{ "verifiedOn": "2026-09-06", "sources": { "registry": "https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-windows", "privileges": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment", "passwords": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/0b40db09-d95d-40a6-8467-32aedec8140c", "asr": "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview", "maester": "https://maester.dev/docs/tests/maester/", "pingcastle": "https://www.pingcastle.com/PingCastleFiles/ad_hc_rules_list.html" }, "registryTargets": [ "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\PUAProtection", "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection", "Software\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware", "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring", "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan\\DisableEmailScanning", "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScriptScanning", "SOFTWARE\\Policies\\Microsoft\\InputPersonalization\\AllowInputPersonalization", "SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\DependOnService", "SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential", "System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\DisableIPSourceRouting", "System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\DisableIPSourceRouting", "System\\CurrentControlSet\\Services\\Netbt\\Parameters\\NoNameReleaseOnDemand", "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode", "SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Security\\WarningLevel", "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\EnableICMPRedirect", "SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\AllowInsecureGuestAuth", "SOFTWARE\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy\\fMinimizeConnections", "SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\\NC_AllowNetBridge_NLA", "SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\\NC_ShowSharedAccessUI", "SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnableCdp", "SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnumerateLocalUsers", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit\\ProcessCreationIncludeCmdLine_Enabled", "SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata\\PreventDeviceMetadataFromNetwork", "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection", "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoConnectedUser", "SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SignSecureChannel", "SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange", "System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\MaximumPasswordAge", "SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireStrongKey", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\CachedLogonsCount", "SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableForcedLogoff", "System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\SMBServerNameHardeningLevel", "SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1", "SYSTEM\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM", "SYSTEM\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\SupportedEncryptionTypes", "SYSTEM\\CurrentControlSet\\Control\\Lsa\\NoLMHash", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableInstallerDetection", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableSecureUIAPaths", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableVirtualization", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging\\LogFilePath", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging\\LogFileSize", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\DefaultOutboundAction", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\AllowLocalIPsecPolicyMerge", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\AllowLocalPolicyMerge", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\DisableNotifications", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\\LogFilePath", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\\LogFileSize", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\DefaultOutboundAction", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\AllowLocalIPsecPolicyMerge", "SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\AllowLocalPolicyMerge", "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fPromptForPassword", "SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