mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
Merged PR 7002: LocalPoliciesSecurityOptions in Policy CSP - added new policies
This commit is contained in:
Maricia Alforque
parent
bba9b0928a
commit
2be1473f34
@ -6,7 +6,7 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: nickbrower
|
author: nickbrower
|
||||||
ms.date: 03/16/2018
|
ms.date: 04/06/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# Policy CSP - LocalPoliciesSecurityOptions
|
# Policy CSP - LocalPoliciesSecurityOptions
|
||||||
@ -51,6 +51,15 @@ ms.date: 03/16/2018
|
|||||||
<dd>
|
<dd>
|
||||||
<a href="#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly">LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly</a>
|
<a href="#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly">LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly</a>
|
||||||
</dd>
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways">LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible">LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges">LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges</a>
|
||||||
|
</dd>
|
||||||
<dd>
|
<dd>
|
||||||
<a href="#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked">LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked</a>
|
<a href="#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked">LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked</a>
|
||||||
</dd>
|
</dd>
|
||||||
@ -117,6 +126,18 @@ ms.date: 03/16/2018
|
|||||||
<dd>
|
<dd>
|
||||||
<a href="#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers">LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers</a>
|
<a href="#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers">LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers</a>
|
||||||
</dd>
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication">LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic">LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic">LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers">LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers</a>
|
||||||
|
</dd>
|
||||||
<dd>
|
<dd>
|
||||||
<a href="#localpoliciessecurityoptions-recoveryconsole-allowautomaticadministrativelogon">LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon</a>
|
<a href="#localpoliciessecurityoptions-recoveryconsole-allowautomaticadministrativelogon">LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon</a>
|
||||||
</dd>
|
</dd>
|
||||||
@ -757,6 +778,220 @@ GP Info:
|
|||||||
|
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways"></a>**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Domain member: Digitally encrypt or sign secure channel data (always)
|
||||||
|
|
||||||
|
This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted.
|
||||||
|
|
||||||
|
When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc.
|
||||||
|
|
||||||
|
This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies:
|
||||||
|
|
||||||
|
Domain member: Digitally encrypt secure channel data (when possible)
|
||||||
|
Domain member: Digitally sign secure channel data (when possible)
|
||||||
|
|
||||||
|
Default: Enabled.
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
|
||||||
|
If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.
|
||||||
|
If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic.
|
||||||
|
Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible"></a>**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Domain member: Digitally encrypt secure channel data (when possible)
|
||||||
|
|
||||||
|
This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates.
|
||||||
|
|
||||||
|
When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc.
|
||||||
|
|
||||||
|
This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption.
|
||||||
|
|
||||||
|
Default: Enabled.
|
||||||
|
|
||||||
|
Important
|
||||||
|
|
||||||
|
There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted.
|
||||||
|
|
||||||
|
Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges"></a>**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Domain member: Disable machine account password changes
|
||||||
|
|
||||||
|
Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days.
|
||||||
|
|
||||||
|
Default: Disabled.
|
||||||
|
|
||||||
|
Notes
|
||||||
|
|
||||||
|
This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions.
|
||||||
|
This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Domain member: Disable machine account password changes*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
<!--Policy-->
|
<!--Policy-->
|
||||||
<a href="" id="localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked"></a>**LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked**
|
<a href="" id="localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked"></a>**LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked**
|
||||||
|
|
||||||
@ -2122,6 +2357,282 @@ GP Info:
|
|||||||
|
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication"></a>**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
|
||||||
|
|
||||||
|
This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured.
|
||||||
|
|
||||||
|
If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication.
|
||||||
|
|
||||||
|
If you do not configure this policy setting, no exceptions will be applied.
|
||||||
|
|
||||||
|
The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic"></a>**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Network security: Restrict NTLM: Audit Incoming NTLM Traffic
|
||||||
|
|
||||||
|
This policy setting allows you to audit incoming NTLM traffic.
|
||||||
|
|
||||||
|
If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic.
|
||||||
|
|
||||||
|
If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option.
|
||||||
|
|
||||||
|
If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option.
|
||||||
|
|
||||||
|
This policy is supported on at least Windows 7 or Windows Server 2008 R2.
|
||||||
|
|
||||||
|
Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Network security: Restrict NTLM: Audit Incoming NTLM Traffic*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic"></a>**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Network security: Restrict NTLM: Incoming NTLM traffic
|
||||||
|
|
||||||
|
This policy setting allows you to deny or allow incoming NTLM traffic.
|
||||||
|
|
||||||
|
If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests.
|
||||||
|
|
||||||
|
If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon.
|
||||||
|
|
||||||
|
If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error.
|
||||||
|
|
||||||
|
This policy is supported on at least Windows 7 or Windows Server 2008 R2.
|
||||||
|
|
||||||
|
Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Network security: Restrict NTLM: Incoming NTLM traffic*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers"></a>**LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
|
||||||
|
|
||||||
|
This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server.
|
||||||
|
|
||||||
|
If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication.
|
||||||
|
|
||||||
|
If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer.
|
||||||
|
|
||||||
|
If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication.
|
||||||
|
|
||||||
|
This policy is supported on at least Windows 7 or Windows Server 2008 R2.
|
||||||
|
|
||||||
|
Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--RegistryMapped-->
|
||||||
|
GP Info:
|
||||||
|
- GP English name: *Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers*
|
||||||
|
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||||
|
|
||||||
|
<!--/RegistryMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
<!--Policy-->
|
<!--Policy-->
|
||||||
<a href="" id="localpoliciessecurityoptions-recoveryconsole-allowautomaticadministrativelogon"></a>**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
|
<a href="" id="localpoliciessecurityoptions-recoveryconsole-allowautomaticadministrativelogon"></a>**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon**
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user