All Computer Specify the maximum log file Make consistent with Server OS Client Configuration\Windows size (KB) recommendations and increase OS Components\Event Log diagnostic and forensic abilities. Service\System All Computer Allow indexing of encrypted files Not Disabled Information disclosure; encrypted OS Configuration\Administrative Configured content potentially goes into Templates\Windows unencrypted Components\Search All Computer Configuration\ Account lockout threshold 50 invalid 10 invalid 50 gives attackers too many shots; OS Windows Settings\Security logon logon the 50 most-used passwords will Settings\Account attempts attempts give attackers too many accounts. Policies\Account Lockout Policy Too low a threshold causes accidental lockout from passwords. (Separate blog post describes issues in more detail.) All Computer MSS: (ScreenSaverGracePeriod) 0 Seconds 5 seconds No real security benefit setting it to OS Configuration\Windows The time in seconds before the 0; with DoD STIG. Settings\Security Settings\Local screen saver grace period Policies\Security Options expires (0 Recommended) All Computer Network security: Force logoff Not Enabled Make logoff hours work over the OS Configuration\Windows when logon hours expire Configured network too. Settings\Security Settings\Local Policies\Security Options All Computer User Account Control: Behavior Prompt for Prompt for Make consistent (note that the OS Configuration\Windows of the elevation prompt for consent for consent on actual value for Server 2008 has to Settings\Security administrators in Approval the secure be for consent”, as “Prompt “secure Policies\Security Options Mode desktop desktop” is specified in another binaries option on Server 2008). All Computer User Account Control: Behavior Prompt for Automatically UAC same-desktop elevation is not a OS Configuration\Windows of the elevation prompt for credentials deny security boundary; there are more Settings\Security Settings\Local standard users elevation secure ways to administer a system. Policies\Security Options requests
All Client OS Computer Configuration\Windows Components\Event Log Service\System Specify the maximum log file size (KB) Make consistent with Server OS recommendations and increase diagnostic and forensic abilities. All OS Computer Configuration\Administrative Templates\Windows Components\Search Allow indexing of encrypted files Not Configured Disabled Information disclosure; encrypted content potentially goes into unencrypted All OS Computer Configuration\ Windows Settings\Security Settings\Account Policies\Account Lockout Policy Account lockout threshold 50 invalid logon attempts 10 invalid logon attempts 50 gives attackers too many shots; the 50 most-used passwords will give attackers too many accounts. Too low a threshold causes accidental lockout from passwords. (Separate blog post describes issues in more detail.) All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 Recommended) 0 Seconds 5 seconds No real security benefit setting it to 0; with DoD STIG. All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Network security: Force logoff when logon hours expire Not Configured Enabled Make logoff hours work over the network too. All OS Computer Configuration\Windows Settings\Security Policies\Security Options User Account Control: Behavior of the elevation prompt for administrators in Approval Mode Prompt for consent for binaries Prompt for consent on the secure desktop Make consistent (note that the actual value for Server 2008 has to be “Prompt for consent”, as “secure desktop” is specified in another option on Server 2008). All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options User Account Control: Behavior of the elevation prompt for standard users Prompt for credentials Automatically deny elevation requests UAC same-desktop elevation is not a security boundary; there are more secure ways to administer a system.