mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
Html to md table conversion - batch 26
This commit is contained in:
Alekhya Jupudi
@ -139,53 +139,16 @@ For details about the HelpAssistant account attributes, see the following table.
|
||||
|
||||
**HelpAssistant account attributes**
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Attribute</th>
|
||||
<th>Value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-13 (Terminal Server User), S-1-5-<domain>-14 (Remote Interactive Logon)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>User</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
<td><p>CN=Users, DC=<domain>, DC=</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Default members</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p>Domain Guests</p>
|
||||
<p>Guests</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
<td><p>No</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Safe to move out of default container?</p></td>
|
||||
<td><p>Can be moved out, but we do not recommend it.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Safe to delegate management of this group to non-Service admins?</p></td>
|
||||
<td><p>No</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Attribute|Value|
|
||||
|--- |--- |
|
||||
|Well-Known SID/RID|S-1-5-<domain>-13 (Terminal Server User), S-1-5-<domain>-14 (Remote Interactive Logon)|
|
||||
|Type|User|
|
||||
|Default container|CN=Users, DC=<domain>, DC=|
|
||||
|Default members|None|
|
||||
|Default member of|Domain Guests<p>Guests|
|
||||
|Protected by ADMINSDHOLDER?|No|
|
||||
|Safe to move out of default container?|Can be moved out, but we do not recommend it.|
|
||||
|Safe to delegate management of this group to non-Service admins?|No|
|
||||
|
||||
### DefaultAccount
|
||||
|
||||
@ -290,71 +253,18 @@ For more information about UAC, see [User Account Control](/windows/access-prote
|
||||
|
||||
The following table shows the Group Policy and registry settings that are used to enforce local account restrictions for remote access.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><b>No.</b></p></td>
|
||||
<td><p><b>Setting</b></p></td>
|
||||
<td><p><b>Detailed Description</b></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy location</p></td>
|
||||
<td><p>Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>1</p></td>
|
||||
<td><p>Policy name</p></td>
|
||||
<td><p><a href="/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode" data-raw-source="[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)">User Account Control: Run all administrators in Admin Approval Mode</a></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy setting</p></td>
|
||||
<td><p>Enabled</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>2</p></td>
|
||||
<td><p>Policy location</p></td>
|
||||
<td><p>Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy name</p></td>
|
||||
<td><p><a href="/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode" data-raw-source="[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)">User Account Control: Run all administrators in Admin Approval Mode</a></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy setting</p></td>
|
||||
<td><p>Enabled</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>3</p></td>
|
||||
<td><p>Registry key</p></td>
|
||||
<td><p><b>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</b></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p></p></td>
|
||||
<td><p>Registry value name</p></td>
|
||||
<td><p>LocalAccountTokenFilterPolicy</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Registry value type</p></td>
|
||||
<td><p>DWORD</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p></p></td>
|
||||
<td><p>Registry value data</p></td>
|
||||
<td><p>0</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|No.|Setting|Detailed Description|
|
||||
|--- |--- |--- |
|
||||
||Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options|
|
||||
|1|Policy name|[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)|
|
||||
||Policy setting|Enabled|
|
||||
|2|Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options|
|
||||
||Policy name|[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)|
|
||||
||Policy setting|Enabled|
|
||||
|3|Registry key|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|
|
||||
||Registry value name|LocalAccountTokenFilterPolicy|
|
||||
||Registry value type|DWORD|
|
||||
||Registry value data|0|
|
||||
|
||||
>[!NOTE]
|
||||
>You can also enforce the default for LocalAccountTokenFilterPolicy by using the custom ADMX in Security Templates.
