#### [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md)
#### [Document the Group Policy structure and AppLocker rule enforcement](document-group-policy-structure-and-applocker-rule-enforcement.md)
### [Plan for AppLocker policy management](plan-for-applocker-policy-management.md)
#### [Document your application control management processes](document-your-application-control-management-processes.md)
### [Create your AppLocker planning document](create-your-applocker-planning-document.md)
@ -19,8 +19,8 @@ Learn more about how to help protect against threats in Windows10 and Windows
|[Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md)|Provides info about Windows Defender Advanced Threat Protection (Windows Defender ATP), an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.|
|[Windows Defender Antivirus in Windows 10](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)|Provides info about Windows Defender Antivirus, a built-in antimalware solution that helps provide security and antimalware management for desktops, portable computers, and servers. Includes a list of system requirements and new features.|
|[Windows Defender Application Guard](windows-defender-application-guard/wd-app-guard-overview.md)|Provides info about Windows Defender Application Guard, the hardware-based virtualization solution that helps to isolate a device and operating system from an untrusted browser session.|
|[Windows Defender Application Control](enable-virtualization-based-protection-of-code-integrity.md)|Explains how Windows Defender Application Control restricts the applications that users are allowed to run and the code that runs in the System Core (kernel).|
|[Enable HVCI](windows-defender-application-control.md)|Explains how to enable HVCI to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.|
|[Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md)|Explains how Windows Defender Application Control restricts the applications that users are allowed to run and the code that runs in the System Core (kernel).|
|[Enable HVCI](enable-virtualization-based-protection-of-code-integrity.md)|Explains how to enable HVCI to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.|
|[Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) |Learn more about Windows Defender SmartScreen.|
|[Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) |Learn more about mitigating threats in Windows 10.|
|[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies.|
#### [Specify the cloud-delivered protection level](specify-cloud-protection-level-windows-defender-antivirus.md)
#### [Configure and validate network connections](configure-network-connections-windows-defender-antivirus.md)
#### [Enable the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md)
#### [Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md)
### [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)
#### [Detect and block Potentially Unwanted Applications](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
#### [Enable and configure always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
### [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md)
#### [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
#### [Prevent users from seeing or interacting with the user interface](prevent-end-user-interaction-windows-defender-antivirus.md)
#### [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
## [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
### [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
#### [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
#### [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
#### [Configure exclusions in Windows Defender AV on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md)
### [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
### [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md)
### [Run and review the results of a Windows Defender Offline scan](windows-defender-offline.md)
## [Review event logs and error codes to troubleshoot issues](troubleshoot-windows-defender-antivirus.md)
## [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)
### [Use Group Policy settings to configure and manage Windows Defender AV](use-group-policy-windows-defender-antivirus.md)
### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](use-intune-config-manager-windows-defender-antivirus.md)
### [Use PowerShell cmdlets to configure and manage Windows Defender AV](use-powershell-cmdlets-windows-defender-antivirus.md)
### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](use-wmi-windows-defender-antivirus.md)
### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](command-line-arguments-windows-defender-antivirus.md)
### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
### [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
#### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune)
### [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)
### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
### [Introduction to Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
### [Requirements and deployment planning guidelines for Device Guard](device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md)
### [Planning and getting started on the Device Guard deployment process](device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md)
#### [Optional: Create a code signing certificate for WDAC](device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md)
#### [Deploy WDAC: policy rules and file rules](device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
#### [Steps to deploy WDAC](device-guard/steps-to-deploy-windows-defender-application-control.md)
#### [Deploy catalog files to support WDAC](device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md)
#### [Deploy Managed Installer for Device Guard](device-guard/deploy-managed-installer-for-device-guard.md)
### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen\windows-defender-smartscreen-available-settings.md)
### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen\windows-defender-smartscreen-set-individual-device.md)
###[System requirements for Windows Defender Application Guard](windows-defender-application-guard\reqs-wd-app-guard.md)
