Computer Include command line in process creation events N/A Not Configured Enable only when Configuration\Administrative needed; otherwise it Templates\System\Audit Process provides an attacker Creation with admin rights a lot of data, potentially including passwords (e.g., from a NET USE command line). Computer Do not display network selection UI N/A Enabled Unauthenticated Configuration\Administrative user should not be Templates\System\Logon able to switch networks. (Tampering) Computer Allow Microsoft accounts to be optional N/A Enabled Enterprises have to Configuration\Administrative be able to enable Templates\Windows app use without Components\App runtime tying to an MSA or automatically uploading data to SkyDrive. Computer Sign-in last interactive user automatically after a system-initiated N/A Disabled Requires Windows to Configuration\Administrative restart retain Templates\Windows Components\Windows Logon credentials during Options session
Computer Configuration\Administrative Templates\System\Audit Process Creation Include command line in process creation events N/A Not Configured Enable only when needed; otherwise it provides an attacker with admin rights a lot of data, potentially including passwords (e.g., from a NET USE command line). Computer Configuration\Administrative Templates\System\Logon Do not display network selection UI N/A Enabled Unauthenticated user should not be able to switch networks. (Tampering) Computer Configuration\Administrative Templates\Windows Components\App runtime Allow Microsoft accounts to be optional N/A Enabled Enterprises have to be able to enable app use without tying to an MSA or automatically uploading data to SkyDrive. Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options Sign-in last interactive user automatically after a system-initiated restart N/A Disabled Requires Windows to retain credentials during session
Recommended%20Security%20Baseline%20Settings.docx