Windows 10

Secure boot

Windows 10 can support secure boot, but is dependent on supported and correctly configured hardware

Assured data-in-transit protection

Use the Windows 10 Built-In VPN Client configured as per customization guide.

Configure the built-in Windows firewall to block outbound connections when the VPN is not active. An example firewall profile is provided in the Firewall configuration section.

Use certificates for user or machine credentials. We recommend that Windows Key Attestation or Windows Hello for Business should be used to bind these credentials to the device’s hardware.

Alternatively, use a third-party, correctly configured, CPA Foundation grade VPN app which makes use of the UWP (Universal Windows Platform) VPN plug-in platform.

Assured data-at-rest protection

Use one of the following configurations to provide full volume encryption:

· BitLocker with a TPM and PIN configured in alignment with the BitLocker configuration settings.

· An independently assured CPA Foundation Grade, Data at Rest encryption product that supports UEFI and Windows Secure Boot, configured in alignment with the security procedures for that product.

If using BitLocker, deploy the configuration settings before encryption is started.

Device Encryption introduced for Connected Standby devices in Windows 10 does not allow the use of a passphrase to unlock the disk and so does not support some of the mandatory requirements expected from assured disk encryption products. BitLocker, or an independently assured CPA Foundation Grade product, should be used instead.

Authentication

The user implicitly authenticates to the device by entering the BitLocker PIN at boot time.

The user then has a secondary credential to use when authenticating to the platform after boot and when unlocking the device. You should use Windows Hello for Business and allow the user to log in with a PIN code or Biometric. For both Windows Hello and traditional passwords, the credential derives a key which protects other credentials, which give access to corporate services.

In an enterprise environment, the user will also be issued with an Active Directory credential which will be required when they use a device for the first time. You should use Credential Guard to best protect this credential. The user should also be a member of the Protected Users Security Group on the domain and that domain should be running a minimum of 2016 Functional Domain Level.

Windows Hello for Business also permits biometric unlock of devices that have the necessary hardware. This can be used if desired.

Accounts with administrative privileges should only be present on End User Devices used to perform administrative functions and should take advantage of the Restricted Admin feature of Remote Desktop Connections. User accounts with administrative privileges should have a strong password and ideally a second factor to authenticate them to the platform at logon and unlock time. The credentials will be best protected if the administrative user is a member of the Protected Users Security Group on the domain, and have Authentication Policy Silos applied.

Microsoft provides guidance on the use of administrative workstations, delegation of privilege and other good administrative practices.

Secure boot

On Windows 10, this requirement is met on a correctly configured platform deployed on the Hardware Compatibility Program.

A UEFI password can make it more difficult for an attacker to modify the boot process. With physical access, the boot process can still be compromised.

Platform integrity and application sandboxing

No configuration is required.

Application whitelisting

An enterprise configuration can be applied to implement application control using AppLocker. A recommended sample configuration that only allows Administrator-installed applications to run is provided below.

Device Guard can also be used to reinforce application control rules. As it does not offer the same granularity as AppLocker, the two technologies should be used alongside one another.

AppLocker can be used to restrict which pre-installed Windows Apps are available to users, and if the public Windows Store is enabled it can control which applications a user can install.

Malicious code detection and prevention

Windows 10 includes Windows Defender Antivirus and Windows Defender SmartScreen that attempt to detect malicious code for the platform. Cloud sample submission can be disabled. Alternatively, third party anti-malware products are available. If using a third-party product, those that implement the Anti-Malware Scan Interface (AMSI) should be preferred to improve compatibility with future Feature Updates.

The Early Launch Anti-Malware (ELAM) driver provides signature checking for known bad drivers on ELAM-compliant systems that are configured to use Secure Boot.

Microsoft Store for Business, or a Company Store, can be used to distribute user-installable universal apps. Such stores should only contain vetted apps. If the public Microsoft Store is enabled, AppLocker can be used to control which applications a user is able to install. Content-based attacks can be filtered by scanning capabilities in the enterprise.

Windows Defender Exploit Guard can be used to help prevent vulnerabilities in older software from being successfully exploited.