|
||||
@ -437,54 +347,14 @@ In order to perform this procedure, you must first identify the name of the loca
|
||||
|
||||
The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><b>No.</b></p></td>
|
||||
<td><p><b>Setting</b></p></td>
|
||||
<td><p><b>Detailed Description</b></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy location</p></td>
|
||||
<td><p>Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>1</p></td>
|
||||
<td><p>Policy name</p></td>
|
||||
<td><p><a href="/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network" data-raw-source="[Deny access to this computer from the network](/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network)">Deny access to this computer from the network</a></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy setting</p></td>
|
||||
<td><p>Local account and member of Administrators group</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>2</p></td>
|
||||
<td><p>Policy location</p></td>
|
||||
<td><p>Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy name</p></td>
|
||||
<td><p><a href="/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services" data-raw-source="[Deny log on through Remote Desktop Services](/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services)">Deny log on through Remote Desktop Services</a></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p></p></td>
|
||||
<td><p>Policy setting</p></td>
|
||||
<td><p>Local account and member of Administrators group</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|No.|Setting|Detailed Description|
|
||||
|--- |--- |--- |
|
||||
||Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment|
|
||||
|1|Policy name|[Deny access to this computer from the network](/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network)|
|
||||
||Policy setting|Local account and member of Administrators group|
|
||||
|2|Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment|
|
||||
||Policy name|[Deny log on through Remote Desktop Services](/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services)|
|
||||
||Policy setting|Local account and member of Administrators group|
|
||||
|
||||
**To deny network logon to all local administrator accounts**
|
||||
|
||||
|
||||
@ -41,151 +41,32 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
> [!NOTE]
|
||||
> Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2">Policy</th>
|
||||
<th>Scope</th>
|
||||
<th>Options</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use Windows Hello for Business</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
<p><b>Enabled</b>: Device provisions Windows Hello for Business using keys or certificates for all users.</p>
|
||||
<p><b>Disabled</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use a hardware security device</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use certificate for on-premises authentication</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<td>Use PIN recovery</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p><b>Not configured</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p>
|
||||
|Policy|Scope|Options|
|
||||
|--- |--- |--- |
|
||||
|Use Windows Hello for Business|Computer or user|<p><b>Not configured</b>: Device does not provision Windows Hello for Business for any user.<p><b>Enabled</b>: Device provisions Windows Hello for Business using keys or certificates for all users.<p><b>Disabled</b>: Device does not provision Windows Hello for Business for any user.|
|
||||
|Use a hardware security device|Computer|<p><b>Not configured</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.<p><b>Disabled</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.|
|
||||
|Use certificate for on-premises authentication|Computer or user|<p><b>Not configured</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.<p><b>Enabled</b>: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.<p><b>Disabled</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.|
|
||||
|Use PIN recovery|Computer|<p>Added in Windows 10, version 1703<p><b>Not configured</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service<p><b>Enabled</b>: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset<p><b>Disabled</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.<p>For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).|
|
||||
|Use biometrics|Computer|<p><b>Not configured</b>: Biometrics can be used as a gesture in place of a PIN<p><b>Enabled</b>: Biometrics can be used as a gesture in place of a PIN.<p><b>Disabled</b>: Only a PIN can be used as a gesture.|
|
||||
|
||||
For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use biometrics</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
<p><b>Enabled</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
<p><b>Disabled</b>: Only a PIN can be used as a gesture.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="8">PIN Complexity</td>
