Policy Definition for PCI templates - Server Automation Documentation

Part namePart type2.2.3.44 Network access: Named Pipes that can be accessed anonymouslyExtended Object2.2.3.45 Network access: Remotely accessible registry paths2.2.3.50 Network security: LAN Manager authentication level2.2.3.56 Interactive logon: Message text for users attempting to log on2.2.3.57 Interactive logon: Message title for users attempting to log on2.2.3.63 Configure system security parameters to prevent misuse: 
Enable the computer to stop generating 8.3 style filenames2.2.3.64 Configure system security parameters to prevent misuse:  
Allow the computer to ignore NetBIOS name release requests except from WINS servers2.2.3.74 Network access: Remotely accessible registry paths and sub-paths2.2.3.83 Configure system security parameters to prevent misuse:
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes2.2.3.84 Configure system security parameters to prevent misuse:
MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds2.2.3.85 Configure system security parameters to prevent misuse:
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)2.2.3.86 Configure system security parameters to prevent misuse:
MSS: (TCPMaxDataRetransmissions)  How many times unacknowledged data is retransmitted2.2.3.87 Configure system security parameters to prevent misuse:
MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)2.2.3.88 Configure system security parameters to prevent misuse:
MSS: (TCPMaxDataRetransmissions) IPv6 How many times unacknowledged data is retransmitted8.5.10 Minimum password length8.5.13 Account lockout thresholdAudit-PolicyAudit-Policy-10.2.1.11Audit-Policy-10.2.1.12Audit-Policy-10.2.1.14Audit-Policy-10.2.1.15Audit-Policy-10.2.1.17Audit-Policy-10.2.1.18Audit-Policy-10.2.1.19Audit-Policy-10.2.1.20Audit-Policy-10.2.1.21Audit-Policy-10.2.1.22Audit-Policy-10.2.1.23Audit-Policy-10.2.1.3Audit-Policy-10.2.1.5Audit-Policy-10.2.1.6Audit-Policy-10.2.1.7Audit-Policy-10.2.1.8Audit-Policy-10.2.1.9Audit-Policy-10.2.2.2Audit-Policy-10.2.4.2Audit-Policy-10.2.4.3Audit-Policy-10.4.2Service Fax PermissionsService iphlpsvc PermissionsService MSFtpsvc PermissionsService NetMan PermissionsService RasAuto PermissionsService RasMan PermissionsService RpcLocator PermissionsService SNMPTRAP PermissionsService TapiSrv PermissionsService TlntSvr PermissionsService VSS PermissionsUser Rights Policy-2.2.3.1User Rights Policy-2.2.3.10User Rights Policy-2.2.3.11User Rights Policy-2.2.3.12User Rights Policy-2.2.3.13User Rights Policy-2.2.3.14User Rights Policy-2.2.3.15User Rights Policy-2.2.3.16User Rights Policy-2.2.3.17User Rights Policy-2.2.3.18User Rights Policy-2.2.3.19User Rights Policy-2.2.3.2User Rights Policy-2.2.3.20User Rights Policy-2.2.3.3User Rights Policy-2.2.3.4User Rights Policy-2.2.3.5User Rights Policy-2.2.3.6User Rights Policy-2.2.3.65User Rights Policy-2.2.3.66User Rights Policy-2.2.3.67User Rights Policy-2.2.3.68User Rights Policy-2.2.3.69User Rights Policy-2.2.3.7User Rights Policy-2.2.3.70User Rights Policy-2.2.3.77User Rights Policy-2.2.3.78User Rights Policy-2.2.3.79User Rights Policy-2.2.3.8User Rights Policy-2.2.3.80User Rights Policy-2.2.3.81User Rights Policy-2.2.3.82User Rights Policy-2.2.3.89User Rights Policy-2.2.3.9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonRegistry KeyHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windowsHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\SecurityHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\SetupHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\SystemHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfileHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfileHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfileHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettingsHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\ParametersHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnableSecureCredentialPromptingRegistry ValueHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministratorsHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableLocalMachineRunHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableLocalMachineRunOnceHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRunHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPublishingWizardHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebServicesHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdminHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUserHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCADHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserNameHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetectionHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPathsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggleHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualizationHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorTokenHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaptionHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeTextHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktopHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\scforceoptionHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogonHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\securitylevelHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\setcommandHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRomsHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASDHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppiesHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogonHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\cachedlogonscountHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogonHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\passwordexpirywarningHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScreenSaverGracePeriodHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\scremoveoptionHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Conferencing\NoRDSHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Cryptography\ForceKeyProtectionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Messenger\Client\CEIPHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SearchCompanion\DisableContentFileUpdatesHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching\DontSearchWindowsUpdateHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\Application\MaxSizeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\Application\RetentionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\Security\MaxSizeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\Security\RetentionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\System\MaxSizeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\System\RetentionHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoBackgroundPolicyHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoGPOListChangesHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\
{B087BE9D-454F-AF9C-04291E351182}\NoGPOListChangesHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\
CodeIdentifiers\AuthenticodeEnabledHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate
\AU\AUOptionsHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\
NoAUShutdownOptionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\
RescheduleWaitTimeEnabledHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\
AllowLocalIPsecPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\
AllowLocalPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\
DefaultInboundActionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\
DisableNotificationsHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\
EnableFirewallHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowInboundEchoRequestHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowInboundEnchoRequestHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowInboundMaskRequestHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowInboundRouterRequestHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowInboundTimestampRequestHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowOutboundDestinationUnreachableHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowOutboundPacketTooBigHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowOutboundParameterProblemHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowOutboundSourceQuenchHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowOutboundTimeExceededHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
IcmpSettings\AllowRedirectHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\
AllowLocalIPsecPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\
AllowLocalPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\
DefaultInboundActionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\
DisableNotificationsHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\
EnableFirewallHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\
AllowLocalIPsecPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\
AllowLocalPolicyMergeHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\
DefaultInboundActionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\
DisableNotificationsHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\
EnableFirewallHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
DisableNotificationsHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
EnableFirewallHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings

