All Computer Other Privilege Use Events No Auditing Not Defined No security value; better to allow OS Configuration\Windows customers to decide Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use All Computer Audit Other System Events No Auditing Success and Auditing” was probably a “No OS Configuration\Windows Failure mistaken entry here. Settings\Advanced Audit Policy Configuration\Audit Policies\System Removed Windows Recommendations This section lists settings that we believe should be removed from the Windows recommendations. In many cases, they provide little or no security value. In other cases, the settings are no longer applicable. Baseline Policy Path Policy Name Old Value New Rationale All Computer System Enabled Not Limited security breaks many legitimate use cases; SSL 3.0 OS Configuration\Windows cryptography: Defined and earlier can be disabled through other means. Discussed in Settings\Security Use FIPS more detail here: Settings\Local compliant Policies\Security Options algorithms for encryption, hashing, and signing All Computer Interactive Enabled Not No security value OS Configuration\Windows logon: Require Defined Settings\Security Domain Settings\Local Controller Policies\Security Options authentication to unlock workstation
All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use Other Privilege Use Events No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\System Audit Other System Events No Auditing Success and Failure “No Auditing” was probably a mistaken entry here. Removed Windows Recommendations This section lists settings that we believe should be removed from the Windows recommendations. In many cases, they provide little or no security value. In other cases, the settings are no longer applicable. Baseline Policy Path Policy Name Old Value New Rationale All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Enabled Not Defined Limited security breaks many legitimate use cases; SSL 3.0 and earlier can be disabled through other means. Discussed in more detail here: All OS Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Require Domain Controller authentication to unlock workstation Enabled Not Defined No security value
Recommended%20Security%20Baseline%20Settings.docx