5.11.2 2026-09-09T14:09:16Z Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 To successfully enforce the administrative tiering model, the boundaries must be programmatically restricted. Active Directory administrative groups (such as `Domain Admins`, `Enterprise Admins`, and `Schema Admins`) must be explicitly blocked from authenticating to lower-tier systems. If these permissions are not restricted, a Tier 0 administrator might use their account to troubleshoot a Tier 1 server or Tier 2 workstation. This action caches their administrative password hash or Kerberos Ticket Granting Ticket (TGT) in the local memory of the target machine. If that machine has been compromised, an attacker can extract those credentials and compromise the entire Active Directory domain. By configuring Group Policy objects to explicitly deny logon rights (interactive, network, and Remote Desktop) for high-tier administrative accounts on lower-tier systems, you prevent accidental or unauthorized exposure of high-privilege credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Remote management protocols like Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) are critical interfaces for directory administration. However, if these protocols are accessible from any host in the network, they become high-value targets for attackers. If an attacker compromises a standard user workstation (Tier 2), they can run network scanners to identify all machines listening on port 3389 (RDP) or 5985/5986 (WinRM). They can then attempt password spraying or locate open administrative sessions. Restricting administrative protocols at the network and local firewall levels to allow inbound connections *only* from designated administrative jump hosts or PAW IP ranges stops lateral movement and brute-force attempts from standard user networks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Attackers who gain initial access to an Active Directory domain attempt to elevate their privileges to Tier 0. A primary method for establishing domain persistence is adding compromised domain accounts to highly privileged administrative groups, such as `Domain Admins`, `Enterprise Admins`, `Schema Admins`, or `Builtin\Administrators`. If these groups are not audited continuously: 1. **Backdoor Persistence**: Attackers can add temporary users to administrative groups and remove them later, leaving backdoor accounts with administrative authority that go unnoticed. 2. **Privilege Creep**: Unmanaged administrative accounts accumulate over time, violating the principle of least privilege. 3. **Delegation Risks**: Administrative accounts can inherit unintended administrative rights if nested within other groups. Enforcing advanced auditing on directory object changes, combined with a daily script to monitor privileged group members, ensures immediate visibility into unauthorized modifications. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Domain Functional Level (DFL) and Forest Functional Level (FFL) dictate the capabilities of the Active Directory (AD) infrastructure. While upgrading the Operating System of Domain Controllers (DCs) improves the underlying OS security, the AD logic remains constrained by the functional level. Maintaining an obsolete DFL forces Domain Controllers to emulate legacy behaviors and protocols to ensure backward compatibility with non-existent older DCs. This emulation effectively creates a ceiling for your security posture, preventing the activation of modern identity protection mechanisms. Raising the functional level is critical for hardening because it unlocks architectural security changes that mitigate credential theft and lateral movement. Specifically, higher functional levels are prerequisites for: 1. **Protected Users Group**: Mandates restrictions that prevent caching of NTLM credentials, disable Kerberos DES/RC4 keys, and prevent caching of plaintext passwords. 2. **Group Managed Service Accounts (gMSAs)**: Eliminates static service account passwords by automating 120-character key rotation. 3. **Kerberos Armoring (FAST)**: Protects Kerberos tickets and exchanges against offline dictionary attacks and ticket manipulation. 4. **Deprecating Legacy Replication**: Disables insecure File Replication Service (FRS) in favor of DFS Replication (DFSR). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modifying the Default Domain Policy (DDP) and Default Domain Controllers Policy (DDCP) introduces significant operational risks. These default policies define the core directory baseline configurations required for Active Directory to initialize, replicate, and authenticate. However, a critical exception to modular Group Policy design applies to **Account Policies** (Password, Account Lockout, and Kerberos settings) and **Encrypting File System (EFS)** policies. Windows operating systems only process domain-wide Account Policies from the GPO linked directly to the domain root (by default, the Default Domain Policy). Custom GPOs linked at lower levels containing these settings will be ignored for domain accounts. Therefore, these specific baselines must be configured directly within the Default Domain Policy itself. All other custom hardening settings (such as local User Rights Assignments, Audit Policies, and registry parameters) should be managed via dedicated modular GPOs (e.g., `SEC_DomainControllers_Hardening`) linked at higher precedence. Integrating the following controls inside the DDP/DDCP and custom GPOs completes the Active Directory management baseline: 1. **Disabling Encrypting File System (EFS)**: EFS allows users to encrypt files on local drives. This makes files difficult to recover or back up securely. Enterprise environments should enforce full-disk encryption (BitLocker) rather than user-managed file-level encryption. Disabling EFS prevents unauthorized user-level encryption. 2. **Enforcing Group Policy Background Refresh**: Ensuring that Group Policy background refresh is active prevents unauthorized local overrides from persisting. Setting the policy `Turn off background refresh of Group Policy` to **Disabled** ensures that GPOs are reapplied every 90 minutes. 3. **Mandating GPO Comments**: Documenting the purpose, author, and revision history in the GPO comments field ensures accountability and prevents configuration drift. 4. **Restricting gpupdate /force Overuse**: Running `gpupdate /force` causes endpoints and servers to re-download all applied GPOs from Domain Controllers. In large environments, this can trigger severe network congestion and CPU spikes on DCs. Administrators should use standard `gpupdate` without the `/force` switch unless a full re-application of unchanged policies is required. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory trust relationships permit authentication and resource access across domain or forest boundaries. However, weak trust configurations can serve as transit routes for attackers to compromise trusting domains. Specifically: 1. **SID History**: Enabling SID History allows users from a trusted forest to present security identifiers (SIDs) from other domains, bypass SID filtering, and potentially impersonate high-privilege administrators in the trusting forest. Disabling SID History on external/forest trusts prevents this path of escalation. 2. **SID Filtering / Quarantine**: Enabling Quarantine (SID Filtering) on external trusts ensures that the trusting domain filters out unauthorized SIDs presented in authorization packets, restricting access only to SIDs originating from the trusted domain itself. 3. **Kerberos TGT Delegation**: If TGT delegation is allowed on inbound trusts, a user authenticating from the trusted forest to a service in the trusting domain can have their Kerberos Ticket Granting Ticket (TGT) delegated to that service. If that service or host is compromised, the attacker can harvest the user's TGT and impersonate them. Blocking TGT delegation is critical to prevent credential exposure. 4. **Selective Authentication**: Enforcing selective authentication restricts cross-forest access, allowing administrators to explicitly define which users/groups from the trusted forest can authenticate to specific resources in the trusting forest. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, installing Microsoft Exchange Server in an Active Directory forest modifies the permissions of the domain root object. It grants the **Exchange Windows Permissions** group (and sometimes **Exchange Servers**) write permissions (`WriteDacl` and `WriteOwner`) over the domain root container. This configuration presents a critical security risk: 1. **Privilege Escalation**: Any user or service account with administrative control over Exchange, or any compromised Exchange server itself, can write new permissions to the domain root. 2. **DCSync Exploitation**: The attacker can grant their own account the `ds-Replication-Get-Changes` and `ds-Replication-Get-Changes-All` (DCSync) extended rights. This allows the attacker to dump password hashes directly from the domain controller database (NTDS.dit), leading to a complete forest compromise. Restricting these write permissions ensures that Exchange servers cannot modify domain-level security descriptors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 SMBv1 (Server Message Block version 1) is a legacy networking protocol designed over 30 years ago. It lacks modern security features such as packet encryption, cryptographic signing enforcement, and robust integrity verification. SMBv1 contains severe remote code execution (RCE) vulnerabilities (e.g., the EternalBlue vulnerability mitigated in MS17-010). Attackers can exploit SMBv1 to execute commands remotely, capture credentials, or perform lateral movement across the domain network. Domain Controllers (Tier 0) are highly sensitive targets, and keeping SMBv1 enabled presents an unacceptable risk. Disabling both the server protocol and the client driver eliminates this entire attack surface. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS), and multicast DNS (mDNS) are fallback name resolution protocols. When a Windows host is unable to resolve a name via standard DNS, it broadcasts the query to the local subnet using these protocols. Adversaries on the same subnet can easily sniff these broadcast/multicast queries and respond with their own IP address (using tools such as Responder). When the requesting client attempts to authenticate to the fake host, its NTLM credentials (specifically NTLMv2 hashes) are captured by the attacker. These hashes can then be cracked offline or relayed to other hosts on the network (e.g., Active Directory Certificate Services or SMB servers) to achieve unauthorized administrative access. Disabling these legacy fallback protocols eliminates these name resolution spoofing attack vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 NTLMv1 (NT LAN Manager version 1) is a legacy authentication protocol that relies on weak cryptographic primitives (specifically MD4 and DES). Because of these mathematical weaknesses, an attacker who intercepts NTLMv1 network authentication traffic can decrypt the responses offline in a matter of minutes, recovering the user's plaintext password or NT hash. By configuring the system to send only NTLMv2 responses and refuse both LM and NTLMv1 negotiations (corresponding to LAN Manager Compatibility Level 5), the system enforces the use of NTLMv2, which implements HMAC-MD5 and provides significantly stronger protection against offline cryptographic analysis. It also ensures that the directory environment moves closer to Kerberos-exclusive authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Lightweight Directory Access Protocol (LDAP) traffic transmitted over cleartext (TCP port 389) without signing is vulnerable to eavesdropping and man-in-the-middle (MitM) attacks. An adversary in a position to intercept network traffic can inject malicious payload packets, modify directory responses, or perform session hijacking. Enforcing LDAP signing ensures that the LDAP server (Domain Controller) rejects simple binds that are not encrypted or signed. It mandates data integrity verification via cryptographically secure signatures on the network packets. This directly mitigates the threat of LDAP relay and injection attacks, securing the communication path between directory clients and Domain Controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Adversaries use credential relay attacks (such as NTLM relaying) to intercept authentication challenges and replay them to other network services. In a coercion attack (e.g., the PetitPotam technique), an attacker forces a Domain Controller to authenticate to a malicious listener using NTLM. The attacker then relays these credentials to Active Directory Certificate Services (ADCS) or an LDAPS server to issue administrative certificates or modify directory databases. LDAP Channel Binding Tokens (CBT) mitigate these relay attacks. CBT establishes a cryptographic link between the transport-level security channel (TLS/SSL) and the application-level authentication protocol (SASL/NTLM/Kerberos). By requiring CBT verification on the LDAP server, the Domain Controller verifies that the authentication request originated from within the specific TLS channel used to send it. If an attacker attempts to relay credentials from a different session, the channel parameters will not match, and the Domain Controller will reject the authentication request. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (LSASS) process (`lsass.exe`) is responsible for enforcing security policies, handling user authentication, and storing sensitive credential secrets (such as Kerberos tickets, NT hashes, and cached credentials) in memory. Adversaries who gain local administrative rights frequently target LSASS using memory-dumping tools (e.g., Mimikatz, Procdump) to extract these credentials, leading to domain-wide compromise and lateral movement. Enabling LSA Protection configures LSASS to run as a Protected Process Light (PPL). When running as a PPL, the operating system uses security boundaries to prevent non-protected processes (even those running with local administrator or SYSTEM privileges) from accessing LSASS memory space via debugging APIs (`OpenProcess` with read/write permissions) or injecting DLLs. This significantly increases the difficulty of offline credential harvesting. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) should be enabled on Domain Controllers to protect the integrity of the operating system kernel and enforce driver blocklists. However, Windows Defender Credential Guard must **not** be deployed on Active Directory domain controllers. Credential Guard is designed to isolate LSA secrets to prevent credential-dumping tools from harvesting password hashes from local memory. Domain controllers do not store user credentials in LSASS memory in the same way member servers do; instead, credentials are stored securely in the Active Directory database (ntds.dit). Furthermore, domain controllers run LSASS in a manner that requires active cryptographic operations and delegation capabilities that are incompatible with the restrictions imposed by Credential Guard. Enabling Credential Guard on a domain controller can lead to authentication failures, block Kerberos delegation features, and cause operational instability without providing any security benefits. For official warnings and product specifications, refer to the Microsoft documentation: [Microsoft Security Guidance: Windows Defender Credential Guard Warnings](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/) Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Print Spooler service (`Spooler`) is enabled and running by default on Windows Server installations, including Domain Controllers. However, Domain Controllers do not print and should never act as print servers. The Print Spooler service has a history of high-severity vulnerabilities, including remote code execution exploits (e.g., the PrintNightmare vulnerability family - CVE-2021-1675 / CVE-2021-34527). Additionally, the service is exploited in coercion attacks such as the PetitPotam technique or printer-based authentication coercion. An attacker with low-privilege network access can send an RPC request to the DC's Print Spooler service (specifically utilizing APIs such as `RpcRemoteFindFirstPrinterChangeNotificationEx`), forcing the Domain Controller to authenticate to a malicious listener over NTLM. The attacker can then relay this authentication to take over the Active Directory domain. Disabling the service completely closes these high-risk vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Server Message Block (SMB) authentication is vulnerable to man-in-the-middle (MitM) and relay attacks. If SMB signing is not enforced, an attacker positioned on the local network can intercept SMB authentication sessions from client systems and relay them to another host (e.g., a Domain Controller or high-value member server). If the relayed user credential possesses administrative rights on the target host, the attacker can execute commands remotely (e.g., via PsExec/WMI) and compromise the system without knowing the password. Enforcing SMB signing ensures that all SMB packets are digitally signed using session keys. This guarantees the authenticity of both the sender and the receiver and ensures packet integrity. If an attacker attempts to relay or modify the packets, the cryptographic signature check fails, and the session is terminated. Enforcing this on both server and client roles is a fundamental defense against lateral movement and domain takeover. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory uses the Kerberos version 5 protocol as its primary authentication mechanism. By default, Active Directory maintains backward compatibility with legacy cryptographic suites, including Data Encryption Standard (DES) and Rivest Cipher 4 (RC4-HMAC). Allowing these legacy ciphers introduces severe architectural vulnerabilities: 1. **Cryptographic Weaknesses of RC4-HMAC (RFC 4757)**: * **Key Derivation Flaw**: Under the RC4-HMAC Kerberos specification, the long-term secret key used to encrypt tickets is identical to the user's NTLM password hash (`MD4(UTF-16LE(password))`). No salt, no iteration count, and no cryptographic key derivation function (KDF) stretching are applied. * **AES vs. RC4 Cryptography**: In contrast, Kerberos AES encryption (RFC 3961 and RFC 3962) utilizes PBKDF2 with HMAC-SHA1, an account-specific salt (`DOMAINusername`), and a default work factor of 4,096 iterations. Cracking an AES Kerberos key requires exponentially more computational effort per guess than RC4. 2. **Kerberoasting & Cipher Downgrade Attacks (MITRE ATT&CK T1558.003)**: * Any authenticated domain user can request a Ticket Granting Service (TGS) ticket for any account with a registered Service Principal Name (SPN). * In a cipher downgrade attack, an attacker crafts a Kerberos `TGS-REQ` specifying only `rc4-hmac` (encryption type `23`) in the requested encryption type list. If RC4 is permitted on the Key Distribution Center (KDC), the KDC issues an RC4-encrypted service ticket—even if the target service account supports AES. * Because RC4 tickets use the raw NTLM hash, attackers can crack the extracted ticket offline using modern GPU rigs (Hashcat mode `13100`) at rates exceeding billions of guesses per second. By restricting KDC encryption types to AES-128 and AES-256, the KDC strictly rejects requests for weak ciphers, neutralizing Kerberoasting downgrade attacks. 3. **AS-REP Roasting Protection (MITRE ATT&CK T1558.004)**: * For accounts with Kerberos pre-authentication disabled (`DONT_REQ_PREAUTH` flag enabled), any domain user can request an AS-REP authentication ticket from the KDC without supplying credentials. * If RC4 is enabled, the returned AS-REP ticket is encrypted using the target account's RC4/NTLM hash, allowing high-speed offline dictionary attacks (Hashcat mode `18200`). Enforcing AES ensures the KDC encrypts the AS-REP using PBKDF2-stretched AES keys. 4. **Mitigating Forged Golden & Silver Tickets (MITRE ATT&CK T1558.001 / T1558.002)**: * When an attacker extracts NTLM password hashes (e.g., via DCSync against `krbtgt` or a service account), they can forge arbitrary Kerberos Ticket Granting Tickets (TGTs - Golden Tickets) or Service Tickets (Silver Tickets) using RC4. * When RC4 is disabled domain-wide, domain members and Domain Controllers reject RC4-encrypted tickets outright. Attackers are forced to obtain the actual AES-128 or AES-256 keys, which are not exposed through simple NTLM hash dumping or relay mechanisms. 5. **PAC Signature Integrity & CVE-2022-37967 Enforcement**: * The Privilege Attribute Certificate (PAC) contains the user's authorization data, security identifiers (SIDs), and group memberships. * Security updates for CVE-2022-37967 / KB5020805 require strong HMAC-SHA1 AES algorithms for PAC signatures (`KERB_CHECKSUM_HMAC_SHA1_96_AES128` / `KERB_CHECKSUM_HMAC_SHA1_96_AES256`). Disabling RC4 guarantees consistent cryptographic security across ticket encryption, session key derivation, and PAC checksum verification. 6. **Overpass-the-Hash / Pass-the-Key Defense**: * In an Overpass-the-Hash attack, an attacker uses an NTLM hash as the Kerberos RC4 key to request a valid TGT. Enforcing AES-only requires authentication to use AES keys, preventing attackers from converting raw NTLM hashes into Kerberos tickets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, the Security Account Manager (SAM) and NT Directory Services (NTDS) allow remote RPC connections from non-privileged accounts. Using these connections, an attacker who has established a foothold in the network (even with a basic, non-administrative domain user account) can query the Domain Controller or member servers to enumerate local users, group memberships, and security policies. Tools like BloodHound/SharpHound, or simple commands like `net user /domain`, rely on these remote SAM RPC interfaces to extract information for network profiling and lateral movement mapping. Restricting remote client access to the SAM API (utilizing `RestrictRemoteSAM`) ensures that only members of the built-in Administrators group can make remote RPC queries. This significantly reduces the recon capabilities of an internal attacker. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory environments relying on standard Kerberos authentication are susceptible to offline brute-force, dictionary attacks, and credential harvesting. During the initial Kerberos pre-authentication phase, the client requests a Ticket Granting Ticket (TGT) in clear text by sending an AS-REQ containing encrypted timestamps. Attackers monitoring network traffic can intercept these exchanges, or perform AS-REP roasting against accounts that do not require pre-authentication, conducting offline password cracking to compromise credentials. Kerberos Armoring, also known as Flexible Authentication Secure Tunneling (FAST - RFC 6113), mitigates this vulnerability by establishing an encrypted channel (a secure tunnel) between the Kerberos client and the Key Distribution Center (KDC) on the Domain Controller. This tunnel is encrypted using the computer account's credential (or the local system's credential), protecting the pre-authentication messages (AS-REQ and AS-REP) from eavesdropping, offline dictionary attacks, and tampering. Additionally, Kerberos Armoring is a strict prerequisite for Dynamic Access Control (DAC), Compound Authentication (which validates both the user's and the device's identities before granting access), and Authentication Silos. On Windows Server 2016 and newer domain controllers, configuring KDC support for the PKInit Freshness Extension (RFC 8070) further strengthens public key authentication by ensuring that certificates cannot be reused in pre-authentication replay attacks. Domain Controllers function both as KDC servers handling authentication requests and as Kerberos clients during domain controller replication, directory operations, and inter-forest authentication. Consequently, both KDC-side and client-side Kerberos armoring policies must be enabled on all Domain Controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The NT LAN Manager (NTLM) authentication protocol is legacy, cryptographically weak, and lacks support for modern security primitives such as mutual authentication. Adversaries exploit NTLM through credential relaying attacks (e.g., replaying captured authentication responses to other network services) and coercion techniques (e.g., PetitPotam or printer spooler RPC abuse). By auditing and subsequently restricting NTLM authentication incoming to, outgoing from, and within the Active Directory domain, organizations significantly mitigate the risks of credential relaying, offline password cracking, and unauthorized lateral movement. Restricting NTLM pushes client machines and application servers to utilize Kerberos, which provides robust mutual authentication and support for advanced cryptographic algorithms. Microsoft has also announced the eventual deprecation of NTLM, making active restriction an essential step in future-proofing active directory directory services. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory domain environments rely on replication to synchronize GPO templates and scripts stored in the `SYSVOL` share across all Domain Controllers. Historically, this replication was managed by the File Replication Service (FRS). However, FRS is obsolete, does not support modern transport-layer security features, and is prone to replication database corruption. Migrating to Distributed File System Replication (DFSR): 1. **Ensures Replication Integrity**: DFSR uses remote differential compression algorithms and hash validation to verify that files are replicated securely and without corruption. 2. **Minimizes Attack Surface**: Transitioning to DFSR allows security administrators to completely disable and deprecate the legacy, insecure FRS service and its associated RPC endpoints. 3. **Improves Diagnostics**: DFSR provides comprehensive logging, system health auditing, and diagnostic reports, allowing quick identification of synchronization failures. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In Active Directory, the `adminSDHolder` object acts as a security template for administrative accounts and groups (known as protected objects). Every hour, a background system thread (the `AdminSDHolder` task, also referred to as the `ProtectAdminGroups` task) running on the Domain Controller holding the PDC Emulator role compares the Access Control Lists (ACLs) of all protected objects against the ACL of the `adminSDHolder` object. If they differ, the ACL on the protected object is overwritten by the ACL on `adminSDHolder`, and security inheritance is disabled. A common misconception is that the Security Descriptor Propagator (`SDProp`) thread enforces this protection. In reality, `SDProp` is a separate background thread on all Domain Controllers whose sole job is to propagate inheritable Access Control Entries (ACEs) when an object is moved or a parent ACL is modified. The actual enforcement of the `adminSDHolder` template is performed exclusively by the `AdminSDHolder` background task. If an attacker gains temporary write permissions on the `adminSDHolder` object, they can inject a backdoor Access Control Entry (ACE) granting their account write permissions. Within an hour, the `AdminSDHolder` background task will apply this backdoor ACE to all protected groups (e.g., Domain Admins, Schema Admins, Enterprise Admins). Even if the administrator cleans up permissions on a Domain Admin account directly, the `AdminSDHolder` task will restore the backdoor ACE on its next run. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In Active Directory-integrated DNS environments, DNS configuration settings, zones, and resource records are stored directly within the directory and managed via the Microsoft DNS Server service. By default, the built-in `DnsAdmins` group possesses management rights over the DNS service, while standard authenticated domain users possess rights to register new DNS records in AD-integrated zones. This configuration exposes Domain Controllers and Active Directory to critical attack vectors: 1. **DNS Service DLL Hijacking (`ServerLevelPluginDll`)**: The Microsoft DNS Server management RPC interface permits members of `DnsAdmins` (and accounts with write control over the DNS server configuration) to set the `ServerLevelPluginDll` parameter using `dnscmd.exe /config /serverlevelplugindll \\path\to\malicious.dll`. Because the DNS Server service runs as `NT AUTHORITY\SYSTEM` on Domain Controllers, the service loads this DLL upon restart or server reboot, executing arbitrary code with SYSTEM privileges and granting full Domain Controller compromise (effectively making `DnsAdmins` a Tier 0 equivalent group). 2. **ADIDNS Record Spoofing & Kerberos Reflection (Ghost-SPN)**: In Active Directory Integrated DNS (ADIDNS) zones, the root container DACL grants `Authenticated Users` the `Create all child objects` right (specifically `Create dnsNode objects`) by default. This allows any standard domain user or compromised workstation account to register arbitrary DNS records. Attackers exploit this capability to register Unicode homoglyphs (such as `․` U+2024 or `Ⓡ` U+00AE) matching high-value servers or Domain Controllers. When clients request Kerberos service tickets (TGS-REQ) for an SPN like `HOST/target`, Kerberos linguistic normalization canonicalizes the homoglyph SPN to ASCII (matching the legitimate target), while the Windows DNS client resolves the IP via the attacker's ADIDNS homoglyph record, allowing Kerberos AP-REQ reflection attacks (CVE-2025-58726 / Synacktiv research) and WPAD hijacking. 3. **Partition Directory DACL Tampering**: Modern AD environments store DNS zones across dedicated Application Directory Partitions (`DomainDnsZones` and `ForestDnsZones`) as well as the legacy `CN=System` container. Write access on these containers allows non-Tier 0 identities to modify zone delegations, poison records, manipulate SOA/NS records, or grant themselves persistent backdoor rights. Enforcing GPO-based restriction on `DnsAdmins`, purging `ServerLevelPluginDll`, enforcing Secure Dynamic Updates, and removing arbitrary child record creation rights on ADIDNS zones ensures that the directory DNS infrastructure strictly adheres to the Tier 0 administrative boundary. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In modern IT environments, Domain Controllers (DCs) are frequently virtualized. However, a virtualized DC is only as secure as the physical host and hypervisor running it. If a hypervisor hosting a DC is compromised, an attacker can: 1. **Harvest NTDS.dit Offline**: Copy the virtual hard disk file (VHDX/VMDK) of the running DC and extract all domain password hashes offline. 2. **Manipulate Memory**: Dump the guest DC's LSASS memory directly from the hypervisor console, exposing active Tier 0 administrator credentials. 3. **Inject Arbitrary Commands**: Use integration tools (like Hyper-V Integration Services or VMware Tools) to run code within the guest OS without authenticating. To mitigate these risks: * **Host Segregation**: Hypervisors hosting Tier 0 Domain Controllers must be dedicated exclusively to Tier 0 workloads. Lower-tier virtual machines (Tier 1/2) must never run on the same physical host clusters. * **Administrative Isolation**: The virtualization hosts and management consoles (e.g., vCenter, Hyper-V Manager) must be managed exclusively by Tier 0 administrative accounts. * **Virtual Machine Security**: Enable shielded VMs or VM encryption options to cryptographically lock the guest OS resources and protect virtual disks from unauthorized access. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Remote Desktop Protocol (RDP) is a standard tool for administrative sessions. However, by default, RDP authenticates users by placing their credentials (NTLM hashes or Kerberos tickets) directly in the Local Security Authority Subsystem Service (LSASS) memory of the destination host. If an administrator connects to a compromised host (such as a Tier 1 server or Tier 2 workstation) from their workstation using standard RDP, an attacker with local administrator privileges on that target system can dump LSASS and harvest the administrator's credentials. This allows the attacker to compromise the administrator's account and move laterally or escalate privileges. Enforcing RDP Restricted Admin Mode (RDP RA) prevents credential harvesting: 1. **Blocks Credential Transmission**: Under Restricted Admin mode, the client does not send the user's plaintext password, NTLM hash, or Kerberos TGT to the remote host. The host validates the connection without caching reusable credentials in its LSASS database. 2. **Limits Remote Session Privilege**: In network access attempts initiated from within the RDP session, the remote session runs in the security context of the destination machine's computer account (`$MachineName$`) rather than the administrator's user account. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers are Tier 0 administrative assets and must never be used for general-purpose tasks like web browsing, document viewing, or running unapproved utilities. Attackers who compromise a Domain Controller or obtain administrative access often attempt to execute custom binaries, remote access tools (RATs), or script-based tools to pivot, establish persistence, or extract the Active Directory database (NTDS.dit). Enforcing AppLocker policies on Domain Controllers provides the following defense-in-depth security benefits: 1. **Restricts Execution to Authorized Software**: Prevents execution of unapproved software, preventing standard user directories (such as `C:\Users\` or `C:\Windows\Temp\`) from being used to launch malicious binaries or scripts. 2. **Blocks Browser Execution**: Prevents administrative users from launching web browsers (Chrome, Edge, Firefox, Internet Explorer) directly on Domain Controllers, shutting down web-based drive-by downloads and browser-based credential leakage. 3. **Restricts Windows Installer and Script Execution**: Prevents unauthorized `.msi` installations and unauthorized PowerShell or VBScript scripts from running, reducing the likelihood of successful exploitation via living-off-the-land techniques. 4. **Defends Against AppLocker Bypasses**: Abusing trusted, signed Microsoft binaries (such as `msbuild.exe`, `installutil.exe`, `regasm.exe`, `regsvcs.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under `%WINDIR%` (such as `Tasks`, `Temp`, `tracing`, `spool\drivers\color`, etc.). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections. In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the **Microsoft Vulnerable Driver Blocklist** via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to **Kernel Mode Code Integrity (KMCI) only** (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits without introducing administrative overhead or blocking standard user-mode server applications and utilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `dSHeuristics` attribute is a Unicode string that defines forest-wide heuristic configuration settings for Active Directory. Individual characters at specific indices (1-based) modify security and protocol behaviors on Domain Controllers: 1. **fLDAPBlockAnonOps** (7th character): Controls anonymous LDAP operations. If set to `2`, anonymous binds and searches are permitted, allowing unauthorized users to map out directory structures. Setting it to `0` blocks anonymous operations. 2. **fAllowAnonNSPI** (8th character): Controls anonymous access to the Name Service Provider Interface (NSPI). If set to `1` or any value other than `0`, anonymous clients can query address books, which allows user enumeration. Setting it to `0` restricts NSPI queries to authenticated users. 3. **dwAdminSDExMask** (16th character): Excludes administrative groups from the automatic security descriptor protection mechanism (the `AdminSDHolder` background task). By default (`0`), groups like Account Operators, Server Operators, Print Operators, and Backup Operators are protected. If set to non-zero, this protection is bypassed, risking privilege escalation. 4. **DoNotVerifyUPNAndOrSPNUniqueness** (21st character): Controls uniqueness enforcement for User Principal Names (UPN) and Service Principal Names (SPN). Disabling this check (`1` or non-zero) can lead to identity spoofing or credential hijacking by registering duplicate names (KB5008382). 5. **AttributeAuthorizationOnLDAPAdd** (28th character) and **BlockOwnerImplicitRights** (29th character): Introduced in KB5008383. Setting these to `1` enforces strict authorization validations and auditing during LDAP Add operations, preventing malicious creators from abusing implicit owner privileges. 6. **DisableConfidentialAttributeEncryptionRequirements** (31st character): Controls connection security requirements for retrieving or writing confidential attributes. Allowing unencrypted connections (non-zero) risks exposing sensitive information such as password hashes or BitLocker recovery keys on the network. To reach the maximum Level 5 security state, all dangerous features must be disabled, and KB5008383 protections must be explicitly set to `1`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Security Options control critical security settings such as anonymous access to Named Pipes, remote access to the registry (winreg), and domain member secure channel parameters. Restricting these options prevents credential sniffing, service enumeration, and remote unauthorized inspection of local configurations. Specifically, the following settings are configured to protect the Tier 0 administrative boundary: 1. **Server Operator Task Scheduling (`SubmitQueue`)**: Restricting Server Operators from scheduling tasks on Domain Controllers prevents privilege escalation and command execution pathways. 2. **Secure Channel Protection (`RequireStrongKey` / `AllowVulnerableChannel`)**: Restricting secure channels to strong session keys and blocking vulnerable connections mitigates coercion and impersonation attacks. 3. **Machine Password Change (`RefusePasswordChange` / `DisablePasswordChange` / `MaximumPasswordAge`)**: Ensuring domain members rotate machine account passwords at regular intervals prevents offline account hijacking while forcing the DC to process password changes correctly. 4. **Anonymous Named Pipe Restricting (`NullSessionPipes`)**: Setting NullSessionPipes to a minimum required list prevents anonymous callers from enumerating user SIDs or directories on Domain Controllers. 5. **Remote Registry Restrictions (`winreg` Exact Paths and Paths)**: Restricting remote WinReg operations prevents information disclosure and configuration scanning. 6. **Network Credentials Storage Restrictions (`DisableDomainCreds`)**: Blocking the local storage of credentials or passwords for network authentication prevents local security databases from caching reusable network hashes, hindering lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Restricting telemetry, remote help channels, data sharing features, and diagnostic logs on Domain Controllers limits target exposure and data leakage: 1. **Minimize Telemetry and Personalization Leakage**: Domain Controllers process highly sensitive security directory events, administrative tasks, and structural secrets. Personalization telemetry (such as handwriting sharing, speech data, and Customer Experience Improvement Programs) sends host telemetry to external cloud endpoints. 2. **Disable Non-Essential Network Services**: Features like Online Help, printing over HTTP, and Windows Spotlight create unauthenticated outbound connections to cloud platforms. 3. **Restrict Diagnostic Tools**: Interactive diagnostic channels like the Microsoft Support Diagnostic Tool (MSDT) have been targeted in remote execution exploits (e.g., Follina). Restricting interactive troubleshooting tools prevents adversaries from utilizing diagnostic capabilities for code execution. 4. **Prevent Cloud Synchronization**: Message cloud synchronization, push-to-install services, and cloud-based search highlights run background processes that expose local queries and operations to external networks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem on Domain Controllers: 1. **Kernel Attack Surface Reduction**: Restricting the system to only load trusted fonts installed in the `%windir%\Fonts` system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. **Mitigation of Document-Based Exploits**: Prevents malicious font files embedded in Microsoft Office documents, PDFs, or web pages from triggering parsing vulnerabilities in the context of administrative sessions on the Domain Controller. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Service Host (`svchost.exe`) process is an essential operating system component responsible for hosting multiple background services in Windows. Because `svchost.exe` processes execute with the highest operating system privileges (typically `NT AUTHORITY\SYSTEM`, `NT AUTHORITY\LOCAL SERVICE`, or `NT AUTHORITY\NETWORK SERVICE`), they represent high-value targets for adversaries seeking privilege escalation, persistence, and defense evasion across both Domain Controllers and enterprise Domain Member Servers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Directory Services Restore Mode (DSRM) is a special boot mode for Domain Controllers that allows administrators to repair or restore the Active Directory database (NTDS.dit). DSRM uses a local Administrator account separate from the AD directory. If DSRM is not secured: 1. **Network Authentication Abuse**: By default, or if misconfigured (e.g. `DsrmAdminLogonBehavior` set to `0` or `2`), the local DSRM administrator account can authenticate over the network to the Domain Controller. Since this account has a static password (often never changed since DC promotion), it can be targeted for brute-forcing, pass-the-hash, or DCSync credential retrieval. 2. **Offline Recovery Attacks**: If the DC is booted in Safe Mode/DSRM, local controls are reduced. Setting `DsrmAdminLogonBehavior` to `1` ensures the DSRM Administrator account can only log on locally, and only when the DC is booted into DSRM mode. Setting it to `2` allows logon when the AD service is stopped, which is also a risk. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory relies heavily on Kerberos authentication, which has a default maximum clock skew limit of 5 minutes to prevent replay attacks. If the system clocks of Domain Controllers and member endpoints drift, authentication will fail, causing directory service outages. The Domain Controller holding the Primary Domain Controller (PDC) Emulator FSMO role acts as the root time source for the entire Active Directory forest. All other Domain Controllers synchronize their time from the PDC Emulator, and member servers and workstations synchronize their time from their local authenticating Domain Controllers (using the NT5DS domain hierarchy). If the PDC Emulator is not configured to synchronize with a reliable external time source or hardware clock: 1. **Clock Drift Outages**: The entire forest clock can drift over time, eventually exceeding the 5-minute skew limit for external integrations or causing authentication failures. 2. **Replay Attacks**: A lack of synchronized time compromises the security of Kerberos tokens, leaving the environment vulnerable to replay attacks. Configuring the PDC Emulator as a reliable NTP server synchronizing with a secure, trusted reference clock prevents time drift and secures Kerberos transactions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. For Tier 0 assets like Domain Controllers, firmware integrity is critical. If Secure Boot is disabled: 1. **Bootkits & Rootkits**: Attackers with physical access or hosting infrastructure control (in virtual environments) can replace the boot manager with a malicious bootloader (bootkit) to bypass LSASS protections and all OS security controls before the Windows kernel loads. 2. **Virtualization-Based Security**: Advanced security boundaries (like LSA Protection and Device Guard) depend on hardware-rooted trust. Without UEFI Secure Boot active, virtualization-based security capabilities cannot execute with proper system measurements. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the `AvailableUpdates` registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is **`0x5944`** (hex) / **`22852`** (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at **`0x4000`** (hex) / **`16384`** (decimal) upon successful completion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in an Active Directory forest. Traditional signature-based antivirus solutions are easily bypassed by custom, compiled executables, memory injection scripts, or zero-day payloads. **Windows Defender Application Control (WDAC)** enforces a strict trust-based model for binary and script execution. By restricting the operating system to only run signed, trusted system files and administrative utilities, WDAC blocks unauthorized software, remote access tools, and custom malware. Deploying WDAC on Domain Controllers mitigates administrative credential dumping, domain compromises, and malware execution in kernel or user space. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Xbox Live Auth Manager (XblAuthManager) service directly supports this: 1. Provides gaming authentication functions; irrelevant to server infrastructure. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Xbox Live Game Save (XblGameSave) service directly supports this: 1. Provides gaming save functions; irrelevant to server infrastructure. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the ActiveX Installer (AxInstSV) (AxInstSV) service directly supports this: 1. Validates ActiveX controls. Domain Controllers should never run ActiveX controls. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Bluetooth Support Service (bthserv) service directly supports this: 1. Supports Bluetooth devices; unnecessary on server systems. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Connected Devices Platform User Service (CDPUserSvc) service directly supports this: 1. Connected Devices Platform User Service; syncs user activity data across devices. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Contact Data (PimIndexMaintenanceSvc) service directly supports this: 1. Manages contact data indexing; unnecessary on directory servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the WAP Push Message Routing Service (dmwappushservice) service directly supports this: 1. WAP Push Message Routing Service; used for diagnostics and telemetry. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Downloaded Maps Manager (MapsBroker) service directly supports this: 1. Enables access to downloaded maps; irrelevant to server roles. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Geolocation Service (lfsvc) service directly supports this: 1. Monitors system location; represents a privacy and security risk. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Internet Connection Sharing (ICS) (SharedAccess) service directly supports this: 1. Provides network address translation; represents a networking security risk. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Link-Layer Topology Discovery Mapper (lltdsvc) service directly supports this: 1. Discovers network topology; unnecessary exposure of server network location. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Account Sign-in Assistant (wlidsvc) service directly supports this: 1. Enables user signing with Microsoft Accounts; unnecessary on directory servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Passport (NgcSvc) service directly supports this: 1. Part of Windows Hello for Business; not needed if Windows Hello is not deployed. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Passport Container (NgcCtnrSvc) service directly supports this: 1. Part of Windows Hello for Business container management. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Network Connection Broker (NcbService) service directly supports this: 1. Broker for background network connections for modern apps. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Phone Service (PhoneSvc) service directly supports this: 1. Manages telephony state; irrelevant to server infrastructure. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Printer Extensions and Notifications (PrintNotify) service directly supports this: 1. Handles printer notification dialogs; unnecessary on servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Program Compatibility Assistant Service (PcaSvc) service directly supports this: 1. Detects application compatibility issues; unnecessary on highly controlled DCs. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Quality Windows Audio Video Experience (QWAVE) service directly supports this: 1. Multimedia streaming quality service; irrelevant to server systems. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Radio Management Service (RmSvc) service directly supports this: 1. Controls radio transmitters (cellular, Wi-Fi); irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Data Service (SensorDataService) service directly supports this: 1. Handles data from system sensors; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Monitoring Service (SensrSvc) service directly supports this: 1. Monitors system sensors; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Service (SensorService) service directly supports this: 1. Core sensor service; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Shell Hardware Detection (ShellHWDetection) service directly supports this: 1. Provides notifications for AutoPlay hardware events; can be disabled. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Smart Card Device Enumeration Service (ScDeviceEnum) service directly supports this: 1. Detects smart cards; can be disabled if smart cards are not used for authentication. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the SSDP Discovery (SSDPSRV) service directly supports this: 1. Discovers UPnP devices; introduces broadcast name discovery vulnerabilities. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Still Image Acquisition Events (WiaRpc) service directly supports this: 1. Still image capturing events; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sync Host (OneSyncSvc) service directly supports this: 1. Synchronizes mail, contacts, calendar; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the UPnP Device Host (upnphost) service directly supports this: 1. Allows hosting of UPnP devices; represents unnecessary network exposure. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the User Data Access (UserDataSvc) service directly supports this: 1. Manages user structured data; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the User Data Storage (UnistoreSvc) service directly supports this: 1. Stores user data; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the WalletService (WalletService) service directly supports this: 1. Used by Wallet application; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Audio (Audiosrv) service directly supports this: 1. Manages system audio; servers do not require audio capabilities. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Audio Endpoint Builder (AudioEndpointBuilder) service directly supports this: 1. Manages audio endpoints; servers do not require audio capabilities. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Camera Frame Server (FrameServer) service directly supports this: 1. Enables access to system camera feeds; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Image Acquisition (WIA) (stisvc) service directly supports this: 1. Image acquisition from scanners/cameras; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Insider Service (wisvc) service directly supports this: 1. Handles Windows Insider settings; unnecessary on production servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Mobile Hotspot Service (icssvc) service directly supports this: 1. Shares internet connection as hotspot; introduces wireless routing security risk. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Push Notifications System Service (WpnService) service directly supports this: 1. System service for push notifications; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Push Notifications User Service (WpnUserService) service directly supports this: 1. User service for push notifications; irrelevant to servers. 2. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Preventing local overrides of Microsoft Active Protection Service (MAPS) reporting ensures that Domain Controllers consistently report telemetry and signature feedback to cloud resources, preserving centralized protective visibility. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM Domain Controllers. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Disabling generic telemetry and reports on Domain Controllers restricts the transmission of potentially sensitive metadata or environment data regarding Tier 0 directory services to external cloud resources. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory Domain Controllers are prime targets for automated password brute-forcing and Kerberos pre-authentication spraying attacks. Setting brute force protection aggressiveness to 1 enables immediate behavioral blocks against network authentication flood sources. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Ransomware groups target SYSVOL and SYSVOL shares on Domain Controllers to deploy encrypted templates or payloads. Enabling remote encryption protection aggressiveness blocks remote network-driven encryption attempts immediately. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and Domain Controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeNetworkLogonRight` determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTcbPrivilege` identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via `LsaRegisterLogonProcess` and invoke `LsaLogonUser` to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeMachineAccountPrivilege` allows an authenticated domain user to join computer accounts to the Active Directory domain, creating new computer objects in the default `CN=Computers` container up to the limit defined by `ms-DS-MachineAccountQuota` (default: 10). This privilege is governed by the Domain Controllers policy and domain-level schema. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeIncreaseQuotaPrivilege` grants a process the capability to increase the maximum memory quota (working set size and page pool limits) allocated to a process via `SetProcessWorkingSetSize` or `NtSetInformationProcess`. The memory manager enforces memory quotas to prevent individual processes from monopolizing system memory pools. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeInteractiveLogonRight` determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (`explorer.exe`) and interactive desktop session. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRemoteInteractiveLogonRight` determines which security principals are permitted to establish interactive Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target host. RDP provides full remote graphical desktop access, loading interactive user credentials into LSASS memory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeBackupPrivilege` grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the `FILE_FLAG_BACKUP_SEMANTICS` flag in Win32 `CreateFile` calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeChangeNotifyPrivilege` grants the caller the ability to traverse directory trees to access child objects (files and subdirectories) even if the user lacks explicit 'Traverse Folder / Execute File' permissions on parent directories in the path. In addition, this privilege enables applications to register for file system change notifications via APIs such as `ReadDirectoryChangesW`. While enabled broadly on workstations for user convenience, on Domain Controllers and hardened infrastructure, directory navigation paths must be securely bounded. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemtimePrivilege` allows a security principal to adjust the internal hardware clock and system time of the computer via Win32 APIs `SetSystemTime` or `SetLocalTime`. Accurate time synchronization is foundational to the Windows distributed security architecture. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePagefilePrivilege` allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (`pagefile.sys`) via the `NtCreatePagingFile` API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateTokenPrivilege` allows a process to invoke the native API `NtCreateToken` to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (`lsass.exe`) following successful authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePermanentPrivilege` allows a process to create permanent object directory objects in the Windows Object Manager namespace (`\DirectoryObject`) via APIs like `NtCreateDirectoryObject`. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDebugPrivilege` allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to `OpenProcess` with permissions such as `PROCESS_ALL_ACCESS` or `PROCESS_VM_READ` succeed even against processes owned by other users or `NT AUTHORITY\SYSTEM`. This privilege is intended strictly for kernel/application developers debugging live processes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyNetworkLogonRight` explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyBatchLogonRight` explicitly denies designated security principals the ability to authenticate and run batch or scheduled workloads (Logon Type 4). In Windows security, an explicit 'Deny' right takes precedence over any conflicting 'Allow' right (`SeBatchLogonRight`), ensuring that restricted accounts cannot be granted batch execution through nested group memberships. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyServiceLogonRight` explicitly prevents designated accounts from registering and executing as a Windows service process (Logon Type 5). Windows services run unattended in the background under designated security contexts, typically with persistent execution privileges across reboots. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyInteractiveLogonRight` explicitly blocks designated accounts and groups from establishing an interactive logon session (Logon Type 2) at the physical keyboard, mouse, or virtual machine console. Because an explicit deny overrides any allow right, this policy establishes a foolproof security boundary against unauthorized console access. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyRemoteInteractiveLogonRight` explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeEnableDelegationPrivilege` allows a security principal to modify the `userAccountControl` attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) `TRUSTED_FOR_DELEGATION` (Unconstrained Delegation); (2) `TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION` (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRemoteShutdownPrivilege` allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as `InitiateSystemShutdownEx` or `shutdown.exe /m \\computer`). This function is exposed over named pipe `\PIPE\InitShutdown` and RPC interface `winreg`/`shutdown`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeAuditPrivilege` allows a process to write synthetic records directly into the Windows Security Event Log (`Security.evtx`) by invoking the Local Security Authority (LSA) and Authz APIs, specifically `AuthzReportSecurityEvent` or `LsaRegisterLogonProcess`. The Windows Security event log is the primary tamper-resistant telemetry source for forensic investigations, compliance audits, and Security Information and Event Management (SIEM) ingest. Access to inject events directly into this log without generating standard OS audit trails represents a critical security hazard. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLoadDriverPrivilege` allows a process to dynamically load and unload kernel-mode device drivers (`.sys` files) via `NtLoadDriver` or the Service Control Manager (`CreateService` with `SERVICE_KERNEL_DRIVER`). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLockMemoryPrivilege` allows a process to lock physical memory pages in RAM using APIs such as `VirtualLock` and Address Windowing Extensions (AWE) via `AllocateUserPhysicalPages`. Locking pages prevents the Windows virtual memory manager from paging data out to disk in `pagefile.sys`, ensuring high-performance memory retention. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeBatchLogonRight` determines which security principals can authenticate and establish non-interactive batch logon sessions (Logon Type 4). Batch logons are utilized by the Task Scheduler (`taskschd.msc`) and batch queuing subsystems to execute scheduled tasks, maintenance scripts, and background workloads without requiring an interactive desktop session or terminal connection. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeServiceLogonRight` determines which security principals are permitted to register and authenticate as background Windows service accounts (Logon Type 5). When the Service Control Manager (`services.exe`) starts a service configured with a user account, it initiates a service logon session. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSecurityPrivilege` controls access to the Windows Security Event Log (`Security.evtx`) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via `ACCESS_SYSTEM_SECURITY`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemEnvironmentPrivilege` allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs `GetFirmwareEnvironmentVariable` and `SetFirmwareEnvironmentVariable`. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeProfileSingleProcessPrivilege` allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRestorePrivilege` grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying `FILE_FLAG_BACKUP_SEMANTICS` in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeShutdownPrivilege` controls the capability of a user logged on locally at the console to cleanly shut down or restart the local operating system via the `ExitWindowsEx` or `InitiateSystemShutdown` APIs. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSyncAgentPrivilege` grants the caller the authority to initiate directory synchronization operations against Active Directory domain partitions. This privilege is the underlying Windows user right associated with the directory service replication extended rights: `DS-Replication-Get-Changes`, `DS-Replication-Get-Changes-All`, and `DS-Replication-Get-Changes-In-Filtered-Set`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTakeOwnershipPrivilege` allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via `SetNamedSecurityInfo` or `SetSecurityInfo`. The Windows security model grants the owner of an object implicit `WRITE_DAC` authority. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account logon events captures authentication requests processed by the local system or the domain controller, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing Directory Service changes captures creations, modifications, and deletions of Active Directory objects, providing an essential trail for monitoring structural domain modifications. Key security telemetry enabled by these subcategories includes: 1. **Shadow Credentials Detection (Event ID 5136)**: Placing a System Access Control List (SACL) on the `msDS-KeyCredentialLink` attribute across user and computer objects combined with `Directory Service Changes` auditing generates Event ID `5136` whenever an attacker attempts to inject raw X.509 certificate credentials (`pywhisker`, `PKINITtools`) to gain Kerberos PKINIT persistence or account takeover. 2. **DCSync & Replication Rights Auditing (Event ID 4662)**: Auditing `Directory Service Access` with SACLs placed on the Domain Root container generates Event ID `4662` when an attacker or unauthorized identity attempts DRSUAPI replication calls (`DS-Replication-Get-Changes-All`). 3. **Privileged Group & ACL Tampering**: Provides immediate visibility into unauthorized modifications to administrative groups (`Domain Admins`, `Enterprise Admins`, `DnsAdmins`) and `adminSDHolder` permission descriptors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The WebClient service enables Windows-based programs to create, access, and modify Internet-based files via the Web Distributed Authoring and Versioning (WebDAV) protocol. In an Active Directory environment, the WebClient service represents a major credential coercion and relay attack surface: 1. **Bypassing SMB Signing**: WebDAV coercion triggers an outbound HTTP/HTTPS connection using NTLM authentication rather than SMB. Because HTTP authentication does not enforce SMB signing, an attacker can coerce a Domain Controller (e.g., via PetitPotam, DFSCoerce, or ShadowCoerce targeting a WebDAV path like `\\attacker@80\share\test`) and relay the coerced machine account NTLM credentials directly to LDAP/LDAPS, Active Directory Certificate Services (AD CS) Web Enrollment, or other critical directory endpoints. 2. **Principle of Least Functionality**: Domain Controllers perform core directory and authentication functions and must never operate as WebDAV clients to external or internal web servers. Stopping and disabling the WebClient service on Domain Controllers completely neutralizes WebDAV-based coercion and cross-protocol relay vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `KeepAliveTime` parameter controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote system is still reachable and functioning, it acknowledges the keep-alive transmission. In Active Directory environments, Domain Controllers manage high volumes of concurrent Kerberos, LDAP, SMB, and RPC sessions with member servers and workstations. Configuring `KeepAliveTime` to 300,000 milliseconds (5 minutes) instead of the default 2 hours (7,200,000 ms) ensures orphaned or dead TCP connections from abruptly disconnected clients are detected and reclaimed promptly. This mitigates half-open connection accumulation and denial-of-service risks against server connection pools. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Internet Router Discovery Protocol (IRDP, RFC 1256) enables IPv4 hosts to dynamically discover local default routers by listening for ICMP Router Advertisement packets or soliciting them via ICMP Router Solicitation messages. On Active Directory Domain Controllers, dynamic router discovery presents a severe attack surface: 1. **Rogue Gateway Redirection**: Attackers positioned on the local network segment can forge unauthenticated ICMP Router Advertisements to advertise a higher-priority default gateway address pointing to an attacker-controlled host. 2. **Man-in-the-Middle (MitM)**: Coercing the Domain Controller to route outbound network traffic through a rogue router allows attackers to intercept, inspect, or modify sensitive replication, Kerberos, LDAP, and DNS communication. Domain Controllers must operate exclusively with statically assigned or enterprise DHCP-reserved gateway addresses. Setting `PerformRouterDiscovery` to `0` explicitly disables IRDP processing. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `TcpMaxDataRetransmissions` parameter determines the number of times TCP will retransmit an individual data segment (non-connect segment) before aborting the connection. The retransmission timeout is doubled with each successive retransmission on a connection, backed off exponentially. By default, Windows configures `TcpMaxDataRetransmissions` to `5`, which causes the system to wait over 200 seconds before terminating an unresponsive connection. In an Active Directory environment: 1. **Resource Exhaustion Mitigation**: Restricting retransmissions to `3` causes stalled or unresponsive connections to be severed significantly faster, releasing kernel memory buffers, TCP control blocks (TCBs), and socket handles. 2. **Denial-of-Service Defense**: In scenarios involving connection drop attacks, network partitions, or resource starvation attempts, limiting TCP data retransmissions for both IPv4 and IPv6 prevents connection pool depletion on Domain Controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, the Windows DNS client may fall back to well-known default IPv6 DNS addresses (such as site-local or router-advertised dynamic addresses) if statically configured DNS servers fail to respond, or when processing IPv6 router advertisements (RAs) via DHCPv6 / SLAAC. In an Active Directory environment: 1. **MitM and Rogue IPv6 DNS Redirection**: Attackers on the local network segment utilize tools like `mitm6` to broadcast rogue IPv6 Router Advertisements and rogue DHCPv6 replies, assigning an attacker-controlled IPv6 DNS server to systems on the subnet. 2. **Credential Relay & Authentication Coercion**: When a Domain Controller queries DNS through a rogue IPv6 DNS server, the attacker can spoof hostnames (such as internal WPAD, CRL endpoints, or management servers) to coerce LDAP/SMB/HTTP authentication and perform NTLM relay attacks. Enabling `Turn off default IPv6 DNS Servers` (`DisableIPv6DefaultDnsServers = 1`) ensures that the DNS Client service does not fall back to default or dynamically acquired IPv6 DNS server addresses, confining DNS resolution strictly to administratively approved directory DNS servers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Link-Layer Topology Discovery (LLTD) Mapper I/O (LLTDIO) network protocol driver queries neighboring network hosts to discover physical network topology, bandwidth capabilities, and device characteristics for Windows network mapping tools. On Tier 0 Domain Controllers: 1. **Attack Surface Minimization**: Domain Controllers must not act as network mapping query clients or probe neighboring devices. Running network discovery protocol drivers in kernel space introduces unnecessary attack surface. 2. **Reconnaissance Suppression**: Prohibiting LLTDIO driver activity ensures that the Domain Controller cannot be utilized to perform unauthorized local link-layer discovery queries across adjoining subnets. Disabling the Mapper I/O driver (`Turn on Mapper I/O (LLTDIO) driver -> Disabled`) sets the registry flags under `HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD` to `0`, ensuring the driver is completely disabled across domain, private, and public network profiles. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Link-Layer Topology Discovery (LLTD) Responder (RSPNDR) network protocol driver listens for topology discovery requests from other computers on the local network and responds with device details, identity information, and link-layer capabilities. On Tier 0 Domain Controllers: 1. **Device Fingerprinting Prevention**: Enabling the Responder driver allows any workstation or rogue host on the local physical segment to discover the Domain Controller, map its MAC address, determine link characteristics, and identify its role via LLTD probe packets. 2. **Network Protocol Stack Reduction**: Running link-layer responders in the kernel networking stack exposes the server to packet-handling vulnerabilities and potential broadcast flooding attacks. Disabling the Responder driver (`Turn on Responder (RSPNDR) driver -> Disabled`) ensures that the Domain Controller never advertises itself or responds to link-layer topological queries. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Microsoft Peer-to-Peer Networking Services comprise technologies such as the Peer Name Resolution Protocol (PNRP), Peer Graphing, and Grouping. These services allow distributed applications and workstations to locate each other, publish identities in peer clouds, and exchange data directly without centralized servers. On Active Directory Domain Controllers: 1. **Inappropriate Technology on Tier 0**: Domain Controllers are centralized identity authorities designed for hierarchical client-server communication. Peer-to-peer mechanisms are completely antithetical to Tier 0 security isolation. 2. **Untracked Communication Channels**: PNRP and peer networks establish autonomous, unmanaged communication channels that bypass traditional network inspection and create covert data exchange surfaces. 3. **Attack Surface Reduction**: Disabling Peernet services (`Disabled = 1`) eliminates the PNRP protocol stack and shuts down peer mesh discovery ports on Domain Controllers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Connect Now (WCN) provides mechanisms for wireless network configuration using Wi-Fi Protected Setup (WPS) protocols across various discovery media, including UPnP (Universal Plug and Play), In-Band 802.11, USB flash drives (FlashConfig), and Windows Portable Devices (WPD). On Active Directory Domain Controllers: 1. **Tier 0 Dedicated Wired Infrastructure**: Domain Controllers must run on dedicated, physical wired server backbones within physically secured datacenter segments. Wireless configuration mechanisms have no legitimate place on these machines. 2. **UPnP and Wireless Exploitation**: UPnP registrars and in-band 802.11 discovery listening components can introduce local broadcast vulnerabilities, unauthenticated device registration attacks, or credential leakage over broadcast media. 3. **Attack Surface Elimination**: Setting `Configuration of wireless settings using Windows Connect Now` to `Disabled` ensures that all WCN registrars (UPnP, In-Band 802.11, FlashConfig, WPD) are explicitly turned off. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Connect Now (WCN) wizards guide users through configuring a wireless router or access point and saving network configuration settings to USB flash memory or broadcasting them via Wi-Fi. On Tier 0 Domain Controllers: 1. **Administrative Interface Lockdown**: Interactive administrative sessions on Domain Controllers must never expose consumer wireless or hardware configuration wizards that could be inadvertently or maliciously invoked. 2. **Prevent Unauthorized Configuration Storage**: WCN wizards allow exporting wireless network keys and connection settings to removable storage or across the network. Prohibiting access to the WCN wizards (`DisableWcnUi = 1`) ensures the GUI wizard interface cannot be launched. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory Domain Controllers serve as the root of trust (Tier 0) for the entire enterprise directory. Early-stage boot integrity is critical to prevent kernel-level compromise before security subsystems initialize. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers are Tier 0 crown jewels that store the directory database (`NTDS.dit`), Kerberos key distribution services (`KDC`), and enterprise authentication secrets. If the underlying platform firmware or virtual machine boot configuration is compromised, an attacker can subvert all operating system and hypervisor defenses before the Windows kernel loads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers represent Tier 0 identity stores hosting the directory database (`NTDS.dit`), Kerberos Ticket Granting Service keys (`krbtgt`), and password hashes for all enterprise principals. While enterprise servers reside in datacenters or branch office wiring closets, physical access threats remain a critical attack vector: 1. **Direct Memory Access (DMA) Threat Vectors**: Hot-plug expansion ports and external peripheral interfaces (such as PCIe hot-plug slots, Thunderbolt, USB4, or external storage expansion cards) permit connected hardware to bypass operating system access controls and perform direct read/write operations against physical DRAM. Attackers utilizing physical DMA consoles (e.g., PCILeech or malicious PCIe expansion cards inserted into physical server chassis) can dump LSASS memory and extract volatile Kerberos keys: * **Device Setup Class Lockdown**: Disabling the SBP-2 protocol class (`{d48179be-ec20-11d1-b6b8-00c04fa372a7}`) and IEEE 1394 host controller class (`{6bdd1fc1-810f-11d0-bec7-08002be2092f}`) prevents Windows Server from mounting legacy FireWire storage devices. * **Hardware ID Blocking**: Explicitly blocking hardware IDs `PCI\CC_0C0A` (Thunderbolt), `PCI\CC_0C0010` (FireWire), `PCI\CC_0607` (CardBus), and `PCI\CC_0605` (PCMCIA) prevents the installation of unapproved expansion controllers at the hardware bus layer. * **BitLocker DMA Under Lock**: Enforcing `DisableExternalDMAUnderLock` blocks DMA device enumeration when the server console is locked, mitigating drive-by hardware attacks on unattended consoles. * **Kernel DMA Protection Enforcement**: Enforcing `DeviceEnumerationPolicy = 0` (Block all) guarantees that any peripheral device whose drivers do not explicitly support IOMMU DMA remapping is strictly blocked from executing DMA memory transfers. 2. **Cold Boot & Standby Attacks**: In standard standby sleep states (S1-S3), system RAM remains powered and unencrypted. If an attacker gains physical access to a server in a standby state, they can execute cold-boot extraction or memory analysis to harvest sensitive directory keys. Domain Controllers must operate continuously in full runtime execution states. Disabling standby sleep states forces servers to remain fully operational or enter clean shutdown, ensuring BitLocker encryption keys are sealed by the TPM 2.0 module. Enforcing wake password verification guarantees that any power-state transition requires re-authentication. 3. **Physical USB Exfiltration of Directory Databases**: Rogue insiders or unauthorized datacenter personnel with physical console access can insert USB flash drives to exfiltrate `ntds.dit`, Active Directory backups, or system state data. Enforcing `RDVDenyWriteAccess = 1` prevents writing to removable drives unless protected by BitLocker, while `RDVDenyCrossOrg = 0` eliminates unauthorized cross-organization exceptions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers host the Active Directory directory database (`NTDS.dit`), Kerberos ticket-granting service keys (`krbtgt`), and credentials for all domain identities. Protecting these Tier 0 identity stores requires aggressive operating system minimization and the systematic neutralization of Living-off-the-Land Binaries (LOLBins / LOLBAS) that adversaries leverage during post-exploitation, lateral movement, and defense evasion: 1. **Mitigation of LOLBin Abuse on Critical Servers**: Windows Script Host binaries (`cscript.exe` and `wscript.exe`) execute legacy VBScript (`vbscript.dll`) and JScript (`jscript.dll`) engines. Threat actors targeting Domain Controllers frequently invoke `cscript.exe` or `mshta.exe` to execute obfuscated staging scripts, query Active Directory via legacy ADSI/WMI interfaces, or execute memory injection routines while attempting to evade standard binary application allowlisting (MITRE ATT&CK T1059.005, T1059.007, T1218). 2. **Elimination of Untrusted Script Execution**: Disabling WSH system-wide via the `Enabled = 0` registry setting prevents the execution of all `.vbs`, `.vbe`, `.js`, `.jse`, `.wsf`, and `.wsh` files through the primary scripting host, returning an immediate administrative blocking error. 3. **Comprehensive 64-Bit and 32-Bit WOW6432Node Coverage**: In 64-bit Windows Server environments, threat actors often invoke 32-bit binaries (`%SystemRoot%\SysWOW64\cscript.exe` or `wscript.exe`) to evade 64-bit security monitoring tools and API hooks. Configuring `Enabled = 0` and `TrustPolicy = 2` across both the native 64-bit registry branch (`HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings`) and the 32-bit subsystem branch (`HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings`) closes this evasion vector. 4. **TrustPolicy Hardening**: Setting `TrustPolicy = 2` enforces restrictions that disallow untrusted scripts system-wide, establishing defense-in-depth even if individual registry keys are tampered with. 5. **Accidental Double-Click Prevention**: Remapping legacy scripting extensions (`.vbs`, `.vbe`, `.js`, `.jse`, `.wsf`, `.wsh`, `.hta`) to `txtfile` (`notepad.exe`) ensures that if an administrator inspects an administrative script or diagnostic file on the DC console, opening the file in Windows Explorer displays plain text in Notepad rather than silently triggering code execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory Domain Controllers are the highest-value targets (Tier 0) in an enterprise forest. In addition to serving as the central authentication authority, Domain Controllers continuously process authentication requests, Kerberos ticket issuances, directory service modifications, and directory replication. When comprehensive security audit policies are enforced on Domain Controllers (such as Kerberos Service Ticket operations [Event ID 4769], Account Logon events [Event ID 4768/4771], Directory Service Object Access [Event ID 4662], and Group Membership changes [Event ID 4728/4738]), Domain Controllers generate between 500 MB and multiple gigabytes of security telemetry daily. Default event log capacities (20 MB for standard channels, 16 MB to 32 MB for role channels) roll over in a matter of minutes to hours during production load. This creates severe security vulnerabilities: 1. **Mitigation of Log-Flushing Attacks**: Adversaries executing high-frequency attacks (e.g., Kerberoasting, AS-REP Roasting, password spraying, or DCSync via `DsGetNCChanges`) frequently attempt to "flush" the Security log by generating floods of benign authentication or LDAP requests to overwrite compromise indicators before detection. Expanding the Security log to **4 GB** (`4,194,304 KB`) provides a resilient on-box buffer that retains weeks of forensic evidence even under heavy attack activity. 