|
||||
<td>Require digits</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users must include a digit in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include a digit in their PIN.</p>
|
||||
<p><b>Disabled</b>: Users cannot use digits in their PIN.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require lowercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot use lowercase letters in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one lowercase letter in their PIN.</p>
|
||||
<p><b>Disabled</b>: Users cannot use lowercase letters in their PIN.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Maximum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be less than or equal to 127.</p>
|
||||
<p><b>Enabled</b>: PIN length must be less than or equal to the number you specify.</p>
|
||||
<p><b>Disabled</b>: PIN length must be less than or equal to 127.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Minimum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be greater than or equal to 4.</p>
|
||||
<p><b>Enabled</b>: PIN length must be greater than or equal to the number you specify.</p>
|
||||
<p><b>Disabled</b>: PIN length must be greater than or equal to 4.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Expiration</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN does not expire.</p>
|
||||
<p><b>Enabled</b>: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.</p>
|
||||
<p><b>Disabled</b>: PIN does not expire.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>History</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Previous PINs are not stored.</p>
|
||||
<p><b>Enabled</b>: Specify the number of previous PINs that can be associated to a user account that can't be reused.</p>
|
||||
<p><b>Disabled</b>: Previous PINs are not stored.</p>
|
||||
<div class="alert"><b>Note</b> Current PIN is included in PIN history.</div>
|
||||
<div> </div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require special characters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include a special character in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one special character in their PIN.</p>
|
||||
<p><b>Disabled</b>: Users cannot include a special character in their PIN.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require uppercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include an uppercase letter in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one uppercase letter in their PIN.</p>
|
||||
<p><b>Disabled</b>: Users cannot include an uppercase letter in their PIN.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Phone Sign-in</td>
|
||||
<td>Use Phone Sign-in</td>
|
||||
<td>Computer</td>
|
||||
</td>
|
||||
<td>
|
||||
<p>Not currently supported.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
### PIN Complexity
|
||||
|
||||
|Policy|Scope|Options|
|
||||
|--- |--- |--- |
|
||||
|Require digits|Computer|<p><b>Not configured</b>: Users must include a digit in their PIN.<p><b>Enabled</b>: Users must include a digit in their PIN.<p><b>Disabled</b>: Users cannot use digits in their PIN.|
|
||||
|Require lowercase letters|Computer|<p><b>Not configured</b>: Users cannot use lowercase letters in their PIN<p><b>Enabled</b>: Users must include at least one lowercase letter in their PIN.<p><b>Disabled</b>: Users cannot use lowercase letters in their PIN.|
|
||||
|Maximum PIN length|Computer|<p><b>Not configured</b>: PIN length must be less than or equal to 127.<p><b>Enabled</b>: PIN length must be less than or equal to the number you specify.<p><b>Disabled</b>: PIN length must be less than or equal to 127.|
|
||||
|Minimum PIN length|Computer|<p><b>Not configured</b>: PIN length must be greater than or equal to 4.<p><b>Enabled</b>: PIN length must be greater than or equal to the number you specify.<p><b>Disabled</b>: PIN length must be greater than or equal to 4.|
|
||||
|Expiration|Computer|<p><b>Not configured</b>: PIN does not expire.<p><b>Enabled</b>: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.<p><b>Disabled</b>: PIN does not expire.|
|
||||
|History|Computer|<p><b>Not configured</b>: Previous PINs are not stored.<p><b>Enabled</b>: Specify the number of previous PINs that can be associated to a user account that can't be reused.<p><b>Disabled</b>: Previous PINs are not stored.<div class="alert"><b>Note</b> Current PIN is included in PIN history.</div>|
|
||||
|Require special characters|Computer|<p><b>Not configured</b>: Users cannot include a special character in their PIN<p><b>Enabled</b>: Users must include at least one special character in their PIN.<p><b>Disabled</b>: Users cannot include a special character in their PIN.|
|
||||
|Require uppercase letters|Computer|<p><b>Not configured</b>: Users cannot include an uppercase letter in their PIN.<p><b>Enabled</b>: Users must include at least one uppercase letter in their PIN.<p><b>Disabled</b>: Users cannot include an uppercase letter in their PIN.|