\AllowInboundEchoRequest

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowInboundEnchoRequest

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowInboundMaskRequest

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowInboundRouterRequest

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowInboundTimestampRequest

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowOutboundDestinationUnreachable

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowOutboundPacketTooBig

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowOutboundParameterProblem

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowOutboundSourceQuench

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowOutboundTimeExceeded

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

AllowRedirect

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings\

ParameterProblem

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\DisableHTTPPrintingHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\DisableWebPnPDownloadHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc\EnableAuthEpResolutionHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc\RestrictRemoteClientsHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\DisablePasswordSavingHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fAllowToGetHelpHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fAllowUnsolicitedHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDisableCdmHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fPromptForPasswordHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\MaxIdleTimeHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\MinEncryptionLevelHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreationHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\crashonauditfailHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCredsHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymousHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuestHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUseHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevelHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSecHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSecHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHashHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAMHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\scenoapplylegacyauditpolicyHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControlHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDriversHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\MachineHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\MachineHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitiveHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdownHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionModeHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optionalHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevelHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSEC\NoDefaultExemptHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\autodisconnectHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\enableforcedlogoffHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\enablesecuritysignatureHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipesHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionSharesHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\requiresecuritysignatureHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\restrictnullsessaccessHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPasswordHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignatureHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignatureHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrityHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemandHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\disablepasswordchangeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\maximumpasswordageHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChangeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requiresignorsealHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\requirestrongkeyHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\sealsecurechannelHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\signsecurechannelHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\ldapserverintegrityHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRoutingHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirectHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTimeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\PerformRouterDiscoveryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissionsHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRoutingHKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\TcpMaxDataRetransmissions

Registry Value:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\

{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\NoGPOListChanges

\Access Credential Manager as a trusted callerSecurity Setting\Force shutdown from a remote system\Network access: Allow anonymous SID/Name translation\Synchronize directory service data