Security policy enforcement

Settings applied through Group Policy cannot be modified by unprivileged users.

External interface protection

Interfaces can be configured using group policy. USB removable media can be blocked through Group Policy if required. Direct Memory Access (DMA) is possible from peripherals connected to some external interfaces including FireWire and Thunderbolt unless disabled through group policy as detailed below, or in the UEFI/BIOS. With Windows 10 Connected Standby devices, part of the hardware compliance mitigates DMA attacks by disallowing these interfaces.

Device updates

Windows Update can automatically download and install updates. If the Microsoft Store is enabled, it should be configured to automatically update Microsoft Store apps.

Some devices will allow the UEFI firmware to be updated automatically via Windows Update. Devices that do not implement this will require updates via another mechanism whenever a new firmware is released.

Windows Update for Business or Windows Server Update Services (WSUS) can, optionally, be used to monitor and enforce updates of the core platform, system firmware and any Windows applications.

Event collection

Event collection can be carried out using Windows Event Forwarding for central event log collection.

Incident response

The combination of BitLocker drive encryption and enterprise revocation of user credentials are appropriate for managing this security recommendation.

Computer Configuration > Administrative Templates > Network > Network Connections > Require domain users to elevate when setting a network’s location

Enabled

Computer Configuration > Administrative Templates > Windows Components > Credential User Interface > Do not display the password reveal button

Enabled

Computer Configuration > Administrative Templates > Windows Components > OneDrive > Prevent the usage of OneDrive for file storage

Enabled

Computer Configuration > Administrative Templates > Windows Components > Sync your settings > Do not sync

Enabled

Allow users to turn syncing on: Disabled

Computer Configuration > Administrative Templates > Windows Components > Search > Allow Cortana

Disabled

Computer Configuration > Administrative Templates > Windows Components > Search > Don’t search the web or display web results in Search

Enabled

Computer Configuration > Administrative Templates > Windows Components > Store > Disable all apps from Microsoft Store

Enabled

Computer Configuration > Administrative Templates > Windows Components > Store > Turn off Automatic Download and Install of updates

Disabled

Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

Enabled

User Configuration > Administrative Templates > Control Panel > Personalization > Screen saver timeout

600 seconds

Computer Configuration > Administrative Templates > System > Logon > Turn off picture password sign-in

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business > Use a hardware security device

Enabled

CN=System > CN=Password Settings Container > CN=Granular Password Settings Users

Precedence: 2

Enforce minimum password length

Enforce lockout policy

Account will be locked out: Until an administrator manually unlocks the account

Directly Applies To: Domain Users

CN=System > CN=Password Settings Container > CN=Granular Password Settings Administrators

Precedence: 1

Enforce minimum password length

Password must meet complexity requirements

Enforce lockout policy

Account will be locked out: Until an administrator manually unlocks the account

Directly Applies To: Domain Admins

Protect from accidental deletion: Enabled

Group Policy > Computer Configuration > Administrative Templates > System > PIN Complexity

PIN Complexity > Maximum PIN length

PIN Complexity > Minimum PIN length

PIN Complexity > Require digits

PIN Complexity > Require lowercase letters

PIN Complexity > Require special characters

PIN Complexity > Require uppercase characters

Group Policy

Value(s)

Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry

Enabled:

0 - Security

Note - If using Windows Update for Business this will need to be set to 1 (Basic).

See Windows 10 feature updates for more details.

Computer Configuration > Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting

Enabled

Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions > Prevent installation of devices that match these device IDs

This policy prevents all Thunderbolt devices from being used and provides the strongest protection from DMA attacks. If organizations require the use of Thunderbolt devices, they should first check if the host supports Kernel DMA protection and has it enabled. If it is not supported, follow the Microsoft guidance to disable new DMA devices when the computer is locked.

