All Windows Computer Firefox FilePublisherRule: Deny Block web browsers on DCs Server Configuration\Windows Everyone “Domain Controller” Settings\Security PublisherName="O=MOZILLA baselines Settings\Application Control CORPORATION, Policies\AppLocker\Executable L=MOUNTAIN VIEW, S=CA, Rules C=US" ProductName="FIREFOX" BinaryName="FIREFOX.EXE" All Windows Computer Default rules Allow non-admins to run Block web browsers on DCs Server Configuration\Windows executables in Program Files “Domain Controller” Settings\Security Allow non-admins to run baselines Settings\Application Control executables in Windir Policies\AppLocker\Executable Allow admins to run executables Rules anywhere All Windows Computer Application Service startup mode = AppLocker requires AppIDSvc to be Server Configuration\Windows Identity Automatic running to enforce rules “Domain Controller” Settings\Security (AppIDSvc) baselines Settings\System Services EMET We recommend installing EMET on all workstations and servers, along with these Group Policy settings: Baseline Policy Path Policy Name Old Value New Value Rationale All Computer Default Protections N/A Enabled EMET protections OS Configuration\Administrative for Internet Explorer Templates\Windows Components\EMET All Computer Default Protections N/A Enabled EMET protections OS Configuration\Administrative for Popular Software Templates\Windows Components\EMET
All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Executable Rules Firefox FilePublisherRule: Deny Everyone PublisherName="O=MOZILLA CORPORATION, L=MOUNTAIN VIEW, S=CA, C=US" ProductName="FIREFOX" BinaryName="FIREFOX.EXE" Block web browsers on DCs All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Executable Rules Default rules Allow non-admins to run executables in Program Files Allow non-admins to run executables in Windir Allow admins to run executables anywhere Block web browsers on DCs All Windows Server “Domain Controller” baselines Computer Configuration\Windows Settings\Security Settings\System Services Application Identity (AppIDSvc) Service startup mode = Automatic AppLocker requires AppIDSvc to be running to enforce rules EMET We recommend installing EMET on all workstations and servers, along with these Group Policy settings: Baseline Policy Path Policy Name Old Value New Value Rationale All OS Computer Configuration\Administrative Templates\Windows Components\EMET Default Protections for Internet Explorer N/A Enabled EMET protections All OS Computer Configuration\Administrative Templates\Windows Components\EMET Default Protections for Popular Software N/A Enabled EMET protections
Recommended%20Security%20Baseline%20Settings.docx