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\

MK Protocol Security Restriction\Enforce user logon restrictions

Security Settings\Account PoliciesSecurity Settings\Account PoliciesSecurity Settings\Account PoliciesSecurity Settings\Account PoliciesSecurity Settings\Account Policies\Account Lockout Policy\Account lockout durationSecurity Settings\Account Policies\Account Lockout Policy\Account lockout thresholdSecurity Settings\Account Policies\Account Lockout Policy\Reset account lockout counter afterSecurity Settings\Account Policies\Password PolicySecurity Settings\Account Policies\Password PolicySecurity Settings\Account Policies\Password PolicySecurity Settings\Account Policies\Password Policy\Enforce password historySecurity Settings\Account Policies\Password Policy\Maximum password ageSecurity Settings\Account Policies\Password Policy\Minimum password ageSecurity Settings\Account Policies\Password Policy\Minimum password lengthSecurity Settings\Account Policies\Password Policy\Passwords must meet complexity requirementsSecurity Settings\Local PoliciesSecurity Settings\Local PoliciesSecurity Settings\Local PoliciesSecurity Settings\Local Policies\Access this computer from the networkSecurity Settings\Local Policies\Act as part of the operating systemSecurity Settings\Local Policies\Add workstations to domainSecurity Settings\Local Policies\Adjust memory quotas for a processSecurity Settings\Local Policies\Allow log on locallySecurity Settings\Local Policies\Audit Policy\Audit account logon eventsSecurity Settings\Local Policies\Audit Policy\Audit account managementSecurity Settings\Local Policies\Audit Policy\Audit directory service accessSecurity Settings\Local Policies\Audit Policy\Audit logon eventsSecurity Settings\Local Policies\Audit Policy\Audit object accessSecurity Settings\Local Policies\Audit Policy\Audit policy changeSecurity Settings\Local Policies\Audit Policy\Audit privilege useSecurity Settings\Local Policies\Audit Policy\Audit process trackingSecurity Settings\Local Policies\Audit Policy\Audit system eventsSecurity Settings\Local Policies\Back up files and directoriesSecurity Settings\Local Policies\Bypass traverse checkingSecurity Settings\Local Policies\Change the system timeSecurity Settings\Local Policies\Change the time zoneSecurity Settings\Local Policies\Create a page fileSecurity Settings\Local Policies\Create a token objectSecurity Settings\Local Policies\Create global objectsSecurity Settings\Local Policies\Create permanent shared objectsSecurity Settings\Local Policies\Create symbolic linksSecurity Settings\Local Policies\Debug programsSecurity Settings\Local Policies\Deny access to this computer from the networkSecurity Settings\Local Policies\Deny log on as a batch jobSecurity Settings\Local Policies\Deny log on locallySecurity Settings\Local Policies\Enable computer and user accounts to be trusted for delegationSecurity Settings\Local Policies\Force shutdown from a remote systemSecurity Settings\Local Policies\Generate security auditsSecurity Settings\Local Policies\Impersonate a client after authenticationSecurity Settings\Local Policies\Increase a process working setSecurity Settings\Local Policies\Increase scheduling prioritySecurity Settings\Local Policies\Load and unload device driversSecurity Settings\Local Policies\Lock pages in memorySecurity Settings\Local Policies\Log on as a batch jobSecurity Settings\Local Policies\Manage auditing and security logSecurity Settings\Local Policies\Modify firmware environment valuesSecurity Settings\Local Policies\Perform volume maintenance tasksSecurity Settings\Local Policies\Profile single processSecurity Settings\Local Policies\Profile system performanceSecurity Settings\Local Policies\Remove computer from docking stationSecurity Settings\Local Policies\Replace a process level tokenSecurity Settings\Local Policies\Restore files and directoriesSecurity Settings\Local Policies\Security OptionsSecurity Settings\Local Policies\Security Options\Accounts: Guest account statusSecurity Settings\Local Policies\Security Options\Accounts: Limit local account use of blank passwords to console logon onlySecurity Settings\Local Policies\Security Options\Accounts: Rename administrator accountSecurity Settings\Local Policies\Security Options\Accounts: Rename guest accountSecurity Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security auditsSecurity Settings\Local Policies\Security Options\Devices: Allowed to format and eject removable mediaSecurity Settings\Local Policies\Security Options\Devices: Allow undock without having to log onSecurity Settings\Local Policies\Security Options\Devices: Prevent users from installing printer driversSecurity Settings\Local Policies\Security Options\Devices: Restrict CD-ROM access to locally logged-on user onlySecurity Settings\Local Policies\Security Options\Devices: Restrict floppy access to locally logged-on user onlySecurity Settings\Local Policies\Security Options\Devices: Unsigned driver installation behaviorSecurity Settings\Local Policies\Security Options\Domain controller: Allow server operators to schedule tasksSecurity Settings\Local Policies\Security Options\Domain controller: LDAP server signing requirementsSecurity Settings\Local Policies\Security Options\Domain controller: Refuse machine account password changesSecurity Settings\Local Policies\Security Options\Domain member: Digitally