERVER". In the value field, specify one or more of the following options, separated by commas: 'RequireMutualAuthentication=1': Mutual authentication between the client and server is required to ensure the client connects to the correct server. 'RequireIntegrity=1': Communication between the client and server must employ an integrity mechanism to prevent data tampering. 'RequirePrivacy=1': Communication between the client and the server must be encrypted to prevent third parties from observing sensitive data.
Hardened UNC Paths: |
--- | ---
\\*\SYSVOL | RequireMutualAuthentication=1,RequireIntegrity=1
\\*\NETLOGON | RequireMutualAuthentication=1,RequireIntegrity=1
You should require both Integrity and Mutual Authentication for any UNC paths that host executable programs, script files, or files that control security policies. Consider hosting files that do not require Integrity or Privacy on separate shares from those that absolutely need such security for optimal performance. For additional details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Printers

Policy | Setting | Comment
--- | --- | ---
Configure RPC listener settings | Enabled |
Configure protocol options for incoming RPC connections.
Protocols to allow for incoming RPC connections: | RPC over TCP
Authentication protocol to use for incoming RPC connections: | Negotiate
Policy | Setting | Comment
Limits print driver installation to Administrators | Enabled |

System/Audit Process Creation

Policy | Setting | Comment
--- | --- | ---
Include command line in process creation events | Enabled |

System/Credentials Delegation

Policy | Setting | Comment
--- | --- | ---
Encryption Oracle Remediation | Enabled |
Protection Level: | Force Updated Clients
Policy | Setting | Comment
Remote host allows delegation of non-exportable credentials | Enabled |

System/Early Launch Antimalware

Policy | Setting | Comment
--- | --- | ---
Boot-Start Driver Initialization Policy | Enabled |
Choose the boot-start drivers that can be initialized: | Good, unknown and bad but critical

System/Group Policy

Policy | Setting | Comment
--- | --- | ---
Configure registry policy processing | Enabled |
Do not apply during periodic background processing | Disabled
Process even if the Group Policy objects have not changed | Enabled

System/KDC

Policy | Setting | Comment
--- | --- | ---
Configure hash algorithms for certificate logon | Enabled |
SHA-1 | Default
SHA-256 | Supported
SHA-384 | Supported
SHA-512 | Supported

System/Kerberos

Policy | Setting | Comment
--- | --- | ---
Configure hash algorithms for certificate logon | Enabled |
SHA-1 | Default
SHA-256 | Supported
SHA-384 | Supported
SHA-512 | Supported

System/Kernel DMA Protection

Policy | Setting | Comment
--- | --- | ---
Enumeration policy for external devices incompatible with Kernel DMA Protection | Enabled |
Enumeration policy | Block all

System/Local Security Authority

Policy | Setting | Comment
--- | --- | ---
Allow Custom SSPs and APs to be loaded into LSASS | Enabled |
Configures LSASS to run as a protected process | Enabled |
Configure LSA to run as a protected process | Enabled with UEFI Lock

System/Logon

Policy | Setting | Comment
--- | --- | ---
Enumerate local users on domain-joined computers | Disabled |

System/Remote Procedure Call

Policy | Setting | Comment
--- | --- | ---
Restrict Unauthenticated RPC clients | Enabled |
RPC Runtime Unauthenticated Client Restriction to Apply: | Authenticated

Windows Components/AutoPlay Policies

Policy | Setting | Comment
--- | --- | ---
Disallow Autoplay for non-volume devices | Enabled |
Set the default behavior for AutoRun | Enabled |
Default AutoRun Behavior | Do not execute any autorun commands
Policy | Setting | Comment
Turn off Autoplay | Enabled |
Turn off Autoplay on: | All drives

Windows Components/Biometrics/Facial Features

Policy | Setting | Comment
--- | --- | ---
Configure enhanced anti-spoofing | Enabled |

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 196608

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Policy | Setting | Comment
--- | --- | ---
Do not allow passwords to be saved | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection

Policy | Setting | Comment
--- | --- | ---
Do not allow drive redirection | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security

Policy | Setting | Comment
--- | --- | ---
Always prompt for password upon connection | Enabled |
Require secure RPC communication | Enabled |
Set client connection encryption level | Enabled |
Encryption Level | High Level
Choose the encryption level from the drop-down list.

Windows Components/RSS Feeds

Policy | Setting | Comment
--- | --- | ---
Prevent downloading of enclosures | Enabled |

Windows Components/Search

Policy | Setting | Comment
--- | --- | ---
Allow indexing of encrypted files | Disabled |

Windows Components/Windows Defender SmartScreen/Explorer

Policy | Setting | Comment
--- | --- | ---
Configure Windows Defender SmartScreen | Enabled |
Pick one of the following settings: | Warn and prevent bypass

Windows Components/Windows Installer

Policy | Setting | Comment
--- | --- | ---
Allow user control over installs | Disabled |
Always install with elevated privileges | Disabled |

Windows Components/Windows Logon Options

Policy | Setting | Comment
--- | --- | ---
Sign-in and lock last interactive user automatically after a restart | Disabled |

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on PowerShell Script Block Logging | Enabled |
Log script block invocation start / stop events: | Disabled

Windows Components/Windows Remote Management (WinRM)/WinRM Client

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow Digest authentication | Enabled |

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow WinRM from storing RunAs credentials | Enabled |

User Configuration (Disabled)
No settings defined.