Enabled: PCI\CC_0C0A

Also apply to matching devices that are already installed: Disabled

Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions > Prevent installation of drivers matching these device setup classes

Enabled:

{d48179be-ec20-11d1-b6b8-00c04fa372a7}

{7ebefbc0-3200-11d2-b4c2-00a0C9697d07}

{c06ff265-ae09-48f0-812c-16753d7cba83}

{6bdd1fc1-810f-11d0-bec7-08002be2092f}

Also apply to matching devices that are already installed: Disabled

Computer Configuration > Administrative Templates > Windows Components > Store > Turn off Automatic Download and Install of updates

Disabled

Computer Configuration > Administrative Templates > Windows Components > App runtime > Block launching Universal Windows apps with Windows Runtime API access from hosted content.

Enabled

Computer Configuration > Administrative Templates > Network > Network Isolation > Proxy definitions are authoritative

Enabled

Computer Configuration > Administrative Templates > Network > Network Isolation > Subnet definitions are authoritative

Enabled

Computer Configuration > Administrative Templates > Windows Components > Portable Operating System > Windows To Go Default Startup Options

Disabled

Computer Configuration > Preferences > Windows Settings > Registry > Replace > HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system\

(DWORD) SafeModeBlockNonAdmins = 1

Computer Configuration > Preferences > Windows Settings > Registry > Replace > HKLM\System\CurrentControlSet\Control\SafeBoot\Network

(REG_SZ)

Appid = Service

Computer Configuration > Preferences > Windows Settings > Registry > Replace > HKLM\System\CurrentControlSet\Control\SafeBoot\Network

(REG_SZ)

Appid.sys = Driver

Computer Configuration > Preferences > Windows Settings > Registry > Replace > HKLM\System\CurrentControlSet\Control\SafeBoot\Network

(REG_SZ)

discache.sys = Driver

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Accounts: Block Microsoft accounts

Users can’t add or log on with Microsoft accounts

Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Path Validation Settings > Stores > Allow user trusted root Certificate Authorities (CAs) to be used to validate certificates

Disabled

Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Path Validation Settings > Stores > Allow users to trust peer trust certificates

Disabled

Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Path Validation Settings > Stores > Root CAs that client computers can trust

Third-Party Root Certification Authorities and Enterprise Root Certification Authorities

Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Path Validation Settings > Stores

CAs must also be compliant with user principal name (UPN) constraints = Disabled

Computer Configuration > Administrative Templates >Network > Network Connections > Require domain users to elevate when setting a network’s location

Enabled

Computer Configuration > Administrative Templates > System > Group Policy > Phone-PC linking on this device

Disabled

Computer Configuration > Administrative Templates > System > OS Policies > Allow upload of User Activities

Disabled

Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow a shared Books folder

Disabled

Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow configuration updates for the Books Library

Enabled

Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow extended telemetry for the Books tab

Disabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Turn off Windows Defender Antivirus

Disabled

Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options > Sign-in last interactive user automatically after a system-initiated restart

Disabled

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Disable new DMA devices when this computer is locked

Enabled

Computer Configuration > Administrative Templates > System > Group Policy > Continue experiences on this device

Disabled

Computer Configuration > Administrative Templates > System > Kernel DMA Protection > Enumeration policy for external devices incompatible with Kernel DMA Protection

Enabled:

Enumeration policy: Block all

Computer Configuration > Administrative Templates > System > OS Policies > Allow Clipboard History

Disabled

Computer Configuration > Administrative Templates > System > OS Policies > Allow Clipboard synchronization across devices

Disabled

Computer Configuration > Administrative Templates > System > OS Policies > Allow publishing of User Activities

Disabled

Computer Configuration > Administrative Templates > System > OS Policies > Enabled Activity Feed

Disabled

Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure collection of browsing data for Microsoft 365 Analytics

Enabled

Configure telemetry collection: Do not allow sending intranet or internet history

Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Disable diagnostic data viewer.