encrypt or sign secure channel data (always)Security Settings\Local Policies\Security Options\Domain member: Digitally encrypt secure channel data (when possible)Security Settings\Local Policies\Security Options\Domain member: Digitally sign secure channel data (when possible)Security Settings\Local Policies\Security Options\Domain member: Disable machine account password changesSecurity Settings\Local Policies\Security Options\Domain member: Maximum machine account password ageSecurity Settings\Local Policies\Security Options\Domain member: Require strong (Windows 2000 or later) session keySecurity Settings\Local Policies\Security Options\Interactive logon: Do not display last user nameSecurity Settings\Local Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DELSecurity Settings\Local Policies\Security Options\Interactive logon: Message text for users attempting to log onSecurity Settings\Local Policies\Security Options\Interactive logon: Message title for users attempting to log onSecurity Settings\Local Policies\Security Options\Interactive logon: Number of previous logons to cache
(in case domain controller is not available)Security Settings\Local Policies\Security Options\Interactive logon: Prompt user to change password before expirationSecurity Settings\Local Policies\Security Options\Interactive logon: Require Domain Controller authentication
to unlock workstationSecurity Settings\Local Policies\Security Options\Interactive logon: Require smart cardSecurity Settings\Local Policies\Security Options\Interactive logon: Smart card removal behaviorSecurity Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (always)Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (if server agrees)Security Settings\Local Policies\Security Options\Microsoft network client: Send unencrypted password to third-party SMB serversSecurity Settings\Local Policies\Security Options\Microsoft network server: Amount of idle time required before suspending sessionSecurity Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (always)Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (if client agrees)Security Settings\Local Policies\Security Options\Microsoft network server: Disconnect clients when logon hours expireSecurity Settings\Local Policies\Security Options\Network access: Allow anonymous SID/Name translationSecurity Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accountsSecurity Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accounts and sharesSecurity Settings\Local Policies\Security Options\Network access: Let Everyone permissions apply to anonymous usersSecurity Settings\Local Policies\Security Options\Network access: Named Pipes that can be accessed anonymouslySecurity Settings\Local Policies\Security Options\Network access: Remotely accessible registry pathsSecurity Settings\Local Policies\Security Options\Network access: Remotely accessible registry paths and sub-pathsSecurity Settings\Local Policies\Security Options\Network access: Restrict anonymous access to Named Pipes and SharesSecurity Settings\Local Policies\Security Options\Network access: Shares that can be accessed anonymouslySecurity Settings\Local Policies\Security Options\Network access: Sharing and security model for local accountsSecurity Settings\Local Policies\Security Options\Network security: Do not store LAN Manager hash value on next password changeSecurity Settings\Local Policies\Security Options\Network security: LAN Manager authentication levelSecurity Settings\Local Policies\Security Options\Network security: LDAP client signing requirementsSecurity Settings\Local Policies\Security Options\Network security: Minimum session security for
NTLM SSP based (including secure RPC) clientsSecurity Settings\Local Policies\Security Options\Network security: Minimum session security for
NTLM SSP based (including secure RPC) serversSecurity Settings\Local Policies\Security Options\Recovery console: Allow automatic administrative logonSecurity Settings\Local Policies\Security Options\Recovery console: Allow floppy copy and access to all drives and all foldersSecurity Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log onSecurity Settings\Local Policies\Security Options\Shutdown: Clear virtual memory page fileSecurity Settings\Local Policies\Security Options\System cryptography: Force strong key protection for
user keys stored on the computerSecurity Settings\Local Policies\Security Options\System cryptography: Use FIPS compliant algorithms
for encryption, hashing, and signingSecurity Settings\Local Policies\Security Options\System objects: Default owner for objects created by
members of the Administrators groupSecurity Settings\Local Policies\Security Options\System objects: Require case insensitivity for
non-Windows subsystemsSecurity Settings\Local Policies\Security Options\System objects: Strengthen default permissions
of internal system objects (e.g. Symbolic Links)Security Settings\Local Policies\Security Options\System settings: Optional subsystemsSecurity Settings\Local Policies\Security Options\System settings: Use Certificate Rules on Windows
Executables for Software Restriction PoliciesSecurity Settings\Local Policies\Shut down the systemSecurity Settings\Local Policies\Synchronize directory service dataSecurity Settings\Local Policies\Take ownership of files or other objectsGuestsWindows GroupWindows Service ListWindows Service List