###[Prepare and install Windows Defender Application Guard](windows-defender-application-guard\install-wd-app-guard.md)
###[Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard\configure-wd-app-guard.md)
###[Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard\test-scenarios-wd-app-guard.md)
###[Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard\faq-wd-app-guard.md)
## [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md)
## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md)
## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md)
## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md)
##### [Which editions of Windows support advanced audit policy configuration](auditing\which-editions-of-windows-support-advanced-audit-policy-configuration.md)
#### [Using advanced security auditing options to monitor dynamic access control objects](auditing\using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
##### [Monitor the central access policies that apply on a file server](auditing\monitor-the-central-access-policies-that-apply-on-a-file-server.md)
##### [Monitor the use of removable storage devices](auditing\monitor-the-use-of-removable-storage-devices.md)
##### [Monitor central access policy and rule definitions](auditing\monitor-central-access-policy-and-rule-definitions.md)
##### [Monitor user and device claims during sign-in](auditing\monitor-user-and-device-claims-during-sign-in.md)
##### [Monitor the resource attributes on files and folders](auditing\monitor-the-resource-attributes-on-files-and-folders.md)
##### [Monitor the central access policies associated with files and folders](auditing\monitor-the-central-access-policies-associated-with-files-and-folders.md)
###### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](auditing\event-5031.md)
###### [Event 5150: The Windows Filtering Platform blocked a packet.](auditing\event-5150.md)
###### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing\event-5151.md)
###### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](auditing\event-5154.md)
###### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](auditing\event-5155.md)
###### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](auditing\event-5156.md)
###### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](auditing\event-5157.md)
###### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](auditing\event-5158.md)
###### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](auditing\event-5159.md)
###### [Event 4656 S, F: A handle to an object was requested.](auditing\event-4656.md)
###### [Event 4658 S: The handle to an object was closed.](auditing\event-4658.md)
###### [Event 4660 S: An object was deleted.](auditing\event-4660.md)
###### [Event 4663 S: An attempt was made to access an object.](auditing\event-4663.md)
##### [Audit Other Object Access Events](auditing\audit-other-object-access-events.md)
###### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](auditing\event-4671.md)
###### [Event 4691 S: Indirect access to an object was requested.](auditing\event-4691.md)
###### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](auditing\event-5148.md)
###### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](auditing\event-5149.md)
###### [Event 4698 S: A scheduled task was created.](auditing\event-4698.md)
###### [Event 4699 S: A scheduled task was deleted.](auditing\event-4699.md)
###### [Event 4700 S: A scheduled task was enabled.](auditing\event-4700.md)
###### [Event 4701 S: A scheduled task was disabled.](auditing\event-4701.md)
###### [Event 4702 S: A scheduled task was updated.](auditing\event-4702.md)
###### [Event 5888 S: An object in the COM+ Catalog was modified.](auditing\event-5888.md)
###### [Event 5889 S: An object was deleted from the COM+ Catalog.](auditing\event-5889.md)
###### [Event 5890 S: An object was added to the COM+ Catalog.](auditing\event-5890.md)
###### [Event 4661 S, F: A handle to an object was requested.](auditing\event-4661.md)
##### [Audit Central Access Policy Staging](auditing\audit-central-access-policy-staging.md)
###### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](auditing\event-4818.md)
###### [Event 4944 S: The following policy was active when the Windows Firewall started.](auditing\event-4944.md)
###### [Event 4945 S: A rule was listed when the Windows Firewall started.](auditing\event-4945.md)
###### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](auditing\event-4946.md)
###### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](auditing\event-4947.md)
###### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](auditing\event-4948.md)
###### [Event 4949 S: Windows Firewall settings were restored to the default values.](auditing\event-4949.md)
###### [Event 4950 S: A Windows Firewall setting has changed.](auditing\event-4950.md)
###### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](auditing\event-4951.md)
###### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](auditing\event-4952.md)
###### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](auditing\event-4953.md)
###### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](auditing\event-4954.md)
###### [Event 4956 S: Windows Firewall has changed the active profile.](auditing\event-4956.md)
###### [Event 4957 F: Windows Firewall did not apply the following rule.](auditing\event-4957.md)
###### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](auditing\event-4958.md)
