mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 12:23:37 +00:00
Merge branch 'master' into v-smandalika-5694287-B2
This commit is contained in:
Siddarth Mandalika
@ -38,13 +38,13 @@ For information about setting up Delivery Optimization, including tips for the b
|
||||
|
||||
## New in Windows 10, version 20H2 and Windows 11
|
||||
|
||||
- New peer selection options: Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)."
|
||||
- New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)."
|
||||
- Local Peer Discovery: a new option for **Restrict Peer Selection By** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If you also enabled Group mode, Delivery Optimization will connect to locally discovered peers that are also part of the same group (that is, those which have the same Group ID).
|
||||
|
||||
> [!NOTE]
|
||||
> The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference).
|
||||
> The Local Peer Discovery (DNS-SD, [RFC 6763](https://datatracker.ietf.org/doc/html/rfc6763)) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference).
|
||||
|
||||
- Starting with Windows 10, version 2006 (and in Windows 11), the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used.
|
||||
- Starting with Windows 11, the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used.
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -93,7 +93,7 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
|
||||
|
||||
|
||||
In Windows client Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
|
||||
In Windows client Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT (which includes either Ethernet or WiFi), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
|
||||
|
||||
For more information, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md).
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.date: 08/17/2017
|
||||
ms.date: 01/24/2022
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for
|
||||
Failure occurred in ‘LogonUserExEx’. <br>
|
||||
User Action: Ensure the credentials for the task are correctly specified. <br>
|
||||
Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)."
|
||||
- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. For example:
|
||||
- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4525 with error 0xC0000064 on the machine itself. For example:
|
||||
> Log Name: Microsoft-Windows-NTLM/Operational
|
||||
Source: Microsoft-Windows-Security-Netlogon
|
||||
Event ID: 8004
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: dansimp
|
||||
ms.date: 09/07/2021
|
||||
ms.date: 01/24/2022
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
@ -25,7 +25,8 @@ ms.technology: windows-sec
|
||||
|
||||
This event generates every time a new process starts.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [Note]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
@ -96,7 +97,8 @@ This event generates every time a new process starts.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the "create process" operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [Note]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the "create process" operation.
|
||||
|
||||
@ -116,11 +118,13 @@ This event generates every time a new process starts.
|
||||
|
||||
**Target Subject** \[Version 2\]**:**
|
||||
|
||||
> **Note** This event includes the principal of the process creator, but this is not always sufficient if the target context is different from the creator context. In that situation, the subject specified in the process termination event does not match the subject in the process creation event even though both events refer to the same process ID. Therefore, in addition to including the creator of the process, we will also include the target principal when the creator and target do not share the same logon.
|
||||
> [Note]
|
||||
> This event includes the principal of the process creator, but this is not always sufficient if the target context is different from the creator context. In that situation, the subject specified in the process termination event does not match the subject in the process creation event even though both events refer to the same process ID. Therefore, in addition to including the creator of the process, we will also include the target principal when the creator and target do not share the same logon.
|
||||
|
||||
- **Security ID** \[Type = SID\] \[Version 2\]**:** SID of target account. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [Note]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\] \[Version 2\]**:** the name of the target account.
|
||||
|
||||
|
||||
@ -35,11 +35,11 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from
|
||||
|
||||
- Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download.
|
||||
|
||||
- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
|
||||
- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 11, Windows 10, and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
|
||||
|
||||
## System requirements
|
||||
|
||||
Safety Scanner helps remove malicious software from computers running Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. Please refer to the [Microsoft Lifecycle Policy](/lifecycle/).
|
||||
Safety Scanner helps remove malicious software from computers running Windows 11, Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. For details, refer to the [Microsoft Lifecycle Policy](/lifecycle/).
|
||||
|
||||
## How to run a scan
|
||||
|
||||
|
||||
@ -29,22 +29,18 @@ You can choose to hide the section from users of the machine. This can be useful
|
||||
|
||||
## Hide the Device security section
|
||||
|
||||
You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app.
