All Computer Network security: Allow Local Not Defined Enabled Added to Member Server baseline Configuration\Windows System to use computer identity to be consistent with client and Settings\Security Settings\Local for NTLM domain controller baselines Servers Policies\Security Options All Computer Network security: Allow Not Defined Disabled Added to Member Server baseline Configuration\Windows LocalSystem NULL session to be consistent with client and Settings\Security Settings\Local fallback domain controller baselines Servers Policies\Security Options All Computer Access this computer from the Users, Authenticated Make consistent with Server Client Configuration\Windows network Users, guidance OS Settings\Security Settings\Local Policies\User Rights Assignment Advanced Auditing The guidance for Windows 8 and Windows Server 2012 recommends Auditing” for many settings where the intent was to specify “No “Not Defined” and to allow customer decisions. In some cases, Auditing” overrode a more secure default. We have tried to fix all those cases “No here. Baseline Policy Path Policy Name Old Value New Value Rationale All Computer Kerberos Authentication No Auditing Not Defined No security value; better to allow OS Configuration\Windows Service customers to decide Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon All Computer Audit Kerberos Service Ticket No Auditing Not Defined No security better to allow OS Configuration\Windows Operations customers to decide Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon
All Servers Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Network security: Allow Local System to use computer identity for NTLM Not Defined Enabled Added to Member Server baseline to be consistent with client and domain controller baselines All Servers Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Network security: Allow LocalSystem NULL session fallback Not Defined Disabled Added to Member Server baseline to be consistent with client and domain controller baselines All Client OS Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment Access this computer from the network Users, Authenticated Users, Make consistent with Server guidance Advanced Auditing The guidance for Windows 8 and Windows Server 2012 recommends “No Auditing” for many settings where the intent was to specify “Not Defined” and to allow customer decisions. In some cases, “No Auditing” overrode a more secure default. We have tried to fix all those cases here. Baseline Policy Path Policy Name Old Value New Value Rationale All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon Kerberos Authentication Service No Auditing Not Defined No security value; better to allow customers to decide All OS Computer Configuration\Windows Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon Audit Kerberos Service Ticket Operations No Auditing Not Defined No security better to allow customers to decide
Recommended%20Security%20Baseline%20Settings.docx