2. **Preservation of System and Replication Diagnostics**: Domain Controllers log extensive Netlogon, KDC, DNS, DFS Replication, and NTDS replication events into the **System**, **Directory Service**, **DNS Server**, and **DFS Replication** event channels. Allocating **256 MB** to System, Directory Service, and DNS Server logs prevents replication failures and tombstone synchronization issues from being overwritten during diagnostic troubleshooting. 3. **64 KB Boundary Alignment**: The Windows Event Log service allocates memory in 64 KB blocks. Configured sizes must be exact integer multiples of 64 (`SizeKB % 64 == 0`). Non-aligned values will be automatically truncated or rounded by the operating system (`4,194,304 / 64 = 65,536`; `262,144 / 64 = 4,096`; `131,072 / 64 = 2,048`; `32,768 / 64 = 512`). 4. **Retention Policy**: Enforcing retention method `0` (GPO: `Disabled` / Overwrite events as needed) guarantees that new security audits are continuously recorded rather than halted when log capacity is reached. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Legacy name resolution protocols and insecure default network configurations are heavily targeted by attackers for credential harvesting and man-in-the-middle (MitM) positioning: 1. **Legacy Name Resolution (LLMNR / NetBIOS)**: LLMNR and NBT-NS serve as fallback protocols when DNS resolution fails. When a host queries an unresolvable name, it broadcasts requests over the local subnet. An attacker can spoof responses (e.g., using Responder) to capture NTLMv2 hashes or perform authentication relay attacks. NetBIOS name release requests can be forged to disrupt local names unless protected. 2. **NetBIOS Node Type and Name Release**: Setting the Node Type to P-node (point-to-point, value 2) disables broadcast resolution fallbacks. Enabling name release protection (`NoNameReleaseOnDemand`) prevents attackers from spoofing name release requests to deregister local names. 3. **ICMP Redirects**: ICMP redirect packets can be used by an attacker on the same subnet to dynamically redirect routing for specific hosts through the attacker's machine, enabling full MitM packet sniffing and modification. Disabling ICMP redirects prevents this vector. 4. **IP Source Routing**: Source routing allows a sender to specify the exact network path a packet should follow. This is commonly abused to bypass firewall routing rules or establish communication paths that violate network segment isolation. 5. **Disable Default IPv6 DNS Servers**: Disabling default IPv6 DNS servers prevents automated fallback to unauthenticated, dynamic local IPv6 DNS servers advertised by rogue routers or malicious tools (like mitm6), which would otherwise redirect query traffic and coerce NTLM or Kerberos authentication. 6. **Disable Web Proxy Auto-Discovery (WPAD)**: Disabling WPAD removes another name resolution mechanism that Responder exploits to harvest credentials. By disabling the `WinHttpAutoProxySvc` service and configuring `WpadOverride = 1`, the workstation is protected from rogue web proxy configurations. 7. **Restrict Net Session Enumeration (NetCease)**: By default, any authenticated domain user can query session information from remote hosts. Attackers utilize session enumeration to locate high-privileged user sessions (e.g., Domain Admins) across the network. Hardening the `SrvsvcSessionInfo` default security descriptor blocks this remote reconnaissance. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 User Account Control (UAC) is a fundamental defense mechanism in Windows. It limits the privilege levels of running applications, executing administrative actions with standard user tokens unless elevated privileges are explicitly approved. Hardening UAC settings ensures: 1. **Secure Desktop Enforcement**: The elevation prompt is displayed on a separate, secure desktop environment that isolated system threads run on. This prevents third-party malware running in user space from intercepting credentials or programmatically clicking "Yes" to elevate itself. 2. **Auto-Denial of Standard User Elevation**: Standard users should not be allowed to request elevation. If a standard user triggers a task requiring administrative rights, the prompt should auto-deny rather than requesting an administrator password, preventing users from attempting to bypass controls or exposing local admin passwords on a non-secure user terminal. 3. **Admin Approval Mode**: Forcing built-in administrators to run in Admin Approval Mode ensures that even administrative users do not run web browsers or document editors with administrative tokens by default. 4. **Sudo Command Control**: The `sudo` command introduced in Windows 11 (24H2) allows users to run elevated commands from an unelevated console. Leaving this feature unconfigured or allowing execution within the current console session can expose elevated processes to command injection or token interception in the same console session. Restricting `sudo` to opening a new elevated window (`1`) or disabling it entirely (`0`) mitigates session hijacking risks. 5. **Network UAC Restrictions (`LocalAccountTokenFilterPolicy`)**: Restricting the elevation of local accounts during network logons prevents lateral movement. When set to `0`, local accounts (except for the built-in Administrator RID 500 account) connecting remotely via network shares or administrative interfaces cannot obtain administrative tokens, neutralizing pass-the-hash attacks using secondary local administrative accounts. 6. **Installer Detection (`EnableInstallDetection`)**: Detecting installer program behavior prevents silent software execution. When enabled, any execution of an install file or setup program by standard users or administrators triggers a UAC elevation prompt, preventing unauthorized silent program deployments. 7. **UAC Virtualization (`EnableVirtualization`)**: Virtualizing writes redirection keeps the operating system directory space clean. It redirects legacy application registry and file writes targeting system folders (like `Program Files` or `System32`) to user-profile-specific folders, allowing legacy applications to run without requiring administrative rights. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The AutoPlay and AutoRun features in Windows are designed to automatically execute programs or open media when a removable drive, network share, or CD-ROM is inserted or connected. Attackers exploit these features by placing malicious scripts, payloads, or executables on USB drives or external storage media. If AutoPlay is enabled, connecting the drive triggers automatic execution of these scripts or programs without user interaction or approval, allowing malware to achieve immediate execution in the context of the logged-on user. Disabling AutoPlay across all drive types completely mitigates this physical transmission vector. Additionally, non-volume devices (such as mobile phones, cameras, or media players) can still trigger AutoPlay behavior. Disallowing AutoPlay for non-volume devices ensures these devices do not introduce unauthorized execution pathways when plugged into standard client machines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Removable storage media, such as USB flash drives, external SSDs, and optical discs, represent a significant risk vector for corporate network environments. Attackers use USB drives to bypass network-based security boundaries (such as firewalls and intrusion detection systems), introducing malware directly onto local workstation hosts via physical sneakernets. USB drives are also a primary tool for insider threat data exfiltration, enabling users to copy proprietary or sensitive information off company terminals onto untracked hardware. Restricting removable storage access at the operating system level prevents both unauthorized data ingress (malware infection) and data egress (unauthorized data copying). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Remote Desktop Protocol (RDP) is one of the primary mechanisms used by attackers for lateral movement and administrative session hijacking. If inbound RDP is enabled globally on workstations: 1. **Lateral Movement**: An attacker who compromises a single standard user's credentials with administrative permissions on other machines can RDP from workstation to workstation across the network. 2. **Session Hijacking**: Attackers can hijack existing administrative RDP sessions using built-in command-line tools (such as `tscon.exe`) if they obtain administrator privileges on the system. 3. **Password Spraying**: Open RDP ports allow attackers to attempt password spraying or brute-force attacks against local administrative accounts. Furthermore, Windows **Remote Assistance** allows helper connections that can lead to remote code execution or unauthorized access if not properly restricted. Disabling Solicited Remote Assistance and removing any legacy configuration values limits the workstation's attack surface. The safest configuration is to disable Remote Desktop Services and Remote Assistance entirely on all Tier 2 workstations. If RDP is strictly necessary for remote technical support, it must require Network Level Authentication (NLA) and the listening firewall rules must restrict access to authorized management subnets only. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Local administrator rights on workstations are a significant source of operational vulnerability. If standard end-users run as local administrators: 1. **Malware Propagation**: Malware executed by the user runs in an administrative context, allowing it to bypass local firewalls, alter registry hives, disable security controls (like Windows Defender), and persist across reboots. 2. **Credential Harvesting**: Compromised local admin accounts allow attackers to execute memory-dumping tools (e.g., Mimikatz) to harvest stored domain credentials of other users who have logged on to that machine. 3. **Software Control Bypass**: Users can install arbitrary, unapproved software, introducing license compliance risks and unmonitored security vulnerabilities. Securing the local Administrators group ensures only local security accounts (like the local `Administrator` managed by LAPS) or dedicated workstation support accounts are members. The default `Domain Users` or standard domain accounts must never be allowed local administrative rights. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In an isolated, air-gapped network, workstations cannot connect directly to Microsoft's online Update servers. If the system is left in its default configuration: 1. **DNS/Firewall Pollution**: Workstations will continuously attempt to resolve and connect to public Windows Update URLs (e.g., `*.update.microsoft.com`), filling firewall and local DNS resolver cache logs with timeouts and block events. 2. **Missing Updates**: Workstations will fail to receive security patches, critical updates, and Windows Defender definitions. 3. **Control Bypass**: Attackers or unapproved software could attempt to install out-of-band features or packages if update routes are not explicitly locked to internal sources. Enforcing the intranet update service location redirects all system update queries to the local WSUS server. Furthermore, enforcing Windows **Delivery Optimization** download mode to `Group (2)` limits peer-to-peer update sharing strictly to computers within the same active directory domain/group or local subnet boundaries, reducing bandwidth constraints on WAN/intranet segments and preventing unmanaged peer sharing. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. If Secure Boot is disabled: 1. **Bootkits & Rootkits**: Attackers with physical access or local administrator privileges can replace the system bootloader with a malicious bootloader (bootkit). This bootkit executes before the Windows operating system loads, allowing it to bypass all Windows security controls, disable antivirus software, and run completely undetected. 2. **Virtualization-Based Security**: Advanced Windows defenses (like Credential Guard and Device Guard) depend on hardware-rooted trust. If Secure Boot is disabled, Virtualization-Based Security (VBS) cannot verify platform integrity, rendering these protections ineffective. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Virtualization-Based Security (VBS) uses hardware virtualization features to create and isolate a secure region of memory from the normal operating system. Windows Defender **Credential Guard** runs inside this isolated VBS environment (known as the secure kernel). By moving NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and other domain credentials into this virtualized container, Credential Guard ensures they are inaccessible to the standard operating system. If VBS and Credential Guard are not enabled: 1. **LSASS Access**: Attackers running with administrative rights on the workstation can query the LSASS process memory space and extract Active Directory authentication tokens using memory-dumping tools (e.g., Mimikatz). 2. **Pass-the-Hash / Pass-the-Ticket**: Attackers can use the extracted hashes or Kerberos tickets to log on to other domain systems, leading to rapid lateral movement and domain compromise. Enforcing VBS and Credential Guard prevents in-memory credential harvesting, breaking the primary lateral movement escalation vector. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Traditional signature-based antivirus solutions scan for known malware patterns. However, they are easily bypassed by custom, compiled executables, dynamic scripts, or zero-day payloads. **Windows Defender Application Control (WDAC)** is a kernel-enforced application control framework. Instead of asking "Is this file malicious?", WDAC asks "Is this file explicitly trusted?". If WDAC is not configured: 1. **Payload Execution**: Standard users can execute downloaded scripts (e.g., PowerShell, VBScript) or binary files, facilitating initial access. 2. **Antivirus Bypass**: Attackers can run obfuscated code, compile payloads on the target endpoint using built-in Windows compilers (e.g., `csc.exe`), or run memory injection scripts that standard antivirus signatures miss. Deploying a strict WDAC baseline ensures that only binaries and scripts signed by Microsoft, trusted system developers, or located in protected directories (such as Windows system folders) are allowed to execute. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 BitLocker Drive Encryption protects the operating system volume from offline attacks, data tampering, and data theft when the device is powered off or stolen. Without full disk encryption, an attacker with physical access to a workstation can extract the hard drive, mount it on a non-secure system, bypass operating system security controls, dump local password databases (SAM), and access cached domain credentials. Enforcing specific BitLocker startup parameters, such as a minimum PIN length of at least 6 characters, ensures that if a startup PIN is used, it cannot be easily brute-forced. Restricting how the TPM, startup keys, and PINs are configured ensures consistent security policy application. To maximize security, standard endpoints (Tier 2) should use **BitLocker Network Unlock** to prevent operational overhead in managing startup PINs for thousands of workstations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Standard Tier 2 endpoints (such as corporate laptops and desktop workstations) and member servers are frequently exposed to physical theft, unauthorized local access in branch offices, or untrusted local networks. If system firmware remains unconfigured or relies on legacy BIOS modes, attackers can alter boot settings, subvert operating system security features, bypass disk encryption, or execute physical DMA and bootkit attacks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Direct Memory Access (DMA) allows hardware devices to read and write directly to physical system memory (RAM) over high-speed buses without CPU or operating system arbitration. External expansion ports—such as Thunderbolt 3, Thunderbolt 4, USB4, and hot-plug PCIe slots—expose internal PCI Express lanes directly to external peripherals. If external DMA interfaces are left unprotected, an attacker with physical access to an unattended, locked, or stolen endpoint can connect malicious hardware tools or implants (such as PCILeech or USB3380 DMA attack adapters) to perform drive-by physical DMA attacks. Through unrestricted DMA access, attackers can extract sensitive secrets directly from RAM—including BitLocker full-volume encryption keys, DPAPI master keys, LSASS authentication tokens, Kerberos tickets, and cached credentials—or write to memory to inject kernel payloads and bypass Windows lock screens. Configuring Kernel DMA Protection and enforcing strict external device enumeration mitigates this threat vector: 1. **IOMMU Memory Isolation**: Kernel DMA Protection utilizes the system's Input-Output Memory Management Unit (IOMMU: Intel VT-d or AMD-Vi) and ACPI DMAR tables to create hypervisor-enforced memory sandboxes for peripheral devices. For DMA-remapping-compatible devices, the operating system isolates device DMA transfers exclusively to the specific memory buffers allocated to that device's driver, blocking unauthorized access to adjacent physical RAM. 2. **Mitigating Incompatible External Devices**: External devices and drivers are classified into two categories: those that support DMA remapping and those that do not. If an incompatible or rogue peripheral without DMA-remapping support is connected, Windows default behavior may permit enumeration or delay it until user login. Setting the enumeration policy to **Block All** (`DeviceEnumerationPolicy = 0`) guarantees that any external device whose drivers do not explicitly support DMA remapping is unconditionally blocked from initializing, loading drivers, or executing DMA transfers. 3. **Closing the Physical Hot-Plug Attack Surface**: By blocking incompatible external DMA devices, the operating system ensures that only verified, DMA-remapping-compliant peripherals operate under strict hypervisor IOMMU containment, preventing drive-by memory dumping attacks while preserving device functionality for certified hardware. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Platform Binary Table (WPBT) is an ACPI firmware table that allows hardware manufacturers (OEMs) to execute proprietary binaries in kernel space during the Windows boot phase. Windows automatically extracts the binary from the table and runs it with system privileges before security software, third-party agents, or standard driver verifications are fully initialized. While designed to facilitate automated driver provisioning and anti-theft services, this mechanism represents a significant security risk: 1. **Firmware-to-OS Attack Vector**: Malicious actors utilizing UEFI rootkits, physical firmware flashing tools, or supply-chain firmware implants can compromise the WPBT table to execute arbitrary code at boot, bypassing Secure Boot and operating system-level integrity checks. 2. **Privilege Escalation Risks**: Historically, OEM software delivered via the WPBT has introduced high-severity local privilege escalation and remote code execution vulnerabilities due to inadequate code review or poor permission management. 3. **Control and Transparency**: Executing firmware-rooted binaries without administrative visibility or operating system validation bypasses normal software lifecycle and endpoint protection policies. Disabling WPBT execution prevents Windows from parsing the ACPI table and running the embedded software, mitigating boot-level integrity bypasses. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Physical access to an endpoint introduces distinct attack vectors that bypass traditional OS privilege separation: 1. **Direct Memory Access (DMA) Attacks**: Hot-plug buses (such as FireWire, Thunderbolt, and USB4) permit connected peripherals to read and write directly to system memory without operating system mediation. Attackers connect specialized hardware (e.g., PCILeech) to exposed external ports to extract BitLocker encryption keys, NTLM hashes, or active session tokens directly from RAM: * Disabling the Serial Bus Protocol 2 (SBP-2) setup class (`{d48179be-ec20-11d1-b6b8-00c04fa372a7}`) blocks FireWire/IEEE 1394 DMA controllers. * Blocking hardware device IDs `PCI\CC_0C0A` (Thunderbolt) and `PCI\CC_0C0010` (1394 OHCI FireWire) halts driver initialization for dangerous hot-plug controllers. *(Note: On Tier 0 PAWs, additional legacy controller setup classes and CardBus/PCMCIA bridges are blocked under [REQ-PAW-011](../07-paws/harden-dma-and-physical-security.md)).* * Enforcing `DisableExternalDMAUnderLock` prevents DMA requests while the workstation screen is locked. * `DeviceEnumerationPolicy` set to **Block all** (0) ensures devices lacking DMA-remapping isolation support cannot execute unauthorized memory access transfers. 2. **Cold Boot Attacks & Sleep Vulnerabilities**: When an endpoint enters standby sleep states (S1-S3), system RAM remains powered and active. If an unattended laptop or desktop is stolen while in standby, an attacker can quickly reboot the machine or chill the DRAM chips to dump memory contents and retrieve BitLocker keys. Disabling standby forces systems to transition to Hibernation (S4)/Shutdown, where RAM contents are flushed to the BitLocker-encrypted disk and sealed by the TPM. Enforcing a password upon wake prevents unauthorized physical resumption. 3. **USB Data Exfiltration**: Blocking write access to removable drives unless they are encrypted with BitLocker (`RDVDenyWriteAccess`) prevents users or malicious agents from copying confidential organizational data to unauthorized, unencrypted USB media. Setting `RDVDenyCrossOrg = 0` enforces organization-wide BitLocker compliance. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Exploit Protection (the successor to the Enhanced Mitigation Experience Toolkit, or EMET) provides a set of advanced memory and vulnerability mitigations. These mitigations protect both the operating system and applications from memory corruption, buffer overflows, execution redirection, and process hijack attempts. By enforcing system-wide mitigations: 1. **Data Execution Prevention (DEP)**: Enforces non-executable memory pages, preventing attackers from executing shellcode injected into data-only memory regions (such as the stack or heap). 2. **Address Space Layout Randomization (ASLR)**: Randomizes the locations where system components, executable code, and memory allocations are loaded. Enabling Mandatory ASLR (Force Relocate Images), Bottom-Up ASLR, and High Entropy ASLR makes memory structures unpredictable, thwarting return-oriented programming (ROP) exploits. 3. **Control Flow Guard (CFG)**: Verifies control flow integrity for indirect call targets at compile time, preventing attackers from hijacking indirect jumps to point to arbitrary payloads. 4. **Structured Exception Handler Overwrite Protection (SEHOP)**: Blocks exploits that overwrite Structured Exception Handlers (SEH) to gain control of execution paths during error handling. 5. **Heap Termination on Corruption**: Immediately terminates a process if corruption is detected in its heap. This blocks heap-based buffer overflow exploitation before execution control can be seized. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malicious actors with standard user credentials can potentially bypass local security policies, local endpoint detection and response (EDR) agents, and group policy restrictions by booting the system into Safe Mode. In Safe Mode, many security agents and services do not load, creating an environment where local controls can be circumvented. By configuring `SafeModeBlockNonAdmins = 1`: 1. **Prevent Credential Bypass**: Standard users are blocked from logging in during Safe Mode, ensuring they cannot exploit the disabled security agents to execute unauthorized programs or extract system information. 2. **Maintenance Integrity**: Safe Mode remains accessible exclusively to system administrators for debugging and recovery, ensuring administrative capability is preserved while mitigating standard user risk. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Defender Firewall is the primary host-based security control protecting endpoints from unauthorized incoming network connections and regulating outgoing network behaviors. A secure baseline requires enabling the firewall on all profiles, setting inbound connections to block by default, disabling notification prompts that can be bypassed by users, and implementing detailed auditing/logging to monitor network anomalies. Additionally: 1. **Outbound LOLBins Blocking**: Malicious actors frequently abuse built-in Windows administrative utilities (known as Living Off the Land Binaries, or LOLBins) to download malicious payloads, exfiltrate sensitive data, and communicate with external command-and-control (C2) servers. Blocking outbound network communication for binaries that have no legitimate business requirement to connect to external networks (such as `mshta.exe`, `certutil.exe`, `bitsadmin.exe`, `regsvr32.exe`, `rundll32.exe`, `cscript.exe`, `wscript.exe`, and `hh.exe`) significantly mitigates these threat vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (LSASS) process manages security policies, user authentication, and credential tokens on Windows systems. Attackers targeting workstations commonly attempt to extract plain-text credentials or NT hashes from LSASS memory using debugging tools (e.g., Mimikatz, Procdump). Enabling LSA Protection ensures that: 1. **Protected Process Light (PPL)**: The LSASS process runs as a Protected Process Light (PPL). 2. **Access Restriction**: Only verified, digitally signed code can load into LSASS, and standard processes (even those running as local system/administrator) cannot read the memory space of LSASS or inject code into it. 3. **Mitigating Dump Attacks**: Credential harvesting tools cannot dump LSASS memory to disk or scrape keys from LSA memory blocks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Print Spooler service (`Spooler`) has been the source of numerous high-severity vulnerabilities (such as the PrintNightmare family - CVE-2021-1675 and CVE-2021-34527). Attackers exploit the Print Spooler to coerce authentication or execute arbitrary code with SYSTEM privileges. To secure standard client endpoints and member servers, the primary defense is to **completely disable the Print Spooler service**. This eliminates the service's attack surface. As a secondary defense-in-depth, additional printer registry configurations (such as restricting driver installation to administrators, Redirection Guard, and RPC connection configurations) are enforced to ensure that even if the spooler service is temporarily running, the subsystem remains hardened. 