|
||||
You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. You can hide the device security section by using Group Policy only.
|
||||
|
||||
This can only be done in Group Policy.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>### Requirements
|
||||
>
|
||||
>You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
> [!IMPORTANT]
|
||||
> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Security > Device security**.
|
||||
3. Expand the tree to **Windows components** > **Windows Security** > **Device security**.
|
||||
|
||||
4. Open the **Hide the Device security area** setting and set it to **Enabled**. Click **OK**.
|
||||
4. Open the **Hide the Device security area** setting and set it to **Enabled**. Select **OK**.
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
|
||||
@ -56,18 +52,16 @@ This can only be done in Group Policy.
|
||||
## Disable the Clear TPM button
|
||||
If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>### Requirements
|
||||
>
|
||||
>You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
> [!IMPORTANT]
|
||||
> You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Security > Device security**.
|
||||
3. Expand the tree to **Windows components** > **Windows Security** > **Device security**.
|
||||
|
||||
4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Click **OK**.
|
||||
4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Select **OK**.
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
|
||||
@ -76,23 +70,25 @@ If you don't want users to see the recommendation to update TPM firmware, you ca
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Security > Device security**.
|
||||
3. Expand the tree to **Windows components** > **Windows Security** > **Device security**.
|
||||
|
||||
4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Click **OK**.
|
||||
4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Select **OK**.
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
|
||||
## Disable Memory integrity switch
|
||||
If you don't want users to be able to change the Hypervisor Control Integrity (HVCI), or memory integrity, setting on their computers, you can disable the **Memory integrity** switch.
|
||||
> [!IMPORTANT]
|
||||
> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Security > Device security**.
|
||||
3. Expand the tree to **Windows components** > **Windows Security** > **Device security**.
|
||||
|
||||
4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Click **OK**.
|
||||
4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Select **OK**.
|
||||
|
||||
5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get support for Windows security baselines
|
||||
description: Find answers to frequently asked question on how to get support for Windows baselines, the Security Compliance Toolkit (SCT), and related topics.
|
||||
title: Get support for security baselines
|
||||
description: Find answers to frequently asked question on how to get support for baselines, the Security Compliance Toolkit (SCT), and related topics.
|
||||
keywords: virtualization, security, malware
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
@ -11,7 +11,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 06/25/2018
|
||||
ms.date: 01/24/2022
|
||||
ms.reviewer:
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
@ -96,9 +96,6 @@ Windows Server 2008 R2 |[SP1](/previous-versions/tn-archive/gg236605(v=technet.1
|
||||
|
||||
<br />
|
||||
|
||||
> [!NOTE]
|
||||
> Browser baselines are built-in to new OS versions starting with Windows 10
|
||||
|
||||
## See also
|
||||
|
||||
[Windows security baselines](windows-security-baselines.md)
|
||||
@ -11,8 +11,8 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 11/26/2018
|
||||
ms.reviewer:
|
||||
ms.date: 01/24/2022
|
||||
ms.reviewer: rmunck
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
@ -30,27 +30,26 @@ The Security Compliance Toolkit consists of:
|
||||
- Windows 11 security baseline
|
||||
|
||||
- Windows 10 security baselines
|
||||
- Windows 10 Version 1909 (November 2019 Update)
|
||||
- Windows 10 Version 1903 (April 2019 Update)
|
||||
- Windows 10 Version 1809 (October 2018 Update)
|
||||
- Windows 10 Version 1803 (April 2018 Update)
|
||||
- Windows 10 Version 1709 (Fall Creators Update)
|
||||
- Windows 10 Version 1703 (Creators Update)
|
||||
- Windows 10 Version 1607 (Anniversary Update)
|
||||
- Windows 10 Version 1511 (November Update)
|
||||
- Windows 10 Version 21H2
|
||||
- Windows 10 Version 21H1
|
||||
- Windows 10 Version 20H2
|
||||
- Windows 10 Version 1909
|
||||
- Windows 10 Version 1809
|
||||
- Windows 10 Version 1607
|
||||
- Windows 10 Version 1507
|
||||
|
||||
- Windows Server security baselines
|
||||
- Windows Server 2022
|
||||
- Windows Server 2019
|
||||
- Windows Server 2016
|
||||
- Windows Server 2012 R2
|
||||
|
||||
- Microsoft Office security baseline
|
||||
- Office 365 Pro Plus
|
||||
- Microsoft 365 Apps for Enterprise Version 2112
|
||||
- Office 2016
|
||||
|
||||
- Microsoft Edge security baseline
|
||||
- Edge Browser Version 93
|
||||
- Edge Browser Version 97
|
||||
|
||||
- Tools
|
||||
- Policy Analyzer tool
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows security baselines guide
|
||||
description: Learn how to use Windows security baselines in your organization. Specific to Windows 10, Windows Server 2016, and Office 2016.