Enabled

Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed

Enabled

Configure tab preloading: Prevent tab preloading

Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow Sideloading of extensions

Disabled

Group Policy

Value(s)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MAPS > Configure the ‘Block at First Sight’ feature

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MAPS > Join Microsoft MAPS

Enabled: Advanced

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MAPS > Send file samples when further analysis is required

Enabled: Send safe samples automatically

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Real-time Protection > Turn off real-time protection

Disabled

Group Policy

Value(s)

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Enforcement > Executable Rules

Configured: True Enforce Rules

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Executable Rules

Allow Everyone: All files located in the Windows Defender\Platform folder -

%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\*

Allow Everyone: All files located in the Program Files folder - with exceptions

Exception: (Path) %PROGRAMFILES%\Windows Kits\*\Debuggers\*

Allow Everyone: All files located in the Windows folder - with exceptions

Exception: (Path) %SYSTEM32%\com\dmp\*

Exception: (Path) %SYSTEM32%\FxsTmp\*

Exception: (Path) %SYSTEM32%\Spool\drivers\color\*

Exception: (Path) %SYSTEM32%\Spool\PRINTERS\*

Exception: (Path) %SYSTEM32%\Spool\SERVERS\*

Exception: (Path) %SYSTEM32%\Tasks\*

Exception: (Path) %SYSTEM32%\microsoft\crypto\rsa\machinekeys\*

Exception: (Path) %WINDIR%\tasks\*

Exception: (Path) %WINDIR%\temp\*

Exception: (Path) %WINDIR%\tracing\*

Exception: (Path) %WINDIR%\registration\crmlog\*

Exception: (Path) %WINDIR%\servicing\packages\*

Exception: (Path) %WINDIR%\servicing\sessions\*

Exception: (Publisher) %SYSTEM32%\WMIC.exe,*

Exception: (Publisher) %SYSTEM32%\cmstp.exe,*

Exception: (Publisher) %SYSTEM32%\mshta.exe,*

Exception: (Publisher) %SYSTEM32%\PresentationHost.exe,*

Exception: (Publisher) %SYSTEM32%\windbg.exe,*

Exception: (Publisher) %SYSTEM32%\cipher.exe,*

Exception: (Publisher) %Microsoft.NET%\Framework64\*\IEExec.exe

Exception: (Publisher) %Microsoft.NET%\Framework64\*\InstallUtil.exe

Exception: (Publisher) %Microsoft.NET%\Framework\*\regsvcs.exe

Exception: (Publisher) %Microsoft.NET%\Framework\*\msbuild.exe

Exception: (Publisher) %Microsoft.NET%\Framework\*\regasm.exe

Allow Administrators: All files

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Enforcement > Windows Installer Rules

Configured: True Enforce Rules

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Windows Installer Rules

Allow Administrators: All Windows Installer files

Allow Everyone: (PATH) %WINDIR%\Installer\*

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Enforcement > Script Rules

Configured: True Enforce Rules

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Script Rules > Enforce rules of this type

