[REQ-END-126] User Profile: Toast Notifications Lock Screen Restrictions

Target Scope

  • Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline REQ-PAW-115).
  • Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025.

Implementation Details

  • Priority: Medium
  • GPO Paths / Registry Locations:
    • Turn Off Toast Notifications on the Lock Screen:
      • GPO Path: User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen -> Enabled
      • GPO Path (Computer Alternative): Computer Configuration\Administrative Templates\System\Logon\Turn off app notifications on the lock screen -> Enabled
      • Registry Path: HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications
      • Value Name: NoToastApplicationNotificationOnLockScreen
      • Value Type: REG_DWORD
      • Value Data: 1 (Enabled / Block toast notifications above the lock screen)

Rationale

Modern desktop applications, productivity suites (Microsoft Teams, Outlook), communication channels, and identity tools routinely utilize Windows Push Notifications to display pop-up "toast" notification banners on the screen. By default, Windows allows applications to surface these notification banners "above the lock screen," presenting a major physical data leakage and credential compromise vulnerability.

1. Push Notification Architecture & Lock Screen Exposure

The Windows Push Notification Service (WNS) and Windows Action Center route application messages to the interactive desktop:

  • When an endpoint is locked (Win + L or inactivity screensaver timeout), the Windows logon subsystem (LogonUI.exe) renders the lock screen interface.
  • If lock screen notifications are not suppressed, LogonUI.exe renders toast notification banners in an overlay layer above the authentication prompt.
  • These notifications frequently expose:
    • Multi-Factor Authentication (MFA) Verification Codes: One-Time Passwords (OTPs), SMS codes, and authenticator number-matching prompts generated by identity platforms.
    • Confidential Enterprise Communications: Email sender, subject lines, and preview snippets from Microsoft Outlook or third-party email clients.
    • Direct Messaging Content: Meeting notices, confidential instant messages, and security monitoring alerts.
  • Any unauthenticated individual with physical proximity or line-of-sight to an unattended, locked workstation can harvest verification codes and confidential enterprise intelligence without needing to authenticate.

2. Threat Vectors & Shoulder Surfing Defense

  • Physical Proximity Credential Harvesting: In open-plan offices, shared conference facilities, or remote working spaces, shoulder surfing or opportunistic observation of lock screen notifications allows adversaries to complete secondary MFA challenges.
  • Session Hijacking Preparation: Attackers triggering password resets against an enterprise user can view the incoming OTP token displayed on the victim's locked screen to reset credentials.
  • Setting NoToastApplicationNotificationOnLockScreen = 1 enforces a strict privacy boundary, preventing all application notifications from rendering until the authenticated user unlocks the workstation.

3. MITRE ATT&CK Mapping

  • T1056 - Input Capture: Shoulder Surfing: Visually observing sensitive notification banners and MFA tokens on locked endpoints.
  • T1552 - Unsecured Credentials: Exploiting plaintext authentication codes displayed on screen.
  • T1204 - User Execution: Interacting with notification interfaces on unauthenticated displays.

Legacy Impact & Compatibility

  • User Notification Delivery: Notifications are not lost; they are queued in the background and presented immediately inside the Windows Action Center as soon as the user authenticates and unlocks their desktop.
  • Lock Screen Cleanliness: Enhances user privacy and eliminates distractions in meeting rooms or presentation scenarios where endpoints may be locked.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

  1. Open the Group Policy Management Console (gpmc.msc).
  2. Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints).
  3. Navigate to: User Configuration \ Administrative Templates \ Start Menu and Taskbar \ Notifications
  4. Double-click Turn off toast notifications on the lock screen and set it to Enabled.
  5. (Optional Defense-in-Depth) Navigate to: Computer Configuration \ Administrative Templates \ System \ Logon
    • Set Turn off app notifications on the lock screen to Enabled.
  6. Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force.

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Run the following script locally to disable toast notifications on the lock screen:

Download Script: Configure-Uptoastnotifications.ps1

# Configure-Uptoastnotifications.ps1
Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan

function Set-RegValue {
    [CmdletBinding(SupportsShouldProcess)]
    param (
        [string]$hive,
        [string]$keyPath,
        [string]$name,
        [string]$value,
        [string]$type
    )
    if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) {
        $fullPath = "$hive\$keyPath"
        $parent = Split-Path -Path $fullPath
        if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null }
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force
    }
}
Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord"

# Apply to Default User profile for new sessions
$DefaultHivePath = "C:\Users\Default\NTUSER.DAT"
if (Test-Path $DefaultHivePath) {
    reg load HKU\DefaultUser $DefaultHivePath | Out-Null
    $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications"
    if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null }
    Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force
    [GC]::Collect()
    [GC]::WaitForPendingFinalizers()
    reg unload HKU\DefaultUser | Out-Null
}

To audit the hardening status:

Download Script: Get-UptoastnotificationsStatus.ps1

# Get-UptoastnotificationsStatus.ps1
$script:Vulnerable = $false

function Test-RegValue {
    param (
        [string]$hive,
        [string]$keyPath,
        [string]$name,
        [string]$expected
    )
    $fullPath = "$hive\$keyPath"
    $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue
    $actual = if ($val) { $val.$name } else { "" }
    if ($actual -ne $expected) {
        $script:Vulnerable = $true
    }
}
Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1"

if ($script:Vulnerable) {
    Write-Output "Non-Compliant"
    exit 1
} else {
    Write-Output "Compliant"
    exit 0
}

Sources & Compliance References

  • CIS Benchmark: CIS Microsoft Windows 10 Enterprise Benchmark: Section 19.7.x; CIS Microsoft Windows 11 Enterprise Benchmark: Section 19.7.x
  • DISA STIG: Windows 10 STIG Rule WN10-CC-000135, Windows 11 STIG Rule WN11-CC-000135
  • ANSSI Active Directory Hardening Guide: Recommendation R37 (Securing user desktop profiles and preventing information disclosure)
  • Microsoft Security Guidance: Windows Push Notification Services (WNS) Security and Lock Screen Privacy Specifications

results matching ""

    No results matching ""