Configure System Administrative Templates

Target Scope

Applicable Systems: Tier 2 client workstations and member servers.
Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above).

Implementation Details

Priority: High
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Policies\Administrative Templates\...
- Registry Location: Multiple locations under HKLM\SOFTWARE\Policies and HKLM\SYSTEM\CurrentControlSet (see individual requirements below)

Rationale

Administrative templates govern system-wide capabilities, behaviors, network protocols, diagnostic logging, and component features. Hardening these configurations reduces the attack surface and mitigates critical attack vectors, including credential theft, lateral movement, unauthorized software deployment, and remote exploitation:

Protocols Hardening: Disabling legacy SMBv1 components stops known remote code execution flaws (e.g., EternalBlue), and enforcing NetBT P-node prevents broadcast spoofing and relay attacks.
Data Collection & Telemetry: Restricting diagnostic log collection, crash dump generation, feedback prompts, and dynamic cloud settings (OneSettings) prevents in-memory credential disclosure and limits external telemetry.
App & Installer Restrictions: Disallowing per-user unsigned app packages, preventing non-admin packaged app installation, and blocking the ms-appinstaller protocol handler closes primary drive-by malware delivery paths.
Log Retention & Forensic Buffer: Expanding event log maximum file sizes (Application/System to 128 MB, Setup to 32 MB, Security to 1 GB) guarantees that critical security events are retained for auditing and forensic investigations.
Session & Credential Security: Restricting credential display on the lock screen, disabling Automatic Restart Sign-On (ARSO), prohibiting local password reset questions, and blocking cleartext MPR password transfers prevents credential exposure.
Windows Update Management: Disabling update pauses, managing feature update deferrals, and scheduling daily automatic installations ensures workstations remain continuously patched against active vulnerabilities.

This parent requirement coordinates the 30 individual unitary hardening requirements defined in the dedicated admin-templates/ subsection.

Legacy Impact & Compatibility

SMBv1 Deprecation: Workstations cannot connect to legacy storage appliances or pre-Windows Server 2008 systems that strictly require SMBv1.
App Installer Protocol: Web-based "click-to-install" links utilizing ms-appinstaller:// will not launch automatically. Software must be installed via approved administrative deployment tools.
Internet Explorer 11: Standalone IE11 is disabled and redirects to Microsoft Edge; legacy intranet sites requiring Trident rendering must be configured through Microsoft Edge IE Mode.
Logon & Elevation: Password reveal buttons are hidden and UAC prompts require manual entry of administrative credentials.

Administrative Templates Hardening Requirements

The following 30 unitary administrative template hardening controls must be enforced:

Sources & Compliance References

CIS Microsoft Windows Client Benchmark: Section 18.4 (Network), Section 18.5 (MSS), Section 18.9 (System), and Section 18.10 (Windows Components)
ANSSI Active Directory Hardening Guide: Recommendations on protocol minimization, credential isolation, and client baselines
Microsoft Security Baseline: Windows Client Security Baseline recommendations

REQ-END-026 - Configure System Administrative Templates