|
||||
|
||||
### Phone Sign-in
|
||||
|
||||
|Policy|Scope|Options|
|
||||
|--- |--- |--- |
|
||||
|Use Phone Sign-in|Computer|Not currently supported.|
|
||||
|
||||
## MDM policy settings for Windows Hello for Business
|
||||
|
||||
@ -194,175 +75,38 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
>[!IMPORTANT]
|
||||
>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2">Policy</th>
|
||||
<th>Scope</th>
|
||||
<th>Default</th>
|
||||
<th>Options</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>UsePassportForWork</td>
|
||||
<td></td>
|
||||
<td>Device or user</td>
|
||||
<td>True</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will be provisioned for all users on the device.</p>
|
||||
<p>False: Users will not be able to provision Windows Hello for Business. </p>
|
||||
<div class="alert"><b>Note</b> If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.</div>
|
||||
<div> </div>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>RequireSecurityDevice</td>
|
||||
<td></td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will only be provisioned using TPM.</p>
|
||||
<p>False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ExcludeSecurityDevice</td>
|
||||
<td>TPM12</td>
|
||||
<td>Device</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.</p>
|
||||
<p>False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>EnablePinRecovery</td>
|
||||
<td></td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p>False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p>
|
||||
|Policy|Scope|Default|Options|
|
||||
|--- |--- |--- |--- |
|
||||
|UsePassportForWork|Device or user|True|<p>True: Windows Hello for Business will be provisioned for all users on the device.<p>False: Users will not be able to provision Windows Hello for Business. <div class="alert"> **Note:** If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices</div>|
|
||||
|RequireSecurityDevice|Device or user|False|<p>True: Windows Hello for Business will only be provisioned using TPM.<p>False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.|
|
||||
|ExcludeSecurityDevice<p>TPM12|Device|False|Added in Windows 10, version 1703<p>True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.<p>False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.|
|
||||
|EnablePinRecovery|Device or use|False|<p>Added in Windows 10, version 1703<p>True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.<p>False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).|
|
||||
|
||||
For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">Biometrics</td>
|
||||
<td>
|
||||
<p>UseBiometrics</p>
|
||||
</td>
|
||||
<td>Device </td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.</p>
|
||||
<p>False: Only a PIN can be used as a gesture for domain sign-in.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>FacialFeaturesUser</p>
|
||||
<p>EnhancedAntiSpoofing</p>
|
||||
</td>
|
||||
<td>Device</td>
|
||||
<td>Not configured</td>
|
||||
<td>
|
||||
<p>Not configured: users can choose whether to turn on enhanced anti-spoofing.</p>
|
||||
<p>True: Enhanced anti-spoofing is required on devices which support it.</p>
|
||||
<p>False: Users cannot turn on enhanced anti-spoofing.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="9">PINComplexity</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Digits </td>
|
||||
<td>Device or user</td>
|
||||
<td>1 </td>
|
||||
<td>
|
||||
<p>0: Digits are allowed. </p>
|
||||
<p>1: At least one digit is required.</p>
|
||||
<p>2: Digits are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Lowercase letters </td>
|
||||
<td>Device or user</td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>0: Lowercase letters are allowed. </p>
|
||||
<p>1: At least one lowercase letter is required.</p>
|
||||
<p>2: Lowercase letters are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Special characters</td>
|
||||
<td>Device or user</td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>0: Special characters are allowed. </p>
|
||||
<p>1: At least one special character is required. </p>
|
||||
<p>2: Special characters are not allowed.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Uppercase letters</td>
|
||||
<td>Device or user</td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>0: Uppercase letters are allowed. </p>
|
||||
<p>1: At least one uppercase letter is required.</p>
|
||||
<p>2: Uppercase letters are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Maximum PIN length </td>
|
||||
<td>Device or user</td>
|
||||
<td>127 </td>
|
||||
<td>
|
||||
<p>Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Minimum PIN length</td>
|
||||
<td>Device or user</td>
|
||||
<td>4</td>
|
||||
<td>
|
||||
<p>Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Expiration </td>
|
||||
<td>Device or user</td>
|
||||
<td>0</td>
|
||||
<td>
|
||||