Allow Everyone: All Scripts located in the Program Files folder

 Allow Everyone: All Scripts located in the Windows folder - with exceptions

Exception: (PATH) %SYSTEM32%\com\dmp\*

Exception: (PATH) %SYSTEM32%\FxsTmp\*

Exception: (PATH) %SYSTEM32%\Spool\drivers\color\*

Exception: (PATH) %SYSTEM32%\Spool\PRINTERS\*

Exception: (PATH) %SYSTEM32%\Spool\SERVERS\*

Exception: (PATH) %SYSTEM32%\Tasks\*

Exception: (PATH) %WINDIR%\registration\crmlog\*

Exception: (PATH) %WINDIR%\tasks\*

Exception: (PATH) %WINDIR%\temp\*

Exception: (PATH) %WINDIR%\tracing\*

Exception: (PATH) %WINDIR%\servicing\packages\*

Exception: (PATH) %WINDIR%\servicing\sessions\*

Exception: (PATH) %SYSTEM32%\microsoft\crypto\rsa\machinekeys\*

Allow Administrators: All scripts

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Enforcement > DLL Rules

Configured: True Enforce Rules

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > DLL Rules

Allow Everyone: All DLLs located in the Windows Defender\Platform folder -

%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\*

Allow Everyone: All DLLs located in the Program Files folder

Allow Everyone: All DLLs located in the Windows folder - with exceptions

Exception: (PATH) %SYSTEM32%\com\dmp\*

Exception: (PATH) %SYSTEM32%\FxsTmp\*

Exception: (PATH) %SYSTEM32%\Spool\drivers\color\*

Exception: (PATH) %SYSTEM32%\Spool\PRINTERS\*

Exception: (PATH) %SYSTEM32%\Spool\SERVERS\*

Exception: (PATH) %SYSTEM32%\Tasks\*

Exception: (PATH) %SYSTEM32%\microsoft\crypto\rsa\machinekeys\*

Exception: (PATH) %WINDIR%\registration\crmlog\*

Exception: (PATH) %WINDIR%\tasks\*

Exception: (PATH) %WINDIR%\temp\*

Exception: (PATH) %WINDIR%\tracing\*

Exception: (PATH) %WINDIR%\servicing\packages\*

Exception: (PATH) %WINDIR%\servicing\sessions\*

Allow Administrators: All DLLs

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Enforcement > Packaged app Rules

Configured: True Enforce Rules

Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > Packaged app rules

Allow Everyone: All signed packaged apps

Exception: (Publisher) Microsoft.Getstarted

Exception: (Publisher) Microsoft.MicrosoftOfficeHub

Exception: (Publisher) Microsoft.SkypeApp

Exception: (Publisher) Microsoft.WindowsFeedback

Group Policy

Value(s)

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Enforce drive encryption type on operating system drives

Enabled

Select the encryption type: Full encryption

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Configure use of hardware-based encryption for operating system drives

Disabled

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup

Enabled

Allow BitLocker without a compatible TPM (Requires a password or startup key on a USB flash drive): Unticked

Configure TPM startup: Do not allow TPM

Configure TPM startup PIN: Allow startup PIN with TPM

Configure TPM startup key: Do not allow startup key with TPM

Configure TPM startup key and PIN: Allow startup key and PIN with TPM

Group Policy > Computer Configuration > Administrative Templates > Windows Components > Operating System Drives

Allow enhanced PINs for startup

Configure minimum PIN length for startup

Configure use of passwords for operating system drives

Group Policy

Value(s)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access

Enabled

Mode: Block

Computer Configuration > Administrative Templates > Windows Components > Window Defender Exploit Guard> Use a common set of exploit protection settings

Enabled.

A UNC path to an XML file containing any desired settings should be configured.

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction > Configure Attack Surface Reduction rules

Details on these policies can be found at https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard

d4f940ab-401b-4efc-aadc-ad5f3c50688a: 1

9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2: 1

3b576869-a4ec-4529-8536-b80a7769e899: 1

5beb7efe-fd9a-4556-801d-275e5ffc04cc: 1

92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B: 1

b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4: 1

75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84: 1

d3e037e1-3eb8-44c8-a917-57927947596d: 1

be9ba2d9-53ea-4cdc-84e5-9b1eeee46550: 1

26190899-1602-49e8-8b27-eb1d0a1ce869: 1

7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c: 1

d1e49aac-8f56-4280-b9ba-993a6d77406c: 2

Group Policy

Value(s)

Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security

Enabled:

Platform Security: Secure Boot and DMA Protection

Virtualization Based Protection of Code Integrity: Enabled with UEFI Lock

Require UEFI Memory Attributes Table: Enabled*

Credential Guard Configuration:  Enabled with UEFI Lock

Secure Launch Configuration: Enabled

Group Policy

Value(s)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Turn on Windows Defender Application Guard in Enterprise Mode

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow data persistence for Windows Defender Application Guard

Disabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow auditing events in Windows Defender Application Guard

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Prevent enterprise websites from loading non-enterprise content

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Configure Windows Defender Application Guard clipboard settings

Enabled:

Enable clipboard operation from an isolated session to the host. Clipboard content options: 3 (Allow text and image copying)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Configure Windows Defender Application Guard print settings

Enabled:

Allowed Print types in Application Guard: 11 (Allow network, PDF and XPS printing)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow files to download and save to the host operating system from Windows Defender Application Guard

Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Configure additional sources for untrusted files in Windows Defender Application Guard

Enabled:

Removable media: Enabled

Network shares: Enabled

Files with Mark of the Web: Enabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device

Disabled

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow users to trust files that open in Windows Defender Application Guard

Enabled:

0. Do not allow users to manually trust files

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard > Allow camera and microphone access in Windows Defender Application Guard

Disabled

Computer Configuration  > Administrative Templates > Network > Network Isolation > Enterprise resource domains hosted in the cloud

Enabled:

Computer Configuration  > Administrative Templates > Network > Network Isolation > Private network ranges for apps

Enabled:

Any IP address ranges that are used for internal applications. These can be specified in CIDR notation.