Application\\Retention", "SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Application\\MaxSize", "SOFTWARE\\Policies\\Microsoft\\MicrosoftAccount\\DisableUserAuth", "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\LocalSettingOverrideSpynetReporting", "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fEncryptRPCTraffic", "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\UserAuthentication", "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan\\DisableRemovableDriveScanning", "SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Security\\Retention", "SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Security\\MaxSize", "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\\DisableWindowsConsumerFeatures", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\PreXPSP2ShellProtocolBehavior", "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring", "SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging" ], "privilegeIds": [ "SeTrustedCredManAccessPrivilege", "SeNetworkLogonRight", "SeTcbPrivilege", "SeMachineAccountPrivilege", "SeIncreaseQuotaPrivilege", "SeInteractiveLogonRight", "SeRemoteInteractiveLogonRight", "SeBackupPrivilege", "SeChangeNotifyPrivilege", "SeSystemtimePrivilege", "SeTimeZonePrivilege", "SeCreatePagefilePrivilege", "SeCreateTokenPrivilege", "SeCreateGlobalPrivilege", "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeDebugPrivilege", "SeDenyNetworkLogonRight", "SeDenyBatchLogonRight", "SeDenyServiceLogonRight", "SeDenyInteractiveLogonRight", "SeDenyRemoteInteractiveLogonRight", "SeEnableDelegationPrivilege", "SeRemoteShutdownPrivilege", "SeAuditPrivilege", "SeImpersonatePrivilege", "SeIncreaseWorkingSetPrivilege", "SeIncreaseBasePriorityPrivilege", "SeLoadDriverPrivilege", "SeLockMemoryPrivilege", "SeBatchLogonRight", "SeServiceLogonRight", "SeSecurityPrivilege", "SeRelabelPrivilege", "SeSystemEnvironmentPrivilege", "SeDelegateSessionUserImpersonatePrivilege", "SeManageVolumePrivilege", "SeProfileSingleProcessPrivilege", "SeSystemProfilePrivilege", "SeUndockPrivilege", "SeAssignPrimaryTokenPrivilege", "SeRestorePrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege", "SeTakeOwnershipPrivilege" ], "maesterIds": [ "CISA.MS.EXO.17.3", "MT.1001", "MT.1002", "MT.1003", "MT.1004", "MT.1005", "MT.1006", "MT.1007", "MT.1008", "MT.1009", "MT.1010", "MT.1011", "MT.1012", "MT.1013", "MT.1014", "MT.1015", "MT.1016", "MT.1017", "MT.1018", "MT.1019", "MT.1020", "MT.1022", "MT.1023", "MT.1025", "MT.1026", "MT.1027", "MT.1028", "MT.1029", "MT.1030", "MT.1031", "MT.1033", "MT.1034", "MT.1035", "MT.1036", "MT.1037", "MT.1038", "MT.1041", "MT.1042", "MT.1043", "MT.1044", "MT.1045", "MT.1047", "MT.1048", "MT.1049", "MT.1050", "MT.1051", "MT.1052", "MT.1054", "MT.1055", "MT.1056", "MT.1057", "MT.1058", "MT.1059", "MT.1061", "MT.1062", "MT.1063", "MT.1064", "MT.1065", "MT.1066", "MT.1067", "MT.1068", "MT.1069", "MT.1070", "MT.1071", "MT.1072", "MT.1073", "MT.1074", "MT.1075", "MT.1076", "MT.1077", "MT.1078", "MT.1079", "MT.1080", "MT.1081", "MT.1083", "MT.1084", "MT.1085", "MT.1086", "MT.1087", "MT.1088", "MT.1089", "MT.1090", "MT.1091", "MT.1092", "MT.1093", "MT.1094", "MT.1095", "MT.1096", "MT.1097", "MT.1098", "MT.1099", "MT.1100", "MT.1101", "MT.1102", "MT.1103", "MT.1105", "MT.1106", "MT.1107", "MT.1108", "MT.1109", "MT.1110", "MT.1111", "MT.1112", "MT.1113", "MT.1114", "MT.1115", "MT.1116", "MT.1117", "MT.1118", "MT.1119", "MT.1120", "MT.1121", "MT.1122", "MT.1123", "MT.1147", "MT.1148", "MT.1149", "MT.1150", "MT.1151", "MT.1152", "MT.1153", "MT.1154", "MT.1155", "MT.1156", "MT.1157", "MT.1158", "MT.1159", "MT.1160", "MT.1161", "MT.1162", "MT.1163", "MT.1164", "MT.1165", "MT.1166", "MT.1167", "MT.1168", "MT.1169", "MT.1170", "MT.1171", "MT.1172", "MT.1173", "MT.1174", "MT.1175", "MT.1176", "MT.1177", "MT.1178", "MT.1179", "MT.1180", "MT.1182", "MT.1183", "MT.1184", "MT.1185", "MT.1186", "MT.1187", "MT.1188", "MT.1189", "MT.1190", "MT.1191", "MT.1192", "MT.1193", "MT.1194", "MT.1195" ], "pingcastleIds": [ "A-AdminSDHolder", "A-AnonymousAuthorizedGPO", "A-AuditDC", "A-AuditPowershell", "A-BackupMetadata", "A-CertEnrollChannelBinding", "A-CertEnrollHttp", "A-CertROCA", "A-CertTempAgent", "A-CertTempAnyone", "A-CertTempAnyPurpose", "A-CertTempCustomSubject", "A-CertTempNoSecurity", "A-CertWeakDSA", "A-CertWeakRsaComponent", "A-DC-Coerce", "A-DC-Spooler", "A-DC-WebClient", "A-DCLdapsChannelBinding", "A-DCLdapSign", "A-DCLdapsProtocol", "A-DCLdapsProtocolAdvanced", "A-DCRefuseComputerPwdChange", "A-DnsZoneAUCreateChild", "A-DnsZoneTransfert", "A-DnsZoneUpdate1", "A-DnsZoneUpdate2", "A-DsHeuristicsAllowAnonNSPI", "A-DsHeuristicsAnonymous", "A-DsHeuristicsDoNotVerifyUniqueness", "A-DsHeuristicsLDAPSecurity", "A-Guest", "A-HardenedPaths", "A-Krbtgt", "A-LAPS-Joined-Computers", "A-LAPS-Not-Installed", "A-LDAPSigningDisabled", "A-LimitBlankPasswordUse", "A-LMHashAuthorized", "A-MD2IntermediateCert", "A-MD2RootCert", "A-MD4IntermediateCert", "A-MD4RootCert", "A-MD5IntermediateCert", "A-MD5RootCert", "A-MembershipEveryone", "A-MinPwdLen", "A-NoGPOLLMNR", "A-NoNetSessionHardening", "A-NoServicePolicy", "A-NotEnoughDC", "A-NTFRSOnSysvol", "A-NullSession", "A-PreWin2000Anonymous", "A-PreWin2000AuthenticatedUsers", "A-PreWin2000Other", "A-ProtectedUsers", "A-PwdGPO", "A-ReversiblePwd", "A-RootDseAnonBinding", "A-SHA0IntermediateCert", "A-SHA0RootCert", "A-SHA1IntermediateCert", "A-SHA1RootCert", "A-SmartCardPwdRotation", "A-SmartCardRequired", "A-SMB2SignatureNotEnabled", "A-SMB2SignatureNotRequired", "A-UnixPwd", "A-WeakRSARootCert", "A-WeakRSARootCert2", "A-WSUS-SslProtocol", "P-AdminEmailOn", "P-AdminLogin", "P-AdminNum", "P-AdminPwdTooOld", "P-ControlPathIndirectEveryone", "P-ControlPathIndirectMany", "P-DangerousExtendedRight", "P-DCOwner", "P-Delegated", "P-DelegationDCa2d2", "P-DelegationDCsourcedeleg", "P-DelegationDCt2a4d", "P-DelegationEveryone", "P-DelegationFileDeployed", "P-DelegationGPOData", "P-DelegationKeyAdmin", "P-DelegationLoginScript", "P-DisplaySpecifier", "P-DNSAdmin", "P-DNSDelegation", "P-DsHeuristicsAdminSDExMask", "P-DsHeuristicsDoListObject", "P-ExchangeAdminSDHolder", "P-ExchangePrivEsc", "P-Inactive", "P-Kerberoasting", "P-LoginDCEveryone", "P-LogonDenied", "P-OperatorsEmpty", "P-PrivilegeEveryone", "P-ProtectedUsers", "P-RecoveryModeUnprotected", "P-RecycleBin", "P-RODCAdminRevealed", "P-RODCAllowedGroup", "P-RODCDeniedGroup", "P-RODCKrbtgtOrphan", "P-RODCNeverReveal", "P-RODCRevealOnDemand", "P-RODCSYSVOLWrite", "P-SchemaAdmin", "P-ServiceDomainAdmin", "P-TrustedCredManAccessPrivilege", "P-UnconstrainedDelegation", "P-UnkownDelegation", "P-UnprotectedOU", "S-ADRegistration", "S-ADRegistrationSchema", "S-AesNotEnabled", "S-C-Inactive", "S-C-PrimaryGroup", "S-C-Reversible", "S-DC-2000", "S-DC-2003", "S-DC-2008", "S-DC-2012", "S-DC-Inactive", "S-DC-NotUpdated", "S-DC-SubnetMissing", "S-DCRegistration", "S-DefaultOUChanged", "S-DefenderASR", "S-DesEnabled", "S-Duplicate", "S-FirewallScript", "S-FolderOptions", "S-FunctionalLevel1", "S-FunctionalLevel3", "S-FunctionalLevel4", "S-Inactive", "S-JavaSchema", "S-KerberosArmoring", "S-KerberosArmoringDC", "S-NoPreAuth", "S-NoPreAuthAdmin", "S-OldNtlm", "S-OS-2000", "S-OS-2003", "S-OS-2008", "S-OS-2012", "S-OS-NT", "S-OS-Vista", "S-OS-W10", "S-OS-Win7", "S-OS-Win8", "S-OS-XP", "S-PrimaryGroup", "S-PwdLastSet-45", "S-PwdLastSet-90", "S-PwdLastSet-Cluster", "S-PwdLastSet-DC", "S-PwdNeverExpires", "S-PwdNotRequired", "S-Reversible", "S-SIDHistory", "S-SMB-v1", "S-TerminalServicesGPO", "S-Vuln-MS14-068", "S-Vuln-MS17_010", "S-WSUS-HTTP", "S-WSUS-NoPinning", "S-WSUS-UserProxy", "T-AlgsAES", "T-AzureADSSO", "T-Downlevel", "T-FileDeployedOutOfDomain", "T-Inactive", "T-ScriptOutOfDomain", "T-SIDFiltering", "T-SIDHistoryDangerous", "T-SIDHistorySameDomain", "T-SIDHistoryUnknownDomain", "T-TGTDelegation" ], "asrIds": [ "56a863a9-875e-4185-98a7-b882c64b5ce5", "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", "e6db77e5-3df2-4cf1-b95a-636979351e5b", "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", "d4f940ab-401b-4efc-aadc-ad5f3c50688a", "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550", "01443614-cd74-433a-b99e-2ecdc07bfc25", "5beb7efe-fd9a-4556-801d-275e5ffc04cc", "d3e037e1-3eb8-44c8-a917-57927947596d", "3b576869-a4ec-4529-8536-b80a7769e899", "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", "26190899-1602-49e8-8b27-eb1d0a1ce869", "d1e49aac-8f56-4280-b9ba-993a6d77406c", "33ddedf1-c6e0-47cb-833e-de6133960387", "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4", "c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb", "a8f5898e-1dc8-49a9-9878-85004b8a61e6", "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b", "c1db55ab-c21a-4637-bb3f-a12568109d35" ] }