<p>Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>History</td>
|
||||
<td>Device or user</td>
|
||||
<td>0</td>
|
||||
<td>
|
||||
<p>Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Remote</td>
|
||||
<td>
|
||||
<p>UseRemotePassport</p>
|
||||
</td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Not currently supported.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
### Biometrics
|
||||
|
||||
|Policy|Scope|Default|Options|
|
||||
|--- |--- |--- |--- |
|
||||
|UseBiometrics|Device |False|<p>True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.<p>False: Only a PIN can be used as a gesture for domain sign-in.|
|
||||
|<p>FacialFeaturesUser<p>EnhancedAntiSpoofing|Device|Not configured|<p>Not configured: users can choose whether to turn on enhanced anti-spoofing.<p>True: Enhanced anti-spoofing is required on devices which support it.<p>False: Users cannot turn on enhanced anti-spoofing.|
|
||||
|
||||
### PINComplexity
|
||||
|
||||
|Policy|Scope|Default|Options|
|
||||
|--- |--- |--- |--- |
|
||||
|Digits |Device or user|1 |<p>0: Digits are allowed. <p>1: At least one digit is required.<p>2: Digits are not allowed.|
|
||||
|Lowercase letters |Device or user|2|<p>0: Lowercase letters are allowed. <p>1: At least one lowercase letter is required.<p>2: Lowercase letters are not allowed.|
|
||||
|Special characters|Device or user|2|<p>0: Special characters are allowed. <p>1: At least one special character is required. <p>2: Special characters are not allowed.|
|
||||
|Uppercase letters|Device or user|2|<p>0: Uppercase letters are allowed. <p>1: At least one uppercase letter is required.<p>2: Uppercase letters are not allowed.|
|
||||
|Maximum PIN length |Device or user|127 |<p>Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.|
|
||||
|Minimum PIN length|Device or user|4|<p>Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.|
|
||||
|Expiration |Device or user|0|<p>Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.|
|
||||
|History|Device or user|0|<p>Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.|
|
||||
|
||||
### Remote
|
||||
|
||||
|Policy|Scope|Default|Options|
|
||||
|--- |--- |--- |--- |
|
||||
|UseRemotePassport|Device or user|False|Not currently supported.|
|
||||
|
||||
>[!NOTE]
|
||||
> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN.
|
||||
|
||||
@ -106,169 +106,35 @@ The following diagram details the UAC architecture.
|
||||
|
||||
To better understand each component, review the table below:
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Component</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<th colspan="2">User</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>User performs operation requiring privilege</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>ShellExecute</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>CreateProcess</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th colspan="2">System</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Application Information service</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Elevating an ActiveX install</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the <b>User Account Control: Switch to the secure desktop when prompting for elevation</b> Group Policy setting is checked.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Check UAC slider level</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>UAC has a slider to select from four levels of notification.</p>
|
||||
<ul>
|
||||
<li><p><b>Always notify</b> will:</p>
|
||||
<ul>
|
||||
<li>Notify you when programs try to install software or make changes to your computer.</li>
|
||||
<li>Notify you when you make changes to Windows settings.</li>
|
||||
<li>Freeze other tasks until you respond.</li>
|
||||
</ul>
|
||||
<p>Recommended if you often install new software or visit unfamiliar websites.</p><br>
|
||||
</li>
|
||||
<li><p><b>Notify me only when programs try to make changes to my computer</b> will:</p>
|
||||
<ul>
|
||||
<li>Notify you when programs try to install software or make changes to your computer.</li>
|
||||
<li>Not notify you when you make changes to Windows settings.</li>
|
||||
<li>Freeze other tasks until you respond.</li>
|
||||
</ul>
|
||||
<p>Recommended if you do not often install apps or visit unfamiliar websites.</p><br>
|
||||
</li>
|
||||
<li><p><b>Notify me only when programs try to make changes to my computer (do not dim my desktop)</b> will:</p>
|
||||
<ul>
|
||||
<li>Notify you when programs try to install software or make changes to your computer.</li>
|
||||
<li>Not notify you when you make changes to Windows settings.</li>
|
||||
<li>Not freeze other tasks until you respond.</li>
|
||||
</ul>
|
||||
<p>Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.</p><br>
|
||||
</li>
|
||||
<li><p><b>Never notify (Disable UAC prompts)</b> will:</p>
|
||||
<ul>
|
||||