1. **Remote Connections Block**: By disabling remote client connections to the print spooler, standard client endpoints are prevented from acting as print servers. Outbound printing remains unaffected, but external hosts can no longer target the workstation's print spooler over the network. 2. **Redirection Guard**: Enabling Redirection Guard prevents print spooler processing from being redirected via symbolic links or junction points, mitigating local privilege escalation vectors that abuse file system paths during printer driver mapping. 3. **RPC over TCP**: Forcing both incoming and outgoing RPC connections to use TCP instead of legacy Named Pipes (which can be easily hijacked or relayed) reduces the attack surface. Forcing packet-level privacy and authentication protocols ensures printing traffic is encrypted and authenticated. 4. **Point and Print Restrictions**: Restricting driver installation and update prompts to administrators prevents non-privileged users from installing malicious or unverified printer drivers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Endpoints and general member servers are the most common entry points for malware, ransomware, and administrative account compromise. Standard users running with non-administrative accounts can download and execute malicious executables or scripts in writeable directories (like `%TEMP%` or `%USERPROFILE%`) to bypass traditional signature-based antivirus solutions. Enforcing strict application control via AppLocker on endpoints ensures that: 1. **Malware Prevention**: Standard users are blocked from executing unauthorized binaries and installers. 2. **Defends Against AppLocker Bypasses**: Abusing trusted, signed Microsoft binaries (such as `msbuild.exe`, `installutil.exe`, `regasm.exe`, `regsvcs.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under `%WINDIR%` (such as `Tasks`, `Temp`, `tracing`, `spool\drivers\color`, etc.). 3. **Restricts Interpreted Codes**: Block unauthorized execution of scripts (PowerShell, VBScript, Batch) from writeable locations. 4. **Defense-in-Depth**: Limits the lateral movement of adversaries who pivot from one compromised endpoint to another. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Standard enterprise endpoints and domain member servers represent the primary ingress point for adversaries seeking footholds inside an organization. Ensuring boot-level integrity prevents attackers from using persistence mechanisms that bypass user-mode security software. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem: 1. **Kernel Attack Surface Reduction**: Restricting the system to only load trusted fonts installed in the `%windir%\Fonts` system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. **Mitigation of Document-Based Exploits**: Prevents malicious font files embedded in Microsoft Office documents, PDFs, or web pages from triggering parsing vulnerabilities in the context of the current user. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Service Host (`svchost.exe`) process is a fundamental Windows operating system binary designed to host one or more shared or isolated system services. Because `svchost.exe` instances execute with elevated privileges (such as `NT AUTHORITY\SYSTEM`, `NT AUTHORITY\LOCAL SERVICE`, or `NT AUTHORITY\NETWORK SERVICE`) and naturally maintain persistent execution across user sessions, they represent one of the primary targets for threat actors seeking privilege escalation, defense evasion, and persistence on client workstations. In client endpoint environments, workstations serve as the primary initial access vector for attackers through phishing attachments, malicious browser downloads, drive-by exploits, or compromised peripheral devices. Once a basic user-level foothold is achieved, adversaries frequently attempt to blend malicious activity into legitimate system traffic by targeting `svchost.exe`: 1. **Process Injection & Hollowing (MITRE ATT&CK T1055, T1055.012)**: Attackers create a suspended `svchost.exe` process or inject malicious code into an existing service host instance (`CreateRemoteThread`, `QueueUserAPC`, `SetThreadContext`). This disguises command-and-control (C2) beaconing (e.g., Cobalt Strike, Sliver, Brute Ratel) under trusted system process names and bypasses basic endpoint security inspection. 2. **Dynamic Code Execution & Reflective Loading**: In-memory payloads and exploitation frameworks rely on allocating executable memory (`PAGE_EXECUTE_READWRITE` via `VirtualAlloc` or `VirtualProtect`) to dynamically decrypt, compile, or inject unmapped DLLs directly into process memory without touching disk. 3. **Ghost Service DLL Hijacking & Malicious Service Registration (MITRE ATT&CK T1574.002)**: Attackers modify service registry keys to point `ServiceDll` to unsigned, arbitrary third-party DLLs. When the Service Control Manager starts the service, `svchost.exe` loads the unauthorized DLL with SYSTEM privileges. Enabling `svchost.exe` mitigation options instructs the Windows Service Control Manager (SCM, `services.exe`) to apply strict kernel-enforced process creation mitigation policies whenever a new `svchost.exe` instance is spawned: * **Microsoft-Only Binary Enforcement (`PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON`)**: Enforces that every executable binary and Dynamic Link Library (DLL) loaded into the address space of any `svchost.exe` process must be digitally signed by a trusted Microsoft certificate (Windows Production Root, WHQL, or Microsoft Corporation). Any attempt by unsigned, self-signed, or third-party binaries to map into `svchost.exe` is immediately terminated by the Windows kernel with `STATUS_INVALID_IMAGE_HASH` (`0xC0000428`). * **Dynamic Code Execution Blocking (`PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON`)**: Disallows the generation and execution of dynamic code within `svchost.exe` processes. This kernel mitigation blocks arbitrary memory page execution, preventing JIT compilation abuse, shellcode execution, and reflective DLL injection inside all system service containers. * **Service Host Splitting Synergies**: Since Windows 10 Version 1703, on workstations with more than 3.5 GB of RAM (`SvcHostSplitThresholdInKB`), Windows automatically isolates individual services into dedicated, standalone `svchost.exe` processes. When `EnableSvchostMitigationPolicy` is active, this per-service architecture ensures that every isolated service process receives independent, uncompromising mitigation enforcement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kernel-mode Hardware-enforced Stack Protection uses CPU hardware features to protect the operating system kernel from memory corruption exploits, specifically Return-Oriented Programming (ROP) attacks. An adversary attempting privilege escalation or remote code execution often hijacks the control flow of kernel-mode components by overwriting return addresses on the stack. Intel Control-flow Enforcement Technology (CET) and AMD Shadow Stack technologies create a separate, hardware-secured copy of the call stack (the "shadow stack"). Before returning from a function, the CPU compares the return address on the standard stack with the address stored on the hardware-secured shadow stack. If the addresses do not match, the processor detects a control flow violation, terminates the process, or triggers a system crash to prevent execution of malicious payloads. Enforcing Kernel-mode Hardware-enforced Stack Protection provides hardware-backed control-flow integrity, neutralizing key vectors of kernel exploitation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 To minimize the attack surface of standard client endpoints and member servers, all unnecessary legacy protocols, optional features, and runtime engines must be disabled: 1. **PowerShell 2.0 Engine**: Legacy PowerShell 2.0 does not support modern logging, transcription, or security monitoring mechanisms such as the Antimalware Scan Interface (AMSI). Attackers leverage "downgrade attacks" by executing PowerShell scripts using the `-version 2.0` parameter to bypass script block logging and security tooling. Disabling the engine and its parent runtimes eliminates this bypass vector. 2. **.NET Framework 3.5**: The .NET 3.5 Framework includes the runtime files for .NET 2.0 and 3.0. PowerShell 2.0 requires .NET 2.0/3.5 to run. Disabling `.NET Framework 3.5` removes legacy runtime binaries that are susceptible to downgrade attacks and removes support for older, unpatched software. 3. **SMBv1 Protocol**: The legacy SMBv1 protocol is cryptographically weak, lacks authentication integrity protection, and has been the target of catastrophic remote code execution attacks (such as EternalBlue). Leaving the SMBv1 driver active allows relaying and man-in-the-middle attacks. 4. **Internet Explorer 11**: Internet Explorer contains obsolete MSHTML render engine components. Disabling this legacy browser reduces vulnerability to web-based code execution. 5. **Work Folders, XPS, DirectPlay, and Client Protocols**: Services and tools such as Work Folders, XPS Viewer, DirectPlay, Telnet Client, TFTP Client, and Simple TCP/IP Services contain legacy network parsers and protocols that are completely unnecessary for a secure administrative system. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malicious documents (e.g., weaponized Word, Excel, or PowerPoint files) containing embedded VBA macros are a prevalent initial access and execution vector. Similarly, embedding malicious OLE packages inside Outlook items (such as RTF-formatted emails) allows attackers to trigger script execution or execute arbitrary packages via `packager.dll` when an administrator or standard user opens or previews the email. Hardening these settings ensures: 1. **Internet Macro Blocking**: VBA macros in files downloaded from the Internet or untrusted external attachments are blocked from executing, regardless of user consent. 2. **Macro Code Signing**: Any locally run macros are restricted to trusted, digitally signed code, preventing the execution of ad-hoc unverified user scripts. 3. **OLE Package Disablement**: Restricting Outlook OLE package activation (`ShowOLEPackageObj = 0`) blocks the execution of dangerous embedded objects in email messages. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Script Host (WSH), encompassing the `wscript.exe` (graphical) and `cscript.exe` (command-line) host engines, executes legacy scripting languages including VBScript (`vbscript.dll`) and JScript (`jscript.dll`). In client endpoint environments, WSH is one of the most heavily abused Living-off-the-Land Binaries (LOLBins / LOLBAS) leveraged by adversaries for initial access, defense evasion, and payload execution (MITRE ATT&CK T1059.005, T1059.007, T1218): 1. **Initial Access via Phishing and Drive-By Downloads**: Threat actors routinely deliver weaponized script files (such as `.vbs`, `.js`, `.wsf`, `.hta`) disguised as business invoices, delivery notifications, or archived attachments inside ZIP/ISO files. When an unsuspecting user double-clicks such a file, Windows Explorer automatically invokes `wscript.exe` or `mshta.exe`, running malicious code directly in the user's security context without prompting. 2. **Attack Surface Reduction**: Disabling WSH globally via the `Enabled = 0` registry parameter completely blocks `wscript.exe` and `cscript.exe` from executing any VBScript or JScript files system-wide, producing an immediate termination notice if an execution attempt is made. 3. **64-Bit and 32-Bit WOW6432Node Coverage**: On 64-bit Windows architectures, 32-bit applications and sub-processes invoke the 32-bit scripting host located in `%SystemRoot%\SysWOW64\wscript.exe`. Applying the `Enabled = 0` and `TrustPolicy = 2` registry values to both the native 64-bit hive (`HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings`) and the 32-bit registry hive (`HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings`) guarantees that 32-bit sub-processes cannot be weaponized as an evasion tactic. 4. **TrustPolicy Hardening**: Setting `TrustPolicy = 2` enforces script restriction policies to disallow untrusted or unsigned scripts, providing defense-in-depth even if individual components attempt to execute outside the primary WSH engine. 5. **Defense-in-Depth File Association Remapping**: Setting default file associations for legacy script extensions (`.vbs`, `.vbe`, `.js`, `.jse`, `.wsf`, `.wsh`, `.hta`) to `txtfile` (`notepad.exe`) ensures that if a script file is double-clicked in Windows Explorer, it opens harmlessly in Notepad for plain-text inspection rather than executing code. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the `AvailableUpdates` registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is **`0x5944`** (hex) / **`22852`** (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at **`0x4000`** (hex) / **`16384`** (decimal) upon successful completion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections on standard endpoints. In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the **Microsoft Vulnerable Driver Blocklist** via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to **Kernel Mode Code Integrity (KMCI) only** (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits on endpoint hosts without introducing administrative overhead or blocking standard user-mode applications. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Computer Browser service (`Browser`, driven by the legacy kernel driver `bowser.sys`) maintains an inventory of domains, workgroups, and network servers across local network segments using unauthenticated NetBIOS over TCP/IP (NetBT) broadcast frames and Server Message Block version 1 (SMBv1) protocol datagrams. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Infrared Monitor Service (`irmon`, hosted within `svchost.exe` via `irmon.dll`) manages line-of-sight optical wireless communications using the legacy Infrared Data Association (IrDA) protocol stack and Object Exchange (OBEX) profiles. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Internet Connection Sharing service (`SharedAccess` / ICS) provides Network Address Translation (NAT), dynamic addressing (embedded DHCP server), and name resolution (DNS proxy) capabilities to allow local devices on a network segment to share an external network connection. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Subsystem for Linux (WSL) service (`LxssManager`) coordinates the lifecycle, initialization, and execution of Linux distributions within Windows, managing syscall translation (WSL 1) or lightweight Hyper-V micro-virtual machines (WSL 2). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Microsoft FTP Service (`FTPSVC`) is an IIS server component that provides File Transfer Protocol (FTP) hosting services over TCP port 21. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The OpenSSH SSH Server service (`sshd`) provides inbound secure shell access, interactive command-line terminal hosting (cmd/PowerShell), and secure file transfer (SFTP/SCP) over TCP port 22. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Remote Procedure Call (RPC) Locator service (`RpcLocator`) manages the legacy RPC name service database, originally designed in early Windows NT architectures to allow RPC server applications to publish interface bindings and RPC clients to discover those interfaces by name across network domains. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Routing and Remote Access Service (`RemoteAccess` / RRAS) provides multi-protocol LAN-to-LAN routing, Network Address Translation (NAT), dial-up networking, and VPN server capabilities (PPTP, L2TP, SSTP, IKEv2). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Simple TCP/IP Services (`simptcp`) implement a suite of legacy diagnostic protocols conceived in the 1980s over both TCP and UDP: Echo (port 7, RFC 862), Discard (port 9, RFC 863), Character Generator / Chargen (port 19, RFC 864), Daytime (port 13, RFC 867), and Quote of the Day / QOTD (port 17, RFC 865). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Special Administration Console (SAC) Helper service (`sacsvr`) supports Emergency Management Services (EMS), an out-of-band management architecture developed for headless Windows Server hardware to allow remote diagnostic console access over physical or virtual serial (COM) ports. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Simple Service Discovery Protocol (SSDP) Discovery service (`SSDPSRV`) listens on UDP port 1900 multicast (`239.255.255.250` for IPv4 and `[FF02::C]` / `[FF05::C]` for IPv6) to discover Universal Plug and Play (UPnP) networked devices such as consumer printers, residential gateways, smart displays, and media renderers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The UPnP Device Host service (`upnphost`) enables a Windows endpoint to announce, configure, and host dynamic Universal Plug and Play (UPnP) devices and control points. When software components or peripherals register with `upnphost`, the service publishes XML device descriptions and listens on local HTTP endpoints to process incoming UPnP SOAP control actions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Web Management Service (`WMSvc`) facilitates remote web server administration for Internet Information Services (IIS), listening for incoming remote management connections over HTTPS TCP port 8172. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Media Player Network Sharing Service (`WMPNetworkSvc`, hosted by `wmpnetwk.exe` or `svchost.exe`) shares Windows Media Player multimedia libraries (audio, video, playlists) with other network media players and control devices over Universal Plug and Play (UPnP) and Digital Living Network Alliance (DLNA) protocols. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Mobile Hotspot Service (`icssvc`) manages software-based wireless access points (SoftAP) and connection tethering features, allowing an endpoint to share its Ethernet, Wi-Fi, or cellular connection with external wireless devices. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The World Wide Web Publishing Service (`W3SVC`) is the core Internet Information Services (IIS) HTTP/HTTPS web server engine. It manages HTTP listeners, routes web traffic to `w3wp.exe` worker processes, and hosts ASP.NET, PHP, and static web content over TCP ports 80 and 443. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Accessory Management Service (`XboxGipSvc`, hosted in `svchost.exe` via `XboxGipSvc.dll`) manages connected Xbox peripherals, gamepads, steering wheels, headsets, and consumer wireless dongles by interfacing with the Xbox Game Input Protocol (GIP) kernel driver stack (`xboxgip.sys`). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Auth Manager (`XblAuthManager`, hosted in `svchost.exe` via `XblAuthManager.dll`) provides programmatic authentication and token brokering services for consumer Microsoft Accounts (MSA) and the Xbox Live cloud gaming platform. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Game Save Service (`XblGameSave`, hosted in `svchost.exe` via `XblGameSave.dll`) manages background synchronization of game state, telemetry, and save container files between the local workstation file system and Microsoft Xbox Live consumer cloud storage. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Networking Service (`XboxNetApiSvc`, hosted in `svchost.exe` via `XboxNetApiSvc.dll`) provides network interface management, peer-to-peer session establishment, and NAT traversal capabilities for Xbox Live multiplayer, party chat, and Windows gaming network APIs. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Preventing local overrides of Microsoft Active Protection Service (MAPS) reporting ensures that endpoints consistently report telemetry and signature feedback to cloud resources, preserving centralized protective visibility. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM endpoints. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Defender SmartScreen protects users from running unrecognized or potentially malicious applications downloaded from the internet. Configuring the level to 'Block' prevents users from bypassing security warnings. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Preventing OneDrive files from syncing automatically protects endpoints against automated synchronization of encrypted files during a ransomware event, and prevents unauthorized data exfiltration. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Forcing the Attachment Manager to notify the registered antivirus product when a user opens files downloaded from the web or email clients prevents initial access vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents Adobe Reader from launching any child processes. Malicious PDF documents frequently attempt to exploit application vulnerabilities or trick users into executing embedded links, which spawns command shells (cmd.exe, powershell.exe) or scripting hosts (wscript.exe) to download and launch secondary malware payloads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes. This prevents malicious files containing embedded VBA macros or exploiting unpatched vulnerabilities (such as CVE-2021-40444) from launching scripting environments or system commands to download and execute code. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents executable files (such as .exe, .com, .scr, .vbs, .js, or .pif) from launching directly from email clients (like Outlook) or webmail accessed via browser sessions. This stops phishing attacks where users accidentally launch malicious attachments or download payloads directly from web-based email links. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks execution of unrecognized, newly compiled, or low-prevalence executable files. This provides initial protection against zero-day malware campaigns and targeted custom payloads that have not yet established reputation telemetry in the Microsoft Cloud Protection network. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents JavaScript or VBScript running locally from launching executable binaries that were downloaded from the internet. Attackers use malicious scripts inside documents or web browsers to download payloads (like ransomware or trojans) to the disk and launch them using local script engines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents Microsoft Office applications (Word, Excel, PowerPoint) from creating or writing executable files (e.g., .exe, .dll, .scr) to the local filesystem. Malicious documents often attempt to drop payloads directly into the local temp folders or AppData directories before executing them. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Office applications from writing code or injecting threads directly into external processes. Threat actors use code injection (such as process hollowing or remote thread creation) inside Office macros to hide execution under clean, trusted system binaries like explorer.exe or svchost.exe. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Outlook or other Office communication applications (e.g., Teams, Skype) from creating child processes. This prevents malware payloads delivered through emails, chats, or calendar invites from spawning command-line utilities or scripting environments. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and workstations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks the execution of unsigned or untrusted processes on removable storage devices (USB drives, external SSDs). This stops physical access vectors, rogue USB drops, and automated worm propagation techniques from running unauthorized installers or scripts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks VBA macros inside Microsoft Office documents from invoking Win32 API calls. Malicious documents use macros to call kernel memory functions (such as VirtualAlloc, WriteProcessMemory, or CreateThread) to load and execute shellcode in memory without dropping files to disk, bypassing file scanners. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTrustedCredManAccessPrivilege` allows a process to access the Windows Credential Manager as a trusted caller via internal Credential Manager APIs. The Credential Manager securely stores user domain credentials, web passwords, and certificate secrets used for network authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeNetworkLogonRight` determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTcbPrivilege` identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via `LsaRegisterLogonProcess` and invoke `LsaLogonUser` to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeInteractiveLogonRight` determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (`explorer.exe`) and interactive desktop session. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeBackupPrivilege` grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the `FILE_FLAG_BACKUP_SEMANTICS` flag in Win32 `CreateFile` calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemtimePrivilege` allows a security principal to adjust the internal hardware clock and system time of the computer via Win32 APIs `SetSystemTime` or `SetLocalTime`. Accurate time synchronization is foundational to the Windows distributed security architecture. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTimeZonePrivilege` controls the capability to change the system local time zone setting via `SetTimeZoneInformation`. While changing the time zone does not alter the underlying UTC hardware clock, it alters the local display time and timestamp calculations across the operating system. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePagefilePrivilege` allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (`pagefile.sys`) via the `NtCreatePagingFile` API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateTokenPrivilege` allows a process to invoke the native API `NtCreateToken` to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (`lsass.exe`) following successful authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateGlobalPrivilege` allows a process to create named kernel and user objects (such as named pipes, shared memory sections, mutexes, and events) in the `\BaseNamedObjects` global namespace accessible across all terminal services sessions and interactive logon sessions. In terminal services and multi-user Windows environments, each interactive session is isolated into a private namespace (`\Sessions\X\BaseNamedObjects`). The global namespace is reserved for system services that must communicate across session boundaries. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePermanentPrivilege` allows a process to create permanent object directory objects in the Windows Object Manager namespace (`\DirectoryObject`) via APIs like `NtCreateDirectoryObject`. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateSymbolicLinkPrivilege` controls the ability to create filesystem symbolic links (symlinks) via `CreateSymbolicLink` or `mklink`. Symbolic links are filesystem pointers that transparently redirect file and directory access to alternate target paths. While useful for software development and container workflows, unconstrained symbolic link creation represents one of the most common primitives for Local Privilege Escalation (LPE) in Windows. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDebugPrivilege` allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to `OpenProcess` with permissions such as `PROCESS_ALL_ACCESS` or `PROCESS_VM_READ` succeed even against processes owned by other users or `NT AUTHORITY\SYSTEM`. This privilege is intended strictly for kernel/application developers debugging live processes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeEnableDelegationPrivilege` allows a security principal to modify the `userAccountControl` attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) `TRUSTED_FOR_DELEGATION` (Unconstrained Delegation); (2) `TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION` (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRemoteShutdownPrivilege` allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as `InitiateSystemShutdownEx` or `shutdown.exe /m \\computer`). This function is exposed over named pipe `\PIPE\InitShutdown` and RPC interface `winreg`/`shutdown`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeImpersonatePrivilege` grants a program the ability to impersonate a client that has connected to its local RPC interfaces, named pipes, or COM servers via `ImpersonateNamedPipeClient`, `CoImpersonateClient`, or `RpcImpersonateClient`. Impersonation allows a server process to temporarily run in the security context of the calling client to verify access permissions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeIncreaseBasePriorityPrivilege` allows a process to raise the execution priority class of a process or thread via `SetPriorityClass` to `REALTIME_PRIORITY_CLASS`. The Windows kernel thread scheduler gives realtime priority threads preemption authority over virtually all other system threads, including device driver deferred procedure calls (DPCs) and operating system subsystem threads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLoadDriverPrivilege` allows a process to dynamically load and unload kernel-mode device drivers (`.sys` files) via `NtLoadDriver` or the Service Control Manager (`CreateService` with `SERVICE_KERNEL_DRIVER`). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLockMemoryPrivilege` allows a process to lock physical memory pages in RAM using APIs such as `VirtualLock` and Address Windowing Extensions (AWE) via `AllocateUserPhysicalPages`. Locking pages prevents the Windows virtual memory manager from paging data out to disk in `pagefile.sys`, ensuring high-performance memory retention. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSecurityPrivilege` controls access to the Windows Security Event Log (`Security.evtx`) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via `ACCESS_SYSTEM_SECURITY`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemEnvironmentPrivilege` allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs `GetFirmwareEnvironmentVariable` and `SetFirmwareEnvironmentVariable`. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeManageVolumePrivilege` allows a process to perform low-level disk and volume maintenance tasks, including running defragmentation tools, modifying volume quotas, and invoking the `SetFileValidData` Win32 API. The `SetFileValidData` function allows a caller to extend the valid data length of an allocated file without zeroing out the intervening disk clusters. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeProfileSingleProcessPrivilege` allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemProfilePrivilege` allows a process to use performance monitoring tools to sample and profile operating system-wide and kernel-level performance via Windows tracing APIs and hardware performance counters. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeAssignPrimaryTokenPrivilege` allows a process to assign a primary security access token to a newly initialized process via APIs such as `CreateProcessAsUser` or `SetInformationJobObject`. In the Windows NT security architecture, every process runs under a primary token that defines its user SID, group memberships, privileges, and Mandatory Integrity Control (MIC) level. Under normal conditions, child processes automatically inherit a duplicate of the parent process primary token. When a process holds `SeAssignPrimaryTokenPrivilege`, it can substitute an arbitrary primary token obtained from another session, service, or authentication handshake, effectively launching programs under the security context of any arbitrary user or the local SYSTEM account. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRestorePrivilege` grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying `FILE_FLAG_BACKUP_SEMANTICS` in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTakeOwnershipPrivilege` allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via `SetNamedSecurityInfo` or `SetSecurityInfo`. The Windows security model grants the owner of an object implicit `WRITE_DAC` authority. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRelabelPrivilege` controls the ability to modify the Mandatory Integrity Control (MIC) label of securable objects via `SetKernelObjectSecurity` or `SetNamedSecurityInfo`. Windows Mandatory Integrity Control defines four primary integrity levels: Low, Medium, High, and System. MIC enforces 'No Write Up' rules, preventing a process running at a lower integrity level from writing to or modifying objects at a higher integrity level. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyNetworkLogonRight` explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyRemoteInteractiveLogonRight` explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern desktop applications, productivity suites (Microsoft Teams, Outlook), communication channels, and identity tools routinely utilize Windows Push Notifications to display pop-up "toast" notification banners on the screen. By default, Windows allows applications to surface these notification banners "above the lock screen," presenting a major physical data leakage and credential compromise vulnerability. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows consumer experiences and Windows Spotlight are cloud-integrated features designed to deliver targeted application suggestions, promotional tiles, interactive lock screen imagery, and tips to consumer endpoints. In an enterprise Active Directory domain, these features introduce significant threat surfaces, outbound network connections, and unapproved software provisioning. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Copilot is an artificial intelligence assistant deeply integrated into the Windows 11 desktop shell, Edge browser runtime, and search experience. Copilot utilizes cloud-hosted large language models (LLMs) to synthesize user requests, summarize screen contents, and assist with desktop workflows. In an enterprise environment, unconstrained deployment of generative AI interfaces introduces critical data loss prevention (DLP), regulatory compliance, and credential exposure hazards. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In modern versions of Windows, File Explorer incorporates the "In-Place Sharing" framework (also known as the Share Flyout or Share Charm). This mechanism provides users with a persistent "Share" button on the Explorer ribbon and context menu, allowing files to be directly broadcasted or transmitted to third-party applications, personal email accounts, social media platforms, or nearby devices via Nearby Sharing (Bluetooth and Wi-Fi Direct). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In default Windows configurations, holding the Shift key while right-clicking an executable (`.exe`), command file (`.cmd`), batch script (`.bat`), or Microsoft Management Console file (`.msc`) exposes the "Run as different user" shell context menu command verb (`runasuser`). This feature encourages an anti-pattern that directly violates enterprise credential hygiene and exposes high-privilege credentials to theft on standard workstations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows personalization and input learning features enhance the consumer user experience by providing voice activation, dynamic lock screen slideshows, camera access, and predictive typing. In an enterprise security environment, these unauthenticated and telemetry-driven features introduce physical reconnaissance vulnerabilities, memory corruption attack surfaces, and persistent keystroke data collection. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Group Policy processing in Windows relies on Client-Side Extensions (CSEs). Each CSE is registered under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions` with a unique GUID. The GUID `{35378EAC-683F-11D2-A89A-00C04FBBCFA2}` represents the primary **Registry Client-Side Extension** (`gptext.dll`), which is responsible for applying Administrative Templates (`.admx`/`.adml` policies) and direct registry modifications defined across applied Group Policy Objects. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern Windows operating systems include background diagnostic, telemetry, and inventory scanning subsystems designed to evaluate system health, application compatibility, and user experience telemetry. These subsystems are driven primarily by the **Connected User Experiences and Telemetry** service (`DiagTrack`) and the **Microsoft Compatibility Appraiser** scheduled task (`CompatTelRunner.exe`). While helpful in consumer environments, uncontrolled inventory collection and extensive diagnostic data uploads introduce distinct operational and security risks in hardened enterprise deployments. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows File Explorer (`explorer.exe`) is the primary interactive user shell and file management environment in Windows. Because Explorer regularly parses untrusted file metadata, extracts icon caches, hosts third-party shell preview handlers, and processes custom URL protocol schemes, it represents a prime target for memory corruption exploits and arbitrary command execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Although modern versions of Windows 10 and Windows 11 have retired the standalone Internet Explorer 11 browser in favor of Microsoft Edge (Chromium), core legacy components of the Trident engine (`mshtml.dll`), the Windows Internet API (`wininet.dll`), URLMon, and the **Windows RSS Platform** (`msfeeds.dll`, `msfeedssync.exe`) remain deeply embedded in the operating system. These legacy subsystems are maintained for backward compatibility with legacy COM automation, WebBrowser controls, and internal enterprise tools. Because these legacy components remain active in the background, they represent a persistent attack surface if left unconfigured. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Interactive logon configurations govern the initial security boundary when an operator or user accesses the Windows console. Two critical security parameters are enforced: disabling Automatic Restart Sign-On (ARSO) to protect credentials in memory across reboots, and enforcing legally binding pre-logon warning banners to establish authorization boundaries and consent to monitoring. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In enterprise environments, authorized employees and operators frequently leave workstations unattended—to attend meetings, take breaks, or collaborate elsewhere in the facility. If a workstation remains unlocked while unattended, any individual with physical access to the machine can interact with the active user's session, execute unauthorized commands, exfiltrate sensitive files, or install persistence mechanisms without needing to authenticate. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Installer (`msiexec.exe`) executes as a privileged Windows service (`NT AUTHORITY\SYSTEM`) to manage the installation, repair, and removal of software packages across the operating system. Misconfigurations in Windows Installer policies introduce some of the most critical, well-known Local Privilege Escalation (LPE) vulnerabilities in the Windows operating system. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Secondary Logon service (`seclogon.dll`, executed within `svchost.exe`) provides the runtime infrastructure that enables the `CreateProcessWithLogonW` and `CreateProcessWithTokenW` Win32 APIs, powering the native Windows `runas.exe` utility and interactive "Run as different user" GUI options. While designed to facilitate administrative convenience, the Secondary Logon service introduces severe local privilege escalation risks and undermines enterprise credential tiering hygiene. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account logon events captures authentication requests processed by the local system or the domain controller, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Structured Exception Handling (SEH) is a core Win32 application mechanism designed to manage runtime hardware and software exceptions. However, 32-bit Win32 and WOW64 processes maintain SEH records directly on the thread's stack, creating a classic attack vector for stack buffer overflows where adversaries hijack exception dispatching to execute arbitrary shellcode. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Securing the Windows system root and core system directories against unauthorized modification is essential to preventing Local Privilege Escalation (LPE) and DLL planting attacks. The `ProtectionMode` registry setting configures the Windows Session Manager (`smss.exe`) to enforce hardened security descriptors across critical system directories and Object Manager namespaces during operating system initialization. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Address Space Layout Randomization (ASLR) is a foundational defense against memory corruption vulnerabilities. By randomizing the memory locations of program headers, code segments, stacks, heaps, and libraries, ASLR ensures that an adversary cannot reliably predict target memory addresses when attempting to hijack execution flow. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Transient execution vulnerabilities (such as Spectre, Meltdown, Foreshadow/L1TF, and Microarchitectural Data Sampling / MDS) break architectural isolation boundaries by exploiting CPU speculative execution and out-of-order execution optimizations. Hardware cache side-channel attacks allow unprivileged user-mode processes to reconstruct secret memory contents from kernel address space and adjacent processes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Digital signature verification (Authenticode) is the foundational trust boundary used by Windows Defender Application Control (WDAC), AppLocker, Antivirus engines, and the operating system loader to establish software provenance and integrity. A fundamental design loophole in legacy Authenticode validation allows adversaries to tamper with signed binaries without invalidating their digital signature unless strict certificate padding validation is enforced. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Command Processor (`cmd.exe`) is widely utilized for system administration, software installation routines, and scheduled maintenance tasks. By default, `cmd.exe` executes batch files (`.bat` and `.cmd`) using a streaming file read approach rather than caching the entire script in memory or acquiring a persistent file lock. This design exposes systems to Time-of-Check to Time-of-Use (TOCTOU) race conditions and dynamic script manipulation attacks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Time-Travel Debugging (TTD) is an advanced diagnostic framework embedded in Microsoft development and troubleshooting tooling (such as WinDbg Preview and Windows Diagnostic Infrastructure). TTD works by recording a complete, instruction-by-instruction execution history of a process into a high-fidelity trace file (`.run`), which can then be replayed forwards and backwards in time. In an enterprise environment, unconstrained TTD recording represents a severe data exfiltration and credential theft vulnerability. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows CryptoAPI Trusted Root Certification Authorities store (`Root`) defines the ultimate trust anchors for TLS/SSL communication, Kerberos PKINIT authentication, code signing, and digital identity verification. If an adversary, malicious script, or unauthorized third-party software can inject a rogue Certificate Authority (CA) into the trusted root store, the cryptographic integrity of all network communication and software trust models is completely undermined. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 AppInit_DLLs is a legacy Windows application infrastructure mechanism dating back to Windows NT. It allows system administrators and software vendors to specify a list of dynamic-link libraries (DLLs) that are automatically loaded into the virtual address space of every user-mode process that links against `User32.dll`. Because nearly all interactive Win32 desktop applications, Windows system binaries, and management utilities load `User32.dll`, this mechanism represents a pervasive, high-risk attack surface for persistence, privilege escalation, and stealthy code injection. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Mark-of-the-Web (MOTW) is a vital Windows defensive mechanism that tags files downloaded from the Internet or untrusted external zones with contextual provenance metadata. When a file is received via a web browser, email client (e.g., Microsoft Outlook), or chat application, the Windows Attachment Manager (`IAttachmentExecute` API) writes an NTFS Alternate Data Stream (ADS) named `Zone.Identifier` to the downloaded file. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Game Recording and Broadcasting (Game DVR) is a consumer-oriented multimedia subsystem built into Windows 10 and 11. Designed to capture gaming clips, broadcast live gameplay, and maintain background rolling video buffers, the Game DVR subsystem introduces severe information disclosure risks, unmonitored desktop recording pathways, and unnecessary system resource utilization on enterprise workstations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Ink Workspace provides digital pen and stylus input capabilities, offering productivity tools such as Sticky Notes, Whiteboard, and Snip & Sketch on touch-enabled devices and laptops. When unconstrained, Windows allows the Ink Workspace to be invoked while the device is locked—typically by clicking the shortcut button on an active digital stylus or tapping the lock screen icon. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Establishing a hardened password baseline across enterprise client workstations and member servers protects against password guessing, automated spray campaigns, and offline cryptanalysis: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Configuring a balanced, resilient account lockout baseline across enterprise client workstations and member servers defends against automated password guessing and password spraying while minimizing business interruption from user typos: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kerberos authentication tokens underpin enterprise access across Active Directory environments. Establishing bounded ticket lifetimes and clock synchronization rules restricts ticket reuse, session hijacking, and replay attacks: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In enterprise environments deploying physical smart cards, PIV/CAC badges, or FIDO2 cryptographic tokens for endpoint authentication, removing the physical token must immediately transition the host to a secure state. Hardening smart card removal behavior protects against unauthorized physical console access: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 When domain users authenticate against Windows workstations, the operating system can cache authentication verifiers locally to permit subsequent logons if an Active Directory Domain Controller is unreachable. Hardening this mechanism limits local credential exposure and renders offline attacks computationally unfeasible: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Local accounts represent an attractive target for initial access and lateral movement across enterprise workstations. Restricting blank password usage, purging insecure LAN Manager hashes, and enforcing the Classic network authentication model hardens the local SAM perimeter across endpoints: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Legacy authentication protocols such as LAN Manager (LM) and NTLMv1 represent major vectors for credential interception, offline password recovery, and adversary-in-the-middle relay attacks across corporate networks. Hardening NTLM authentication parameters across endpoints enforces modern cryptographic session controls: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (LSASS) holds authentication tokens and session security contexts for logged-on users. Historically, the WDigest provider retained cleartext passwords in memory, exposing enterprise networks to devastating credential theft: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Deploying Windows Hello for Business (WHfB) across enterprise workstations transitions the environment from vulnerable password-based authentication to hardware-bound asymmetric cryptographic keys. However, strict policy constraints must be enforced to prevent weak PIN choices and insecure fallback mechanisms: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Allowing users to attach consumer Microsoft Accounts (such as `@outlook.com`, `@hotmail.com`, or `@live.com`) to enterprise-managed client workstations bypasses corporate identity perimeters and exposes organizational data to unauthorized external storage: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Netlogon secure channel provides the core trust link between enterprise workstations, member servers, and Active Directory Domain Controllers for user authentication, group enumeration, and secure channel key rotation. Hardening this channel prevents cryptographic downgrade, spoofing, and machine account persistence: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Server Message Block (SMB) protocol is integral to enterprise file sharing, administrative automation, and printer sharing. Hardening SMB client and server parameters protects against cleartext credential theft, resource exhaustion from dormant sessions, and anonymous file access: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Restricting unauthenticated network reconnaissance protects local SAM databases, user account identifiers, and shared directory paths across enterprise endpoints and member servers: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Interactive logon configurations govern how users authenticate at the physical console or remote desktop interface. Hardening these parameters across client endpoints and member servers defends against credential phishing, shoulder surfing, and intentional system crash exploits: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The WebClient service (`WebClient`, driven by `davclnt.sys`) enables Windows programs to create, access, and modify remote files on Internet-based web servers using the Web Distributed Authoring and Versioning (WebDAV) protocol over HTTP and HTTPS. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory environments relying on standard Kerberos authentication are susceptible to offline brute-force, dictionary attacks, and credential harvesting. During standard Kerberos pre-authentication, the client sends an Authentication Service Request (AS-REQ) containing timestamp data encrypted with the user's password hash. Attackers monitoring network traffic can intercept these timestamps, or execute AS-REP roasting against accounts that do not require Kerberos pre-authentication (`DONT_REQ_PREAUTH`), conducting offline hash cracking to recover cleartext credentials. Kerberos Armoring, also known as Flexible Authentication Secure Tunneling (FAST - RFC 6113), mitigates this vulnerability by establishing an encrypted channel between the client workstation and the Key Distribution Center (KDC) on the Domain Controller. This tunnel is encrypted using the computer account's credential (or machine certificate), protecting pre-authentication messages (AS-REQ and AS-REP) from eavesdropping, offline dictionary attacks, and message tampering. On standard Tier 2 client workstations, Kerberos Armoring is configured for opportunistic negotiation (`RequireFast = 0`). This instructs the Windows Kerberos security provider to request armored exchanges whenever communicating with FAST-capable Domain Controllers, while maintaining backward compatibility with legacy resource servers, external forest trusts, and non-Windows Kerberos realms that do not yet support RFC 6113 FAST. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Server Message Block version 1 (SMBv1) is a legacy file and print sharing protocol designed in the early 1980s that suffers from severe architectural design flaws, obsolete cryptographic mechanisms, and extensive vulnerabilities exploited in widespread cyberattacks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 NetBIOS over TCP/IP (NetBT, defined in RFC 1001/1002) is a legacy name resolution and session transport protocol that relies heavily on unauthenticated IP broadcasts over UDP port 137. In modern enterprise environments, NetBT introduces significant attack vectors that can be weaponized for credential theft and denial of service. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Internet Protocol suite (IPv4 RFC 791 and IPv6 RFC 2460/8200) contains legacy diagnostic and routing mechanisms that allow packet senders and adjacent network nodes to manipulate routing decisions. In hostile or untrusted network environments, these capabilities introduce critical exposure to packet spoofing, firewall evasion, and adversary-in-the-middle attacks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Microsoft Solutions for Security (MSS) baseline settings provide low-level kernel, session manager, and authentication subsystem protections. These settings address fundamental Windows operating system security behaviors, including DLL search-order resolution, automatic logon credential storage, physical console lockout latency, and security event log capacity alerting. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 When physical or virtual peripherals—such as USB security tokens, smart card readers, external storage media, printers, or network adapters—are connected to a Windows system, the Device Setup Manager (DSM) initiates automated queries to Microsoft Windows Metadata and Internet Services (WMIS). These services deliver OEM-branded device icons, detailed model descriptions, and companion application links displayed in the "Devices and Printers" interface. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Group Policy service (`gpsvc`) manages operating system and security configurations through Client-Side Extensions (CSEs). To minimize network overhead and processing latency, the default Windows Group Policy engine implements an optimization check: during periodic background refresh cycles (every 90 minutes with a randomized 30-minute delta), CSEs compare the local GPO version with the Active Directory SYSVOL version. If the GPO version has not incremented, the CSE skips applying settings. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Connected Devices Platform (CDP, also known internally as Project Rome) facilitates device-to-device communication, application activity roaming, session continuation ("Continue on PC"), and cross-device clipboard sharing across Windows, iOS, and Android devices. While convenient for consumer multi-device environments, CDP introduces severe security and data-governance vulnerabilities within corporate enterprise networks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows operating system includes several legacy features designed to download supplemental drivers, wizard components, and third-party web provider templates over unauthenticated internet connections. In enterprise environments, these automated internet interactions expose endpoints to remote code execution and data exfiltration. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (`lsass.exe`) is the central authentication authority in the Windows operating system, responsible for credential validation, token creation, and interactive logons. Security Support Providers (SSPs) and Authentication Packages (APs) execute as dynamic link libraries (DLLs) directly inside the `lsass.exe` memory space. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows logon desktop and lock screen represent the physical perimeter of the operating system. In unhardened configurations, the logon interface exposes critical internal network information, leaks corporate usernames, presents weak authentication alternatives, and permits unauthorized network reconfigurations without authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern Standby (S0 Low Power Idle) replaced legacy ACPI S3 (Suspend-to-RAM) sleep states in modern enterprise laptops and convertibles. When "Connected Standby" is permitted, the operating system maintains active Wi-Fi, cellular, and Ethernet network adapters while the display is powered off and the system is suspended. This architecture enables background applications to process incoming push notifications, sync mailboxes, and maintain persistent cloud sockets while unattended. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Remote Assistance (`msra.exe`) allows support personnel to view or remotely control an active user's desktop session across a network. Remote Assistance supports two primary connection modes: solicited (where an end user creates an encrypted invitation ticket) and unsolicited (where an external operator or administrator initiates an uninvited connection to the target workstation via "Offer Remote Assistance"). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Remote Procedure Call (RPC) subsystem is fundamental to Windows inter-process communication and remote management. The RPC Endpoint Mapper service (`epmapper`, listening on TCP port 135) maintains a dynamic database of RPC servers and maps interface UUIDs to dynamic high-range TCP listening ports (ports 49152–65535). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Time Service (`W32Time`) is a core architectural component of Windows security, providing synchronization across domain members, member servers, and directory nodes. Precise timekeeping is mandatory for protocol operation, cryptographic authentication, and forensic integrity. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern Windows application packaging architectures (AppX and MSIX) allow software components to be registered and executed within user profile spaces. In unhardened environments, default deployment behaviors allow standard unprivileged users to install modern packaged applications without administrative oversight or UAC elevation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Hello facial recognition provides convenient, passwordless authentication using biometric verification. However, basic facial recognition systems that analyze only two-dimensional visible spectrum images are vulnerable to presentation attacks and physical spoofing. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern editions of Windows integrate consumer-focused features into the desktop shell and operating system menus. These features display dynamic promotional cards, suggestions for Microsoft consumer cloud services (such as personal OneDrive, Microsoft 365 consumer subscriptions, and personal Microsoft Accounts), and personalized application recommendations directly within core UI components like the Start Menu, Settings app, File Explorer, and Lock Screen. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Connect application enables endpoints to function as wireless display receivers using the Miracast standard over Wi-Fi Direct (IEEE 802.11 P2P). While useful for collaborative screen projection in meeting rooms, unauthenticated wireless display pairing introduces severe physical perimeter attack vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Credential User Interface (CredUI) handles password collection dialogs and User Account Control (UAC) elevation prompts. In default configurations, CredUI exposes cleartext credentials on screen and leaks local administrative usernames to unprivileged operators. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Diagnostic Data Collection infrastructure collects system health, performance metrics, crash dumps, and telemetry data for transmission to Microsoft cloud services. Concurrently, the Windows Insider Program allows systems to receive pre-release operating system builds. In managed enterprise environments, unrestricted diagnostic data collection and preview builds introduce serious data leakage and operational stability risks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows App Installer (`AppInstaller.exe`) provides deployment capabilities for MSIX, AppX, and `.appinstaller` manifest packages. In default client configurations, App Installer registers the `ms-appinstaller://` uniform resource identifier (URI) scheme, allowing web pages to directly trigger package installation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Default Windows event log capacities (typically 20 MB) rollover within hours during normal workstation activity, and can be completely overwritten within minutes during active security incidents, brute-force attempts, or high-volume administrative operations. In hardened environments enforcing comprehensive audit policies (such as Process Creation with command-line arguments [Event ID 4688], PowerShell Script Block Logging [Event ID 4104], and detailed logon/logoff auditing), workstations typically generate between 100 MB and 300+ MB of security telemetry daily. A legacy 192 MB Security log preserves only 12 to 48 hours of telemetry, creating severe risks for endpoints operating off-network (remote users, field devices) where real-time Windows Event Forwarding (WEF) or SIEM shipping may be delayed. Expanding the **Security** log to **1 GB** (`1,048,576 KB`), **System** and **Application** logs to **128 MB** (`131,072 KB`), and **Setup** log to **32 MB** (`32,768 KB`) provides a resilient 7-to-14-day on-box forensic retention buffer. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Attachment Manager and File Explorer utilize the Mark of the Web (MotW) as a core security boundary. MotW is implemented as an NTFS Alternate Data Stream (ADS) named `Zone.Identifier` appended to files downloaded from the internet or untrusted network zones. Maintaining strict MotW integrity and enforcing shell protocol protected mode are essential defenses against initial-access malware campaigns. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Internet Explorer 11 reached official end-of-life and retirement on modern Windows platforms. The standalone browser executable (`iexplore.exe`) lacks contemporary exploit mitigations, process sandboxing, and memory safety defenses, making it a persistent vector for zero-day exploitation and drive-by malware execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Remote Encryption Protection actively detects and terminates network ransomware attempting to encrypt files over SMB shares. Enforcing Block mode terminates the malicious remote process or connection attempting rapid or unauthorized file encryption over network shares, halting lateral encryption attacks from unmanaged or compromised domain assets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Search and Cortana infrastructure provides desktop indexing, voice recognition, and location-aware query capabilities. In enterprise environments, unconstrained search and voice assistant features introduce severe data leakage, physical authentication bypass, and cryptographic exposure risks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern Windows installations incorporate numerous built-in packaged applications, runtime frameworks, and system extensions (such as Windows Terminal, App Installer, HEVC/VP9 codecs, and Edge WebView2 components) that are serviced through the Microsoft Store infrastructure. Managing store update behaviors is essential to ensure critical vulnerability patching while preventing unmanaged operating system upgrades. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Widgets (in Windows 11) and the earlier News and Interests feature (in Windows 10) integrate dynamic cloud-delivered content directly into the Windows desktop taskbar. The feature relies on the Desktop Shell Host (`widgets.exe`) and the Microsoft Edge WebView2 runtime to continuously retrieve and display news feeds, weather reports, sports scores, stock tickers, and third-party sponsored advertisements. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Automatic Restart Sign-On (ARSO) is a Windows convenience feature designed to streamline post-update maintenance. When an automated Windows Update requires a reboot, ARSO captures the interactive user's credentials, encrypts them via the Local Security Authority (LSA) and Data Protection API (DPAPI), and stages them across the reboot sequence. Upon restart, Winlogon automatically decrypts the credentials, logs the user on in the background, instantiates the user profile, and locks the console. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Sandbox provides a disposable, containerized desktop environment based on Hyper-V virtualization technology. While designed for the isolated execution of untrusted applications and triage of suspicious documents, default sandbox configurations permit bidirectional clipboard synchronization and shared network access, introducing significant breach risks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Update is the primary defense mechanism against known Common Vulnerabilities and Exposures (CVEs), remote code execution exploits, and privilege escalation vulnerabilities. In unhardened environments, default update policies allow users to pause updates, postpone reboots, or enroll in experimental preview builds, directly exposing the enterprise network to preventable exploitation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory default domain password policies apply globally to all user accounts. These global policies are often configured with lower complexity and length requirements to avoid overwhelming standard users. However, such settings are inadequate for highly privileged accounts (Tier 0 and Tier 1 administrators), which are primary targets for credential stuffing, brute-force, and offline cracking attacks. Enforcing Fine-Grained Password Policies (FGPP) via Password Settings Objects (PSOs) allows administrators to apply distinct, highly restrictive password and account lockout policies to specific users or groups. By mandating longer password lengths and stricter lockout thresholds for privileged identities, the domain's defense-in-depth posture is significantly bolstered without affecting standard users. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In standard Active Directory setups, local administrator accounts on member servers and client workstations often share the same password. If a single machine is compromised and the local administrator password hash is extracted (e.g., from LSASS memory or SAM database), attackers can leverage Pass-the-Hash (PtH) techniques to log on to other domain machines laterally. Implementing the Local Administrator Password Solution (LAPS) completely mitigates this lateral movement vector by automatically generating a unique, complex password for the specified local administrator account on each machine. These passwords are changed periodically and stored securely in a confidential attribute (`msLAPS-Password` or `ms-Mcs-AdmPwd`) on the computer's Active Directory object. Read access is restricted to authorized administrative groups. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Traditional service accounts in Active Directory are standard user accounts with static, often long-lived passwords. Because service passwords are rarely rotated, they are prime targets for offline brute-force attacks known as **Kerberoasting**. An attacker with domain access can request a Kerberos service ticket (TGS) for any account with a Service Principal Name (SPN) and attempt to crack the password hash offline. Group Managed Service Accounts (gMSAs) address this risk by delegating password management to the operating system and Domain Controllers. Windows automatically generates a complex 120-character password for each gMSA and rotates it every 30 days. Additionally, gMSAs cannot be used for interactive logons, preventing administrative session hijacking or remote administrative access via service accounts. However, gMSAs introduce specific security boundaries that must be strictly enforced: 1. **Password Retrieval Delegation (GMSA Password Access)**: The attribute `msDS-GroupMSAMembership` (`PrincipalsAllowedToRetrieveManagedPassword`) defines which security principals can query Active Directory to retrieve the clear-text gMSA password. If human user accounts or groups containing human users are added to this attribute, any compromise of those user credentials allows an attacker to fetch the clear-text password blob and convert it to an NT hash. 2. **Credential Dumping from memory (LSASS ekeys)**: While LSASS does not cache the clear-text password of a gMSA under standard `sekurlsa::logonpasswords` dumps, the active Kerberos keys (NT hash, AES-128/256 keys) are stored in memory on the host computer running the service. An attacker with administrative/SYSTEM access to the host server can extract these keys using Mimikatz `sekurlsa::ekeys` and use them for pass-the-hash (PTH) or pass-the-ticket (PTT) attacks. 3. **Tier Alignment (Tier-Matching)**: Because compromising the host server hosting a gMSA compromises the gMSA itself, and retrieving the gMSA password grants full control over its permissions, hosts running gMSAs must be secured to the same level (Tier) as the privileges granted to the gMSA. A Tier 0 gMSA must only run on Tier 0 systems (Domain Controllers or Tier 0 Admin Hosts), and only Tier 0 computer accounts/groups must be allowed to retrieve its password. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kerberos delegation allows a service to impersonate a user to access downstream resources on behalf of that user. In **Unconstrained Delegation**, when a user authenticates to a service, the user's Ticket Granting Ticket (TGT) is sent to the service server and stored in LSASS memory. If an attacker compromises that service server, they can extract the cached TGTs of all users who have authenticated to it (including Domain Admins) and impersonate them across the entire domain. To prevent this critical privilege escalation path, **Unconstrained Delegation must be banned entirely**. Any required delegation should be restricted to **Constrained Delegation** or **Resource-Based Constrained Delegation (RBCD)**, which specify exactly which target services can receive delegated credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Standard administrative accounts are highly vulnerable to credential harvesting attacks. If a Domain Admin or other high-privilege account authenticates to a compromised workstation or member server, their credentials (passwords, Kerberos TGTs, NTLM hashes) remain cached in the Local Security Authority Subsystem Service (LSASS) memory. Attackers can extract these credentials using tools like Mimikatz to escalate privileges or move laterally. The **Protected Users** security group (introduced in Windows Server 2012 R2) enforces non-configurable, highly secure authentication restrictions on its members. These protections include: 1. **No NTLM caching**: NTLM password hashes are not cached locally, and members cannot authenticate via NTLM. 2. **Short Kerberos TGT lifetimes**: Ticket Granting Tickets (TGTs) are limited to 4 hours and cannot be renewed beyond that. 3. **No weak encryption**: Members cannot use DES or RC4 encryption for Kerberos pre-authentication. 4. **No CredSSP or WDigest caching**: Cleartext credentials are never cached by the local system. 5. **No delegation**: Kerberos delegation (constrained or unconstrained) is blocked for accounts in this group. Placing Tier 0 and Tier 1 administrative accounts into the Protected Users group significantly reduces the threat of credential harvesting. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory and local Windows environments initialize built-in accounts with fixed Relative Identifiers (RIDs). The default Administrator account always has RID 500, and the Guest account always has RID 501. Because these accounts are well-known, they are frequent targets for automated brute-force, password guessing, and identity enumeration attacks. In many environments, the built-in local administrator account has the same password across multiple systems, allowing attackers to move laterally if they crack one machine. Renaming these accounts increases the complexity of target identification, while disabling them prevents unauthorized logons entirely. If LAPS is active, it can rotate the password of the local administrator account even when the account is disabled, preserving safe recovery options. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Service accounts are frequent targets of brute-force and Kerberoasting attacks. If an adversary successfully cracks a service account's password offline, their immediate next step is to use those credentials to log on to domain systems to establish a footprint, dump credentials from memory, or perform administrative tasks. By enforcing User Rights Assignment policies that explicitly deny service accounts the ability to log on locally (at the physical console) or through Remote Desktop Services (RDP), the threat of an interactive domain compromise via service credentials is neutralized. Even if a service account password is compromised, the attacker cannot utilize it to gain an interactive command shell or graphical desktop session on network endpoints or servers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In Active Directory, even when Group Policies restrict Kerberos encryption algorithms on domain members, individual user and service accounts can override these restrictions during authentication negotiation. If an account has obsolete encryption types enabled (e.g., RC4 or DES) or has the `msDS-SupportedEncryptionTypes` attribute set to `0` (default, which defaults to domain controllers' allowed options), the Key Distribution Center (KDC) may issue Service tickets (TGS) using the RC4 algorithm. Because RC4 utilizes weaker, legacy cryptography, tickets encrypted using RC4 can be easily extracted and cracked offline (Kerberoasting) by adversaries. Explicitly configuring the `msDS-SupportedEncryptionTypes` attribute to `24` (AES128 = 8 + AES256 = 16) on Active Directory accounts ensures that the KDC only negotiates AES encryption types, securing the authentication credentials against offline brute-forcing and ticket forgery. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kerberos Pre-Authentication serves as the primary line of defense against AS-REP Roasting. AS-REP Roasting is a credential theft technique where attackers target accounts that do not require Kerberos pre-authentication. Without pre-authentication: 1. **Unauthenticated Requesting**: The Key Distribution Center (KDC) will issue a Ticket Granting Ticket (TGT) encrypted with the user's secret key (derived from their password) to any client that requests it, without requiring the client to authenticate or prove identity first. 2. **Offline Password Cracking**: An attacker can request a TGT for a target user, intercept the KDC's response (AS-REP payload), and take the encrypted data offline. They can then perform brute-force or dictionary attacks to crack the password hash without triggering account lockout policies or generating logon failure logs. By enforcing pre-authentication, the KDC requires the client to encrypt a timestamp using their password hash before issuing the TGT. This proves the client possesses the password, preventing attackers from retrieving the encrypted AS-REP token for offline cracking. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Schema Admins group is one of the most critical security groups within an Active Directory forest. This group controls the underlying structure of the directory database, defining every class of object and every attribute that those objects can possess. A compromised Schema Admin account poses a massive risk to the forest: 1. **Schema Modifications**: Attackers can modify class definitions, introduce rogue attributes, or insert persistent directory-level backdoors that survive standard OS-level remediation. 2. **Low Operational Frequency**: Schema modifications are extremely rare, typically occurring only during major enterprise software installations (such as Exchange, SCCM) or AD functional level upgrades. To minimize the attack surface, standard administrative accounts must not have permanent membership in the Schema Admins group. Instead, membership must be granted strictly on a Just-In-Time (JIT) basis and revoked immediately after schema changes are completed. Locking the group membership to empty using a Restricted Groups GPO ensures that any unauthorized or accidental additions are automatically cleared. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Organizational Units (OUs) act as the logical containers for structuring users, groups, and computers in Active Directory, and are the targets for linking Group Policy Objects (GPOs). Enforcing the accidental deletion protection property provides the following security and availability benefits: 1. **Administrative Safeguard**: Drag-and-drop mistakes or batch scripting errors can lead to the deletion of an entire OU hierarchy, causing severe outages and loss of access controls. This feature places a "Deny" Access Control Entry (ACE) for the "Everyone" group on the "Delete" and "Delete Subtree" permissions of the object. 2. **Operational Continuity**: While it does not prevent a malicious administrator from intentionally disabling the setting and deleting the OU, it forces a deliberate, two-step verification process before any destructive actions can be performed. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Standard Active Directory access control models rely on Discretionary Access Control Lists (DACLs) and security group memberships. While DACLs determine which directory objects or network shares an administrative account can modify, they do not restrict the physical or virtual systems from which that administrator can log on. In an active enterprise network, if a Tier 0 administrator (such as a Domain Admin or Enterprise Admin) authenticates from or logs on to a compromised Tier 1 server (e.g., an application host) or a Tier 2 workstation (e.g., a standard user workstation), their authentication material is loaded into the memory of the Local Security Authority Subsystem Service (LSASS). Attackers with local administrative control over that lower-tier system can scrape LSASS memory using credential-harvesting tools (such as Mimikatz) to extract Kerberos Ticket Granting Tickets (TGTs), NTLM password hashes, or plaintext credentials, resulting in total forest compromise via lateral movement and privilege escalation (Pass-the-Hash, Pass-the-Ticket). Authentication Policies and Authentication Policy Silos (introduced in Windows Server 2012 R2) provide cryptographic containment enforced directly at the Key Distribution Center (KDC) on Domain Controllers: 1. **Cryptographic Boundary Enforcement at KDC**: Unlike host-level software restrictions or traditional group memberships, Authentication Silos are evaluated by the KDC during the Kerberos ticket acquisition phase (AS-REQ and TGS-REQ). When an account assigned to an Authentication Policy Silo requests a Kerberos ticket, the KDC inspects the client host's device claims (`@Device.ad:silo`). If the host is not enrolled in the same silo, the KDC unconditionally rejects ticket issuance with the Kerberos status code `KDC_ERR_POLICY` (`0x12`). Because ticket issuance is denied at the domain controller level, administrative credentials are never exposed, transmitted, or cached on unauthorized workstations. 2. **Dynamic Access Control (DAC) & Compound Authentication**: Authentication Silos leverage Dynamic Access Control (DAC) device claims. When accounts are enrolled in a silo, Active Directory automatically issues the `@Device.ad:silo` claim during Kerberos authentication. Enabled by Kerberos Flexible Authentication Secure Tunneling (FAST / RFC 6113), the KDC evaluates compound authentication, validating both the user identity and the computer identity simultaneously against conditional Security Descriptor Definition Language (SDDL) rules such as `O:SYG:SYD:(XA;;CR;;;WD;(@Device.ad:silo == "T0_Silo"))`. 3. **Restricted Kerberos TGT Lifetimes**: Authentication Policies enforce reduced Kerberos Ticket Granting Ticket (TGT) lifetimes (e.g., 120 minutes / 2 hours) specifically on high-privilege silo accounts, without impacting standard domain users whose default TGT lifetime remains 10 hours. This significantly constrains the window of opportunity for ticket reuse attacks or stolen session ticket exploitation. 