|
||||
title: Security baselines guide
|
||||
description: Learn how to use security baselines in your organization.
|
||||
keywords: virtualization, security, malware
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
@ -11,17 +11,17 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date:
|
||||
ms.reviewer:
|
||||
ms.date: 01/24/2022
|
||||
ms.reviewer: jmunck
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
# Windows security baselines
|
||||
# Security baselines
|
||||
|
||||
|
||||
## Using security baselines in your organization
|
||||
|
||||
Microsoft is dedicated to providing its customers with secure operating systems, such as Windows and Windows Server, and secure apps, such as Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control over your environments by providing various configuration capabilities.
|
||||
Microsoft is dedicated to providing its customers with secure operating systems, such as Windows and Windows Server, and secure apps, such as Microsoft 365 apps for enterprise and Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control over your environments by providing various configuration capabilities.
|
||||
|
||||
Even though Windows and Windows Server are designed to be secure out-of-the-box, many organizations still want more granular control over their security configurations. To navigate the large number of controls, organizations need guidance on configuring various security features. Microsoft provides this guidance in the form of security baselines.
|
||||
|
||||
@ -41,7 +41,15 @@ Security baselines are an essential benefit to customers because they bring toge
|
||||
|
||||
For example, there are over 3,000 Group Policy settings for Windows 10, which does not include over 1,800 Internet Explorer 11 settings. Of these 4,800 settings, only some are security-related. Although Microsoft provides extensive guidance on different security features, exploring each one can take a long time. You would have to determine the security impact of each setting on your own. Then, you would still need to determine the appropriate value for each setting.
|
||||
|
||||
In modern organizations, the security threat landscape is constantly evolving, and IT pros and policy-makers must keep up with security threats and make required changes to Windows security settings to help mitigate these threats. To enable faster deployments and make managing Windows easier, Microsoft provides customers with security baselines that are available in consumable formats, such as Group Policy Objects Backups.
|
||||
In modern organizations, the security threat landscape is constantly evolving, and IT pros and policy-makers must keep up with security threats and make required changes to security settings to help mitigate these threats. To enable faster deployments and make managing Microsoft products easier, Microsoft provides customers with security baselines that are available in consumable formats, such as Group Policy Objects Backups.
|
||||
|
||||
## Baseline principles
|
||||
Our recommendations follow a streamlined and efficient approach to baseline definitions. The foundation of that approach is essentially:
|
||||
- The baselines are designed for well-managed, security-conscious organizations in which standard end users do not have administrative rights.
|
||||
- A baseline enforces a setting only if it mitigates a contemporary security threat and does not cause operational issues that are worse than the risks they mitigate.
|
||||
- A baseline enforces a default only if it is otherwise likely to be set to an insecure state by an authorized user:
|
||||
- If a non-administrator can set an insecure state, enforce the default.
|
||||
- If setting an insecure state requires administrative rights, enforce the default only if it is likely that a misinformed administrator will otherwise choose poorly.
|
||||
|
||||
## How can you use security baselines?
|
||||
|
||||
|
||||
Reference in New Issue
Block a user