<li>Not notify you when programs try to install software or make changes to your computer.</li>
|
||||
<li>Not notify you when you make changes to Windows settings.</li>
|
||||
<li>Not freeze other tasks until you respond.</li>
|
||||
</ul>
|
||||
<p>Not recommended due to security concerns.</p>
|
||||
</li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Secure desktop enabled</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>The <b>User Account Control: Switch to the secure desktop when prompting for elevation</b> policy setting is checked: </p>
|
||||
<ul>
|
||||
<li>
|
||||
<p>If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.</p>
|
||||
</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>CreateProcess</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>AppCompat</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>The AppCompat database stores information in the application compatibility fix entries for an application.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Fusion</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Installer detection</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th colspan="2">Kernel</th>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>Virtualization</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p>File system and registry</p>
|
||||
</td>
|
||||
<td>
|
||||
<p>The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
### User
|
||||
|
||||
|Component|Description|
|
||||
|--- |--- |
|
||||
|<p>User performs operation requiring privilege|<p>If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.|
|
||||
|<p>ShellExecute|<p>ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.|
|
||||
|<p>CreateProcess|<p>If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.|
|
||||
|
||||
### System
|
||||
|
||||
|Component|Description|
|
||||
|--- |--- |
|
||||
|<p>Application Information service|<p>A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.|
|
||||
|<p>Elevating an ActiveX install|<p>If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.|
|
||||
|<p>Check UAC slider level|<p>UAC has a slider to select from four levels of notification.<ul><li><p>**Always notify** will:<ul><li>Notify you when programs try to install software or make changes to your computer.</li><li>Notify you when you make changes to Windows settings.</li><li>Freeze other tasks until you respond.</li></ul><p>Recommended if you often install new software or visit unfamiliar websites.<br></li><li><p>**Notify me only when programs try to make changes to my computer** will:<ul><li>Notify you when programs try to install software or make changes to your computer.</li><li>Not notify you when you make changes to Windows settings.</li><li>Freeze other tasks until you respond.</li></ul><p>Recommended if you do not often install apps or visit unfamiliar websites.<br></li><li><p>**Notify me only when programs try to make changes to my computer (do not dim my desktop)** will:<ul><li>Notify you when programs try to install software or make changes to your computer.</li><li>Not notify you when you make changes to Windows settings.</li><li>Not freeze other tasks until you respond.</li></ul><p>Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.<br></li><li><p>**Never notify (Disable UAC prompts)** will:<ul><li>Not notify you when programs try to install software or make changes to your computer.</li><li>Not notify you when you make changes to Windows settings.</li><li>Not freeze other tasks until you respond.</li></ul><p>Not recommended due to security concerns.|
|
||||
|<p>Secure desktop enabled|<p>The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked: <ul><li><p>If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.</li><li><p>If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.|
|
||||
|<p>CreateProcess|<p>CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.|
|
||||
|<p>AppCompat|<p>The AppCompat database stores information in the application compatibility fix entries for an application.|
|
||||
|<p>Fusion|<p>The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.|
|
||||
|<p>Installer detection|<p>Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.|
|
||||
|
||||
### Kernel
|
||||
|
||||
|Component|Description|
|
||||
|--- |--- |
|
||||
|<p>Virtualization|<p>Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.|
|
||||
|<p>File system and registry|<p>The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.|
|
||||
|
||||
The slider will never turn UAC completely off. If you set it to <b>Never notify</b>, it will:
|
||||
The slider will never turn UAC completely off. If you set it to **Never notify**, it will:
|
||||
|
||||
- Keep the UAC service running.
|
||||
- Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt.
|
||||
|
||||
@ -23,15 +23,12 @@ In addition to older and less-secure password-based authentication methods (whic
|
||||
|
||||
Windows supports a number of EAP authentication methods.