##### [Audit Other Policy Change Events](auditing\audit-other-policy-change-events.md)
###### [Event 4714 S: Encrypted data recovery policy was changed.](auditing\event-4714.md)
###### [Event 4819 S: Central Access Policies on the machine have been changed.](auditing\event-4819.md)
###### [Event 4826 S: Boot Configuration Data loaded.](auditing\event-4826.md)
###### [Event 4909: The local policy settings for the TBS were changed.](auditing\event-4909.md)
###### [Event 4910: The group policy settings for the TBS were changed.](auditing\event-4910.md)
###### [Event 5063 S, F: A cryptographic provider operation was attempted.](auditing\event-5063.md)
###### [Event 5064 S, F: A cryptographic context operation was attempted.](auditing\event-5064.md)
###### [Event 5065 S, F: A cryptographic context modification was attempted.](auditing\event-5065.md)
###### [Event 5066 S, F: A cryptographic function operation was attempted.](auditing\event-5066.md)
###### [Event 5067 S, F: A cryptographic function modification was attempted.](auditing\event-5067.md)
###### [Event 5068 S, F: A cryptographic function provider operation was attempted.](auditing\event-5068.md)
###### [Event 5069 S, F: A cryptographic function property operation was attempted.](auditing\event-5069.md)
###### [Event 5070 S, F: A cryptographic function property modification was attempted.](auditing\event-5070.md)
###### [Event 5447 S: A Windows Filtering Platform filter has been changed.](auditing\event-5447.md)
###### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](auditing\event-6144.md)
###### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](auditing\event-6145.md)
##### [Audit Other System Events](auditing\audit-other-system-events.md)
###### [Event 5024 S: The Windows Firewall Service has started successfully.](auditing\event-5024.md)
###### [Event 5025 S: The Windows Firewall Service has been stopped.](auditing\event-5025.md)
###### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](auditing\event-5027.md)
###### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](auditing\event-5028.md)
###### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](auditing\event-5029.md)
###### [Event 5030 F: The Windows Firewall Service failed to start.](auditing\event-5030.md)
###### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](auditing\event-5032.md)
###### [Event 5033 S: The Windows Firewall Driver has started successfully.](auditing\event-5033.md)
###### [Event 5034 S: The Windows Firewall Driver was stopped.](auditing\event-5034.md)
###### [Event 5035 F: The Windows Firewall Driver failed to start.](auditing\event-5035.md)
###### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](auditing\event-5037.md)
###### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](auditing\event-6400.md)
###### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](auditing\event-6401.md)
###### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](auditing\event-6402.md)
###### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](auditing\event-6403.md)
###### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](auditing\event-6404.md)
###### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](auditing\event-6405.md)
###### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](auditing\event-6406.md)
###### [Event 6407: 1%.](auditing\event-6407.md)
###### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](auditing\event-6408.md)
###### [Event 6409: BranchCache: A service connection point object could not be parsed.](auditing\event-6409.md)
##### [Audit Security State Change](auditing\audit-security-state-change.md)
###### [Event 4608 S: Windows is starting up.](auditing\event-4608.md)
###### [Event 4616 S: The system time was changed.](auditing\event-4616.md)
###### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](auditing\event-4621.md)
##### [Audit Security System Extension](auditing\audit-security-system-extension.md)
###### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](auditing\event-4610.md)
###### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](auditing\event-4611.md)
###### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](auditing\event-4614.md)
###### [Event 4622 S: A security package has been loaded by the Local Security Authority.](auditing\event-4622.md)
###### [Event 4697 S: A service was installed in the system.](auditing\event-4697.md)
##### [Audit System Integrity](auditing\audit-system-integrity.md)
###### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](auditing\event-4612.md)
###### [Event 4615 S: Invalid use of LPC port.](auditing\event-4615.md)
###### [Event 4618 S: A monitored security event pattern has occurred.](auditing\event-4618.md)
###### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](auditing\event-4816.md)
###### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](auditing\event-5038.md)
###### [Event 5056 S: A cryptographic self-test was performed.](auditing\event-5056.md)
###### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](auditing\event-5062.md)
###### [Event 5057 F: A cryptographic primitive operation failed.](auditing\event-5057.md)
###### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing\event-1108.md)
##### [Appendix A: Security monitoring recommendations for many audit events](auditing\appendix-a-security-monitoring-recommendations-for-many-audit-events.md)
##### [Accounts: Limit local account use of blank passwords to console logon only](security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md)
##### [Audit: Audit the access of global system objects](security-policy-settings/audit-audit-the-access-of-global-system-objects.md)
##### [Audit: Audit the use of Backup and Restore privilege](security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md)
##### [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md)
##### [Audit: Shut down system immediately if unable to log security audits](security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md)
##### [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)
##### [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md)
##### [Devices: Allow undock without having to log on](security-policy-settings/devices-allow-undock-without-having-to-log-on.md)
##### [Devices: Allowed to format and eject removable media](security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md)
##### [Devices: Prevent users from installing printer drivers](security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md)
##### [Devices: Restrict CD-ROM access to locally logged-on user only](security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md)
##### [Devices: Restrict floppy access to locally logged-on user only](security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md)
##### [Domain controller: Allow server operators to schedule tasks](security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md)
##### [Domain controller: LDAP server signing