Configure System Administrative Templates for PAWs

Target Scope

Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration.
Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise.

Implementation Details

Priority: High
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Policies\Administrative Templates\...
- Registry Location: Multiple locations under HKLM\SOFTWARE\Policies and HKLM\SYSTEM\CurrentControlSet (see individual requirements below)

Rationale

Privileged Access Workstations (PAWs) are dedicated exclusively to Tier 0 directory administration and Active Directory forest management. Compromise of a PAW leads directly to total domain compromise. Administrative template configurations on PAWs must enforce an absolute maximum security boundary, disabling non-essential features, legacy protocols, untrusted URI handlers, background telemetry, and unneeded consumer services:

Protocols Hardening: Disabling legacy SMBv1 components stops known remote code execution flaws, and enforcing NetBT P-node prevents broadcast spoofing and relay attacks.
Data Collection & Telemetry: Restricting diagnostic log collection, crash dump generation, feedback prompts, and dynamic cloud settings (OneSettings) prevents in-memory credential disclosure and eliminates external telemetry on Tier 0 stations.
App & Installer Restrictions: Disallowing per-user unsigned app packages, preventing non-admin packaged app installation, and blocking the ms-appinstaller protocol handler closes drive-by malware delivery vectors.
Log Retention & Forensic Buffer: Expanding event log maximum file sizes (Application/System to 128 MB, Setup to 32 MB, Security to 1 GB) guarantees that administrative security events are retained for auditing and forensic investigations.
Session & Credential Security: Restricting credential display on the lock screen, disabling Automatic Restart Sign-On (ARSO), prohibiting local password reset questions, and blocking cleartext MPR password transfers prevents credential exposure.
Windows Update Management: Disabling update pauses, managing feature update deferrals, and scheduling daily automatic installations ensures PAWs remain continuously patched against active vulnerabilities.

This parent requirement coordinates the 30 individual unitary hardening requirements defined in the dedicated admin-templates/ subsection for PAWs.

Legacy Impact & Compatibility

SMBv1 Deprecation: PAWs cannot connect to legacy storage appliances or pre-Windows Server 2008 systems that strictly require SMBv1. Tier 0 administrative management does not require SMBv1.
App Installer Protocol: Web-based "click-to-install" links utilizing ms-appinstaller:// will not launch automatically. Software must be installed via approved administrative deployment tools.
Internet Explorer 11: Standalone IE11 is disabled and redirects to Microsoft Edge; web browsing on PAWs is strictly prohibited or restricted to approved administrative portals.
Logon & Elevation: Password reveal buttons are hidden and UAC prompts require manual entry of administrative credentials.

Administrative Templates Hardening Requirements for PAWs

The following 30 unitary administrative template hardening controls must be enforced on PAWs:

Sources & Compliance References

CIS Microsoft Windows Client Benchmark: Section 18.4 (Network), Section 18.5 (MSS), Section 18.9 (System), and Section 18.10 (Windows Components)
ANSSI Active Directory Hardening Guide: Recommendations for Tier 0 Privileged Access Workstations (PAWs)
Microsoft Security Baseline: Windows Security Baseline for Privileged Access Workstations

REQ-PAW-029 - Configure System Administrative Templates for PAWs