|
||||
|
||||
<table>
|
||||
<thead><tr><th>Method</th><th>Details</th></thead>
|
||||
<tbody>
|
||||
<tr><td>EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2)</td><td><ul><li>User name and password authentication</li><li>Winlogon credentials - can specify authentication with computer sign-in credentials</li></ul></td></tr>
|
||||
<tr><td>EAP-Transport Layer Security (EAP-TLS) </td><td><ul><li>Supports the following types of certificate authentication<ul><li>Certificate with keys in the software Key Storage Provider (KSP)</li><li>Certificate with keys in Trusted Platform Module (TPM) KSP</li><li>Smart card certificates</li><li>Windows Hello for Business certificate</li></ul></li><li>Certificate filtering<ul><li>Certificate filtering can be enabled to search for a particular certificate to use to authenticate with</li><li>Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based</li></ul></li><li>Server validation - with TLS, server validation can be toggled on or off<ul><li>Server name - specify the server to validate</li><li>Server certificate - trusted root certificate to validate the server</li><li>Notification - specify if the user should get a notification asking whether to trust the server or not</li></ul></li></ul></td></tr>
|
||||
<tr><td><a href="/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754179(v=ws.11)">Protected Extensible Authentication Protocol (PEAP)</a></td><td><ul><li>Server validation - with PEAP, server validation can be toggled on or off<ul><li>Server name - specify the server to validate</li><li>Server certificate - trusted root certificate to validate the server</li><li>Notification - specify if the user should get a notification asking whether to trust the server or not</li></ul></li><li>Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication<ul><li>EAP-MSCHAPv2</li><li>EAP-TLS</li></ul><li>Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.<li><a href="/openspecs/windows_protocols/ms-peap/757a16c7-0826-4ba9-bb71-8c3f1339e937">Cryptobinding</a>: By deriving and exchanging values from the PEAP phase 1 key material (<b>Tunnel Key</b>) and from the PEAP phase 2 inner EAP method key material (<b>Inner Session Key</b>), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.</li></li></ul></td></tr>
|
||||
<tr><td>Tunneled Transport Layer Security (TTLS)</td><td><ul><li>Inner method<ul><li>Non-EAP<ul><li>Password Authentication Protocol (PAP)</li><li>CHAP</li><li>MSCHAP</li><li>MSCHAPv2</li></ul></li><li>EAP<ul><li>MSCHAPv2</li><li>TLS</li></ul></li></ul></li><li>Server validation: in TTLS, the server must be validated. The following can be configured:<ul><li>Server name</li><li>Trusted root certificate for server certificate</li><li>Whether there should be a server validation notification</li></ul></li></ul></td></tr></tbody>
|
||||
</table>
|
||||
</br>
|
||||
|Method|Details|
|
||||
|--- |--- |
|
||||
|EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2)|<li>User name and password authentication<li>Winlogon credentials- can specify authentication with computer sign-in credentials|
|
||||
|EAP-Transport Layer Security (EAP-TLS)|<p>Supports the following types of certificate authentication <li>Certificate with keys in the software Key Storage Provider (KSP)<li>Certificate with keys in Trusted Platform Module (TPM) KSP<li>Smart card certificates<li>Windows Hello for Business certificate<p>Certificate filtering<li>Certificate filtering can be enabled to search for a particular certificate to use to authenticate with<li>Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based<p>Server validation- with TLS, server validation can be toggled on or off<li>Server name-specify the server to validate<li>Server certificate- trusted root certificate to validate the server<li>Notification-specify if the user should get a notification asking whether to trust the server or not|
|
||||
|[Protected Extensible Authentication Protocol (PEAP)](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754179(v=ws.11))|<p>Server validation with PEAP,- server validation can be toggled on or off<li>Server name- specify the server to validate<li>Server certificate- trusted root certificate to validate the server<li>Notification- specify if the user should get a notification asking whether to trust the server or not<p>Inner method- the outer method creates a secure tunnel inside while the inner method is used to complete the authentication<li>EAP-MSCHAPv2<li>EAP-TLS<p>Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.<p>[Cryptobinding](/openspecs/windows_protocols/ms-peap/757a16c7-0826-4ba9-bb71-8c3f1339e937): By deriving and exchanging values from the PEAP phase 1 key material (**Tunnel Key**) and from the PEAP phase 2 inner EAP method key material (**Inner Session Key**), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.|
|
||||
|Tunneled Transport Layer Security (TTLS)|**Inner method**<p>Non-EAP<li>Password Authentication Protocol (PAP)<li>CHAP<li>MSCHAP<li>MSCHAPv2<p>EAP<li>MSCHAPv2<li>TLS<p>Server validation: in TTLS, the server must be validated. The following can be configured:<li>Server name<li>Trusted root certificate for server certificate<li>Whether there should be a server validation notification|
|
||||
|
||||
For a UWP VPN plug-in, the app vendor controls the authentication method to be used. The following credential types can be used:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user