requirements](security-policy-settings/domain-controller-ldap-server-signing-requirements.md)
##### [Interactive logon: Display user information when the session is locked](security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md)
##### [Interactive logon: Don't display last signed-in](security-policy-settings/interactive-logon-do-not-display-last-user-name.md)
##### [Interactive logon: Don't display username at sign-in](security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md)
##### [Interactive logon: Do not require CTRL+ALT+DEL](security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md)
##### [Interactive logon: Message text for users attempting to log on](security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md)
##### [Interactive logon: Message title for users attempting to log on](security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md)
##### [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md)
##### [Interactive logon: Prompt user to change password before expiration](security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md)
##### [Interactive logon: Require Domain Controller authentication to unlock workstation](security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md)
##### [Microsoft network server: Amount of idle time required before suspending session](security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md)
##### [Microsoft network server: Attempt S4U2Self to obtain claim information](security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md)
##### [Microsoft network server: Disconnect clients when logon hours expire](security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md)
##### [Microsoft network server: Server SPN target name validation level](security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md)
##### [Network access: Do not allow anonymous enumeration of SAM accounts](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md)
##### [Network access: Do not allow anonymous enumeration of SAM accounts and shares](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md)
##### [Network access: Do not allow storage of passwords and credentials for network authentication](security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md)
##### [Network access: Let Everyone permissions apply to anonymous users](security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md)
##### [Network access: Named Pipes that can be accessed anonymously](security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md)
##### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md)
##### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md)
##### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md)
##### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md)
##### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md)
##### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md)
##### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md)
##### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md)
##### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md)
##### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md)
##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md)
##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md)
##### [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md)
##### [Network security: Restrict NTLM: Add server exceptions in this domain](security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md)
##### [Network security: Restrict NTLM: NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md)
##### [Recovery console: Allow floppy copy and access to all drives and folders](security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md)
##### [Shutdown: Allow system to be shut down without having to log on](security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md)
##### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md)
##### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md)
##### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md)
##### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md)
##### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md)
##### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md)
##### [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md)
##### [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md)
##### [User Account Control: Behavior of the elevation prompt for standard users](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md)
##### [User Account Control: Detect application installations and prompt for elevation](security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md)
##### [User Account Control: Only elevate executables that are signed and validated](security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md)
##### [User Account Control: Only elevate UIAccess applications that are installed in secure locations](security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md)
##### [User Account Control: Run all administrators in Admin Approval Mode](security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md)
##### [User Account Control: Switch to the secure desktop when prompting for elevation](security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md)
##### [User Account Control: Virtualize file and registry write failures to per-user locations](security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md)
##### [Deny access to this computer from the network](security-policy-settings/deny-access-to-this-computer-from-the-network.md)
##### [Deny log on as a batch job](security-policy-settings/deny-log-on-as-a-batch-job.md)
##### [Deny log on as a service](security-policy-settings/deny-log-on-as-a-service.md)
##### [Deny log on locally](security-policy-settings/deny-log-on-locally.md)
##### [Deny log on through Remote Desktop Services](security-policy-settings/deny-log-on-through-remote-desktop-services.md)
##### [Enable computer and user accounts to be trusted for delegation](security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)
##### [Force shutdown from a remote system](security-policy-settings/force-shutdown-from-a-remote-system.md)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Justin Hall