Policy Path Policy Name Old Value New Value Rationale Computer Turn on 64-bit N/A Enabled Increased protection; will break some sites, but applies only Configuration\Administrative tab processes when EPM is enforced Templates\Windows when running in Components\Internet Enhanced Explorer\Internet Control Protected Mode Panel\Advanced Page on 64-bit versions of Windows Computer Don't run N/A Enabled: Disable Enforce the default Configuration\Administrative antimalware Templates\Windows programs against Components\Internet ActiveX controls Explorer\Internet Control Panel\Security Page\Internet Zone Computer Don't run N/A Enabled: Disable (stronger than default; with DoD STIG) Configuration\Administrative antimalware Templates\Windows programs against Components\Internet ActiveX controls Explorer\Internet Control Panel\Security Page\Intranet Zone Computer Don't run N/A Enabled: Disable (stronger than default; with DoD STIG) Configuration\Administrative antimalware Templates\Windows programs against Components\Internet ActiveX controls Explorer\Internet Control Panel\Security Page\Local Machine Zone
Policy Path Policy Name Old Value New Value Rationale Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows N/A Enabled Increased protection; will break some sites, but applies only when EPM is enforced Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable Enforce the default Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable (stronger than default; with DoD STIG) Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone Don't run antimalware programs against ActiveX controls N/A Enabled: Disable (stronger than default; with DoD STIG)
Recommended%20Security%20Baseline%20Settings.docx