Group Policy

Value(s)

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Domain Profile

Firewall State : On (Recommended)

Inbound connections : Block (default)

Outbound connections : Allow (default)

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Domain Profile > Settings > Customize > Apply local firewall rules

No

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Private Profile

Firewall State : On (Recommended)

Inbound connections : Block (default)

Outbound connections : Block

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Private Profile > Settings > Customize > Apply local firewall rules

No

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Public Profile

Firewall State : On (Recommended)

Inbound connections : Block (default)

Outbound connections : Block

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties > Public Profile > Settings > Customize > Apply local firewall rules

No

Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Outbound Rules

Enabled

Allow outbound DHCP

General > Action: Allow the connection

Programs and Services > Programs > This Program > %SystemRoot%\system32\svchost.exe

Allow Programs and Services > Service > Apply to this service > DHCP Client (Dhcp)

Advanced > Profiles: Private, Public

Protocols and Ports > Local port: UDP 68

Protocols and Ports > Remote port: UDP 67

Allow outbound DNS

General > Action: Allow the connection

Programs and Services > Programs > This Program > %SystemRoot%\system32\svchost.exe

Allow Programs and Services > Service > Apply to this service > DNS Client (Dnscache)

Advanced > Profiles: Private, Public

Protocols and Ports > Remote port: TCP 53, UDP 53

Allow outbound Kerberos

General > Action: Allow the connection

Programs and Services > Programs > This Program > %SystemRoot%\system32\lsass.exe

Advanced > Profiles: Private, Public

Protocols and Ports > Remote port: All TCP and UDP ports

Allow outbound LDAP

General > Action: Allow the connection

Programs and Services > Programs > This Program > All programs that meet the specified conditions

Advanced > Profiles: Private, Public

Protocols and Ports > Remote port: TCP 389, UDP 389

Allow outbound NCSI Probe

General > Action: Allow the connection

Programs and Services > Programs > This Program > %SystemRoot%\system32\svchost.exe

Allow Programs and Services > Service > Apply to this service > Network Location Awareness (NlaSvc)

Advanced > Profiles: Private, Public

Protocols and Ports > Remote port: TCP 80

Setting

Value

Administrator/Setup Password + UEFI Lockout

A UEFI administrator or setup password should be set and UEFI console lockout enabled to prevent unauthorized changes to UEFI settings.

Boot Mode

UEFI

Secure Boot

Enabled

Legacy Boot Options and Legacy Option ROMs

Disabled

Manufacturer Signed Firmware Updates

Enabled

Trusted Platform Module (TPM)

Enabled

UEFI Firmware Rollback

Disabled

Boot Options

Restricted to only those that are required. Priority should be given to internal storage.

Boot Order

Locked

No Execute (NX)

Enabled

Virtualization Extensions

Enabled

Input/Output Memory Management Unit (IOMMU)

Enabled

Thunderbolt

Ports should be disabled if not required 

If required

·              Disable Thunderbolt boot support if not required.

·              Disable Thunderbolt pre-boot module support.

·              Set a minimum Thunderbolt Security Level of User Authorization.

Group Policy

Value(s)

Computer Configuration  > Administrative Templates > Windows Components > Windows Update > Remove access to “Pause updates” feature

Enabled

Computer Configuration  > Administrative Templates > Windows Components> Windows Update > Windows Update for Business > Manage preview builds

Disabled

Computer Configuration  > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received

Select the Windows readiness level for the updates you want to receive: Semi-Annual Channel

After a Preview Build or Feature Update is released, defer receiving it for this many days: 0