[REQ-PAW-115] User Profile: Toast Notifications Lock Screen Restrictions for PAWs

Target Scope

  • Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline REQ-END-126).
  • Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise.

Implementation Details

  • Priority: Medium
  • GPO Paths / Registry Locations:
    • Turn Off Toast Notifications on the Lock Screen:
      • GPO Path: User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen -> Enabled
      • GPO Path (Computer Alternative): Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen -> Enabled
      • Registry Path: HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications
      • Value Name: NoToastApplicationNotificationOnLockScreen
      • Value Type: REG_DWORD
      • Value Data: 1 (Enabled / Strictly suppress toast notifications above the lock screen)

Rationale

Privileged Access Workstations (PAWs) operate in high-security operations centers (SOC/NOC) or dedicated administrative enclaves. Tier 0 administrative operators interact with domain controllers, public key infrastructure (PKI), and cloud identity tenants. Allowing application notifications to render above the lock screen exposes highly confidential administrative context and authentication challenges to physical observation.

1. Notification Architecture & Lock Screen Vulnerabilities

The Windows Push Notification Service and notification routing subsystem allow applications to display pop-up toasts on the interactive desktop:

  • When a PAW operator locks their station or leaves it unattended, the system transitions to LogonUI.exe.
  • By default, toast notifications generated by background administrative agents, management consoles, or communication utilities render above the lock screen overlay.
  • This can leak:
    • Multi-Factor Authentication (MFA) Prompts: Number-matching prompts, SMS one-time passcodes, and Push authentication requests.
    • System Health and Alert Data: Sensitive Active Directory replication alerts, account lockout notifications, or security event warnings containing internal server names and usernames.
    • Administrative Chat Snippets: Confidential internal messages containing infrastructure IP addresses or incident response details.

2. Tier 0 Physical Security & Zero-Trust Posture

  • Physical Shoulder Surfing Defense: Any individual with line-of-sight to the PAW screen—including maintenance staff, visitors, or unbadged personnel—could observe sensitive identity alerts or intercept MFA verification codes.
  • Preserving Console Privacy: Setting NoToastApplicationNotificationOnLockScreen = 1 enforces the core PAW principle that no internal state or sensitive data may be disclosed unless the operator is actively authenticated.
  • Notifications are cleanly preserved in the Action Center and become accessible immediately once the administrator enters their PIN or smart card credentials.

3. MITRE ATT&CK Mapping

  • T1056 - Input Capture: Shoulder Surfing: Visually capturing administrative MFA codes and operational alerts on locked displays.
  • T1552 - Unsecured Credentials: Observing plaintext verification tokens on unauthenticated screens.
  • T1204 - User Execution: Interacting with notification interfaces on unauthenticated displays.

Legacy Impact & Compatibility

  • PAW Dedicated Role: PAWs do not run social or consumer messaging apps. Administrative notifications from Windows Defender or management scripts are simply queued until unlock.
  • Zero Operational Disruption: Legitimate administrative tasks, RSAT tooling, and PowerShell workflows operate without disruption.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

  1. Open the Group Policy Management Console (gpmc.msc).
  2. Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW).
  3. Navigate to: User Configuration \ Administrative Templates \ Start Menu and Taskbar \ Notifications
  4. Double-click Turn off toast notifications on the lock screen and set it to Enabled.
  5. (Optional Defense-in-Depth) Navigate to: Computer Configuration \ Administrative Templates \ System \ Logon
    • Set Turn off app notifications on the lock screen to Enabled.
  6. Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force.

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Run the following script locally to disable toast notifications on the lock screen on the PAW console:

Download Script: Configure-PawUptoastnotifications.ps1

# Configure-PawUptoastnotifications.ps1
Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan

function Set-RegValue {
    [CmdletBinding(SupportsShouldProcess)]
    param (
        [string]$hive,
        [string]$keyPath,
        [string]$name,
        [string]$value,
        [string]$type
    )
    if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) {
        $fullPath = "$hive\$keyPath"
        $parent = Split-Path -Path $fullPath
        if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null }
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force
    }
}
Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord"

# Apply to Default User profile for new sessions
$DefaultHivePath = "C:\Users\Default\NTUSER.DAT"
if (Test-Path $DefaultHivePath) {
    reg load HKU\DefaultUser $DefaultHivePath | Out-Null
    $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications"
    if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null }
    Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force
    [GC]::Collect()
    [GC]::WaitForPendingFinalizers()
    reg unload HKU\DefaultUser | Out-Null
}

To audit the hardening status:

Download Script: Get-PawUptoastnotificationsStatus.ps1

# Get-PawUptoastnotificationsStatus.ps1
$script:Vulnerable = $false

function Test-RegValue {
    param (
        [string]$hive,
        [string]$keyPath,
        [string]$name,
        [string]$expected
    )
    $fullPath = "$hive\$keyPath"
    $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue
    $actual = if ($val) { $val.$name } else { "" }
    if ($actual -ne $expected) {
        $script:Vulnerable = $true
    }
}
Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1"

if ($script:Vulnerable) {
    Write-Output "Non-Compliant"
    exit 1
} else {
    Write-Output "Compliant"
    exit 0
}

Sources & Compliance References

  • CIS Benchmark: CIS Microsoft Windows 10 Enterprise Benchmark: Section 19.7.x; CIS Microsoft Windows 11 Enterprise Benchmark: Section 19.7.x
  • DISA STIG: Windows 10 STIG Rule WN10-CC-000135, Windows 11 STIG Rule WN11-CC-000135
  • ANSSI Active Directory Hardening Guide: Recommendation R37 (Securing administrative workstations and preventing information disclosure)
  • Microsoft Privileged Access Guidance: Clean Source Principle: PAW Administrative Architecture and Physical Security

results matching ""

    No results matching ""