4. **Defense-in-Depth Architectural Triad**: Authentication Silos form an inseparable architectural defense triad with the **Protected Users** security group (REQ-ID-005), **Kerberos Armoring (FAST)** (REQ-DC-013, REQ-PAW-013, REQ-END-013), and **Privileged Access Workstations** (PAWs). Together, these controls prevent credential dumping, halt NTLM fallback, and enforce strict Tier 0 cryptographic isolation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In Active Directory, when an account is added to a protected group (such as `Domain Admins`, `Schema Admins`, or `Account Operators`), a forest-wide background thread (the `AdminSDHolder` task, running on the Domain Controller holding the PDC Emulator role) automatically sets the account's `adminCount` attribute to `1` and disables security descriptor inheritance. This is done to ensure the account only inherits permissions defined by the secure `adminSDHolder` template rather than any insecure permissions on the parent Organizational Unit (OU). A common myth is that Active Directory uses the `adminCount` attribute to determine which accounts are protected. In reality, the `AdminSDHolder` background task evaluates group membership (direct or nested association with a protected group) to trigger protection, not `adminCount`. The `adminCount=1` attribute is merely a metadata flag stamped by the task. However, if that user is later removed from the protected group: 1. **adminCount Remains Active**: Active Directory does not automatically reset the `adminCount` attribute to `0` or empty, nor does it re-enable security descriptor inheritance on the user object. Although the `AdminSDHolder` task stops protecting the object (it no longer overwrites its DACL), inheritance remains permanently disabled. 2. **Leaves Account Insecurely Unmanaged**: The user object remains orphaned, with inheritance permanently disabled. This blocks future legitimate GPO-based permission updates and can allow persistent, hidden permissions (backdoors) on the object to remain unmitigated. 3. **Breaks Management Consistency**: Security administrators auditing protected accounts will see false positives, as accounts appear to have administrative attributes when they do not have administrative group memberships. Auditing and resetting these orphan accounts restores proper security inheritance and cleans up directory metadata. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Group Managed Service Accounts (gMSAs) offer secure, automated password management (complex 120-character passwords rotated every 30 days) for services running on domain member systems. The passwords for these accounts are generated by the Key Distribution Service (KDS) running on Domain Controllers. However, the password generation algorithm relies on KDS root keys stored in the AD Configuration partition. If an attacker compromises or steals the Active Directory database (e.g., via NTDS.dit exfiltration), they obtain the active KDS root keys. Using these keys, the attacker can recalculate the passwords for any gMSA at any time, establishing an invisible, persistent backdoor to any service running under a gMSA. Therefore: 1. **Interrupts Attacker Persistence**: Generating a new KDS root key and forcing all gMSA accounts to rotate their passwords invalidates any previously compromised password generation seeds. 2. **Harden Service Isolation**: Ensures that service account security boundaries remain intact post-remediation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory Certificate Services (ADCS) is a built-in Public Key Infrastructure (PKI) solution widely used for issuing certificates for computer and user authentication. However, misconfigured certificate templates, weak mapping policies, and unhardened CA web endpoints present severe privilege escalation vectors (collectively referred to as ESC1 through ESC17). Key vulnerabilities include: 1. **ESC1 (Enrollee Supplies Subject / SAN Exploitation)**: If a certificate template allows the client requesting the certificate to supply the subject name (Subject Alternative Name - SAN) in the enrollment request, and that template allows client authentication, any unprivileged domain user can request a certificate in the name of a Domain Administrator or Domain Controller. Upon receiving the certificate, the attacker can authenticate as that administrator, resulting in instant forest compromise. 2. **ESC4 (Template ACL Misconfiguration)**: If unprivileged or Tier 1 identities possess write permissions (`GenericAll`, `GenericWrite`, or `WriteDacl`) over a certificate template object in the Active Directory Configuration partition, an attacker can modify the template parameters to enable SAN specification and client authentication (converting it to ESC1), enroll for an administrative certificate, and then restore the original configuration. 3. **ESC8 (IIS Web Enrollment NTLM Relay)**: The default ADCS HTTP Web Enrollment pages (`/certsrv`) do not enforce HTTPS and support NTLM authentication without protection. Attackers can coerce NTLM authentication from a Domain Controller (e.g., using RPC coercion or WebDAV) and relay that authentication to the CA web enrollment endpoint to request a DC certificate, taking over the domain. 4. **ESC9 / ESC10 (Weak Certificate Mapping & UPN Swaps)**: When weak certificate mapping is permitted (or without strong object SID binding), attackers with write permissions over an account's `userPrincipalName` or `dNSHostName` can compromise targets via certificate mapping mismatches. 5. **ESC1-CMC (KB5014754 Bypass via CMC `id-cmc-addExtensions`)**: On patched CAs where PKINIT binds certificates using the `szOID_NTDS_CA_SECURITY_EXT` extension, attackers may attempt to embed arbitrary object SIDs into certificate requests via CMC request extensions. Enforcing strict issuance requirements (CA administrator approval) on sensitive authentication templates and keeping CA binaries fully updated neutralizes this bypass. Hardening ADCS templates, enforcing strong certificate binding, and securing endpoints is critical to protect the Tier 0 boundary. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Securing interactive logons and connection pathways is critical to preventing identity leaks, unauthorized physical user identification, and credential theft during remote administration: 1. **Logon Screen Reconnaissance**: Allowing the local login screen to enumerate local and domain users exposes valid usernames to physical shoulder-surfers or unauthorized operators. Disabling local user enumeration hides username lists at logon. 2. **CredSSP Vulnerabilities (CVE-2018-0886)**: The Credential Security Support Provider protocol (CredSSP) had a logical remote code execution flaw. Enforcing Encryption Oracle Remediation in updated mode blocks connections from unpatched clients and servers. 3. **Delegated Credential Extraction**: When users connect to remote hosts, delegating exportable credentials exposes their authentication materials in remote LSASS memory. Forcing the delegation of non-exportable credentials ensures authentication materials cannot be exported by administrative attackers on the remote system. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, Active Directory sets the domain-level attribute `ms-DS-MachineAccountQuota` to **10** on the domain head (`DC=domain,DC=com`) and assigns the `SeMachineAccountPrivilege` ("Add workstations to domain") User Right to the `Authenticated Users` group. This default configuration allows any standard user, compromised domain identity, or unprivileged service account to introduce up to 10 computer objects into the directory. Active Directory governs computer creation through two distinct mechanisms: 1. **The `ms-DS-MachineAccountQuota` Domain Attribute**: Enforced during direct LDAP/LDAPS operations. Even if local or GPO user rights are restricted, an attacker communicating over LDAP can create computer objects as long as `ms-DS-MachineAccountQuota` is greater than zero. 2. **The `SeMachineAccountPrivilege` User Right Assignment**: Evaluated by the Security Account Manager (SAMR) and NetJoinDomain RPC interfaces when workstations join via standard Windows APIs. Allowing unprivileged users to create machine accounts introduces critical security risks across multiple Active Directory subsystems: 1. **Privilege Escalation via Resource-Based Constrained Delegation (RBCD)**: * **The SPN Prerequisite**: Exploiting Resource-Based Constrained Delegation requires an account configured with a Service Principal Name (SPN). Standard user accounts cannot register an SPN without elevated administrative permissions (the `servicePrincipalName` attribute write is restricted). In contrast, computer accounts automatically receive default SPNs (e.g., `HOST/<computername>`, `RestrictedKrbHost/<computername>`) upon creation, and the creating user is designated as the object's creator/owner (`mS-DS-CreatorSID`), retaining full DACL control. * **Coercion and Relaying Vector**: When an attacker coerces authentication from an unconstrained or privileged server (e.g., via PetitPotam, PrinterBug/SpoolSample, DFSCoerce, or ShadowCoerce) and relays that NTLM authentication to LDAP/LDAPS, or when an attacker has write permissions over a target computer's `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute, they configure the victim system to trust the newly created rogue machine account. * **Kerberos S4U Abuse**: Using the credentials of the rogue computer account, the attacker executes Kerberos S4U2self (Service-for-User-to-Self) and S4U2proxy protocol extensions to obtain a valid Kerberos service ticket impersonating ANY domain user (including a Domain Admin or Enterprise Admin) to services (CIFS, HTTP, LDAP, WSMAN) on the target host, achieving full host or domain takeover. 2. **Active Directory Certificate Services (ADCS) Exploitation**: * **Template Enrollment**: Many enterprise ADCS certificate templates grant enrollment permissions to `Domain Computers` (such as default "Machine" or "Computer" templates, or custom enrollment templates). * **Domain Takeover**: If vulnerable certificate templates are present in the environment—such as ESC1 (templates allowing the enrollee to specify a Subject Alternative Name / `ENROLLEE_SUPPLIES_SUBJECT`), ESC2/ESC3 (enrollment agent misuse), ESC6 (`EDITF_ATTRIBUTESUBJECTALTNAME2` enabled on the CA), or ESC13 (certificate templates linked to issuing policies)—an attacker with a rogue computer account can enroll for a machine certificate, supply the SAN of a Domain Controller or privileged administrative account, and immediately escalate to Domain Admin. * **Credential Relaying**: A rogue machine account also supplies the computer identity required to participate in ESC8 attacks (relaying coerced machine NTLM authentication to ADCS HTTP Web Enrollment or CES endpoints). 3. **Local Privilege Escalation via Local Kerberos Relaying (KrbRelay / KrbRelayUp)**: * On domain-joined Windows endpoints and servers, attack chains such as KrbRelayUp allow local non-administrative users to elevate directly to `NT AUTHORITY\SYSTEM`. * The exploit leverages `ms-DS-MachineAccountQuota` to dynamically provision a computer account in Active Directory, configures RBCD against the local machine, triggers a local RPC connection to coerce machine Kerberos authentication, and relays the ticket locally to execute arbitrary code as SYSTEM. 4. **Active Directory Integrated DNS (ADIDNS) Poisoning & WPAD Hijacking**: * By default, Active Directory-integrated DNS zones allow authenticated machine accounts to register and dynamically update host (`A`) and reverse (`PTR`) DNS records. * Attackers can leverage rogue computer accounts to poison DNS zones, hijack hostnames of anticipated servers, or register `wpad` (Web Proxy Auto-Discovery) records. This allows the attacker to intercept corporate web traffic, harvest NetNTLM credentials, or conduct adversary-in-the-middle (AitM) attacks. 5. **Network Access Control (NAC) & 802.1X Perimeter Bypass**: * Many corporate 802.1X wired and wireless network architectures authenticate connecting devices via machine credentials (e.g., PEAP-MSCHAPv2) or machine certificates linked to domain computer accounts. * An attacker connected to an untrusted switch port, guest network, or rogue access point can create a machine account, complete 802.1X machine authentication, and gain unrestricted network placement into internal corporate workstation or server VLANs. 6. **Shadow Credentials (`msDS-KeyCredentialLink`) & Evasive Persistence**: * Because the creator possesses owner permissions on the newly created machine account, an attacker can write to the `msDS-KeyCredentialLink` attribute to configure public-key credentials (PKINIT). The attacker can then request Kerberos TGTs at will, maintaining persistent directory access without ever modifying the machine's password or triggering password rotation alarms. * Machine accounts automatically join the `Domain Computers` global group, granting them persistent ambient access to read Active Directory LDAP partitions, SYSVOL and Netlogon shares, Group Policy Objects, and any internal resources open to domain members. 7. **Historical Precedent: sAMAccountName Spoofing (noPac / CVE-2021-42278 & CVE-2021-42287)**: * The noPac exploit demonstrated how unprivileged computer creation is weaponized: attackers created a computer account, stripped the trailing `$`, obtained a TGT, renamed the account to match a Domain Controller, and requested a service ticket via S4U2self to impersonate the DC. While specific CVEs are patched, setting `ms-DS-MachineAccountQuota` to 0 eliminates the fundamental entry point for any future exploit chain that relies on creating arbitrary machine objects. Restricting this behavior by setting `ms-DS-MachineAccountQuota` to **0** and removing `Authenticated Users` from the `SeMachineAccountPrivilege` ("Add workstations to domain") user right ensures that only authorized administrators and dedicated provisioning systems can introduce computer objects into the directory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The "Pre-Windows 2000 Compatible Access" group (SID: `S-1-5-32-554`) is a legacy Active Directory security group designed to provide backward compatibility for NT4-era operating systems. By default, this group has broad read permissions to all user and group object attributes within the domain. Historically, groups like "Everyone" (`S-1-1-0`), "Anonymous Logon" (`S-1-5-7`), or "Authenticated Users" (`S-1-5-11`) were added to this group to maintain compatibility. The security risks include: 1. **Information Enumeration**: Any authenticated user (or an unauthenticated attacker via anonymous/everyone permissions) can query the Active Directory database to enumerate user lists, group memberships, trust details, and account metadata. 2. **Reconnaissance Surface**: Attackers use null-sessions or low-privileged domain accounts to profile the entire AD infrastructure, mapping target groups (like Domain Admins) and identifying service accounts for targeted attacks like Kerberoasting. 3. **Implicit Trust Abuse**: Relying on legacy broad-read access bypasses modern Active Directory object-level Access Control List (ACL) restrictions. Removing insecure principals from this group and enforcing anonymous access restrictions restricts AD object access to authenticated, authorized accounts only. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing smart card authentication on privileged accounts significantly mitigates the risk of credential theft, lateral movement, and offline password cracking: 1. **Hash and Password Extraction Prevention**: By checking "Smart card is required for interactive logon" on an Active Directory user account, AD automatically rotates the account's password to a cryptographically strong, random 120-character string that is unknown to the user. This effectively invalidates the traditional NTHash and LMHash authentication methods, preventing attackers from performing password-spraying or brute-force attacks against administrative logins. 2. **Replay and Relay Mitigation**: Password-based authentication relies on credentials that can be captured, logged, or relay-attacked. Using smart cards (or physical tokens like YubiKeys) shifts authentication to Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). This protocol relies on private keys stored in the card's secure hardware element, ensuring credentials cannot be copied or replayed. 3. **Physical Presence Factor**: Combining a hardware token (something you have) and a PIN (something you know) establishes true multi-factor authentication (MFA) for administrative activities, preventing unauthorized access by remote network attackers who have compromised a password. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Historically, administrators utilized Group Policy Preferences (GPP) to automate account creation, service configurations, drive mappings, and local administrator password rotations. When credentials were saved within a GPP, the password was stored as an encrypted string under the `cpassword` attribute in XML configuration files (e.g., `Groups.xml`, `Services.xml`, `ScheduledTasks.xml`) inside the domain-wide `SYSVOL` share. Although Microsoft encrypted the password with AES-256, the static AES decryption key was published on MSDN. Because any authenticated user (or trust) has read access to the `SYSVOL` share, any domain user can read the preference XML files, extract the `cpassword` value, and decrypt it to obtain cleartext credentials. Microsoft patched this vulnerability in May 2014 via **MS14-025 (KB2962486)**, which blocks the Group Policy Management Console (GPMC) from creating or updating policies that contain password fields. However, **the patch does not delete existing GPP XML files with passwords from SYSVOL**. Consequently, legacy preferences with encrypted credentials remain in the `SYSVOL` directory and continue to be a primary target for adversary credential harvesting. Additionally, administrators historically deployed custom login or management scripts (e.g., `.vbs`, `.bat`, `.cmd`, `.ps1`) in `SYSVOL` with cleartext passwords hardcoded. These must also be identified and purged. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Standard Windows security event logging is basic and fails to capture critical event vectors, leading to visibility gaps during compromises. Enforcing refined subcategory audit policies ensures detailed Success and Failure logs for logon attempts, privilege use, process creations, and registry modifications without overloading log stores. This requirement acts as the primary logging baseline, enforcing category overrides and linking to profile-specific submodules matching each system's security tier. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Adversaries make extensive use of built-in system tools (LOLBins) and PowerShell script execution to perform reconnaissance, privilege escalation, and lateral movement. Because PowerShell code can be dynamically obfuscated or executed directly in memory without writing to disk, traditional file-based detection mechanisms are easily bypassed. Enforcing advanced execution logging mitigates these threat vectors: 1. **Command Line Auditing**: Injecting command-line arguments into Security Event ID 4688 allows defenders to see parameters, file paths, and encoded arguments used during process execution. 2. **Script Block Logging**: Captures the full content of code blocks executed by PowerShell (Event ID 4104), logging the actual code after decryption and de-obfuscation at runtime. 3. **Module Logging**: Logs pipeline execution details and loaded modules (Event ID 4103) to map tool usage. 4. **Hardened Transcription**: Records all input commands and console outputs to local text transcripts. By restricting folder access permissions, users are blocked from reading previously typed commands (which may contain sensitive arguments, tokens, or credentials), while still allowing the system to log their actions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Security event logs lack detailed telemetry on low-level operating system actions, such as process memory reads (e.g., LSASS dumping via Mimikatz), thread injection, network connections associated with process IDs, and driver loading. Microsoft Sysmon (System Monitor) bridges this gap by writing rich system monitoring telemetry to the `Microsoft-Windows-Sysmon/Operational` event log channel. Because Sysmon is a critical detection source, adversaries actively target it by attempting to unload its filter driver (`sysmon -u` or `fltmc unload SysmonDrv`) or stopping/disabling the Sysmon service (`sc stop Sysmon`). Hardening Sysmon involves: 1. **Service Recovery Configuration**: Forcing the operating system to automatically restart the Sysmon service on failure or termination. 2. **Telemetry Filtering**: Deploying a hardened, security-focused XML configuration template that filters out noise while logging process creation (Event ID 1), remote threads (Event ID 8), LSASS memory access (Event ID 10), and suspicious file drops (Event ID 11). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In high-security, isolated environments, local log storage is vulnerable to tampering. Attackers who obtain elevated privileges will attempt to clear or modify the Security Event Logs (e.g., via `wevtutil cl Security`) to destroy evidence of their activities. Shipping event logs in real-time to a dedicated offline SIEM (such as an ELK Stack or Wazuh Manager) ensures that forensic logs are preserved. To prevent adversaries from intercepting, redirecting, or tampering with log telemetry, log shippers must be hardened: 1. **Secure Transportation (TLS)**: Enforce TLS 1.2 or TLS 1.3 encryption with strict verification of the server certificate authority. This prevents man-in-the-middle attacks where an adversary redirects logs to a rogue listener. 2. **Buffer and Queue Management**: Limit memory and disk spool queues for the shipping agents. If the SIEM receiver goes offline during maintenance or network failure, the agents must cache logs safely without causing memory leaks, high CPU overhead, or local disk exhaustion. 3. **Hardened Configuration Files**: Agent configurations contain hostnames, ports, and potentially credentials or internal CA paths. Restricting access to these configuration files prevents standard users from discovering SIEM endpoints or tampering with configuration parameters. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kerberoasting allows an authenticated user to request a Kerberos service ticket (TGS) for any service account mapped to a Service Principal Name (SPN). Because the ticket is encrypted using the service account's password hash, the attacker can extract the encrypted ticket from memory and attempt to crack the password offline using brute-force dictionaries or GPU arrays. To mitigate and detect this vector, two strategies must be implemented: 1. **Service Account Honeypots (Decoy Accounts)**: By creating a fake Active Directory user account and registering a decoy SPN on it, security teams establish a high-fidelity trap. Since this decoy account is not tied to any legitimate application or service, no standard user or system has any reason to request a Kerberos ticket for it. - Set the `adminCount` attribute to `1` so the account appears in attacker search queries searching for high-privilege targets (e.g., Domain Admins). - Any ticket request (Event ID 4769) for the decoy SPN is a definitive indicator of a Kerberoasting attempt, providing a zero-false-positive alert with the attacker's client IP. 2. **SIEM Filtering and Correlation**: Standard Event ID 4769 logging generates millions of events daily. Filtering this telemetry down to anomalous behavior is necessary to catch broad Kerberoasting scans: - **Ticket Encryption Type**: Focus on encryption type `0x17` (RC4-HMAC-MD5) or legacy DES (`0x1`, `0x2`, `0x3`) as modern Windows environments negotiate AES (`0x11` or `0x12`) by default. - **Account Exclusions**: Filter out usernames ending with `$` (which represent computer accounts, trusts, or managed service accounts that feature automatically rotated, high-entropy passwords). - **Anomalous Patterns**: Trigger alerts when a single user account requests RC4 or DES tickets for multiple distinct SPNs within a short timeframe (e.g., less than 5 seconds). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Adversaries seeking to elevate privileges within an Active Directory domain frequently scan the `SYSVOL` share for files containing legacy Group Policy Preference (GPP) credentials (specifically searching for the `cpassword` attribute in XML files) or startup/login scripts. This discovery scanning is often automated using script search commands (e.g., `findstr /S cpassword`) or administrative diagnostic frameworks (such as PowerSploit or BloodHound). To detect these unauthorized discovery scans, security teams can deploy a **SYSVOL Decoy XML Honeypot**. This decoy consists of a mock Group Policy folder structure containing a dummy GPP `Groups.xml` file with fake credential properties. Because this mock policy is not linked to any active Active Directory object, no legitimate system or user account has any reason to query or read this file. By applying an explicit **NTFS Deny Read** rule to the `Everyone` group on the decoy file, any attempt by an attacker to scan or read it will immediately fail and generate a high-fidelity **Access Denied** event. By configuring file failure auditing on the decoy path, Windows generates **Event ID 4656** or **4663** in the Domain Controller's Security Log. These events capture the attacker's account details and client IP address, providing a low-noise, high-fidelity alert. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory services require several ports to function, including DNS, Kerberos, LDAP, SMB, and RPC. If firewalls are not configured to restrict traffic to only these essential ports, adversaries can perform internal network scanning, identify open services, exploit vulnerabilities in unhardened services, or pivot across systems. Restricting network communications to the minimum required AD Port Matrix ensures: 1. **Attack Surface Reduction**: Unused services are blocked from receiving network connections. 2. **Reconnaissance Mitigation**: Internal port scanning returns blocked states, slowing down discovery. 3. **Lateral Movement Containment**: Compromised endpoints cannot arbitrary query services on domain controllers or other member systems. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, the RPC runtime utilizes a massive dynamic range of high-order ports (TCP 49152-65535) for communication, including Active Directory replication, netlogon authentication, and DFS replication. Opening this entire dynamic port range in network-based firewalls for all systems exposes an unmonitored attack surface. To mitigate this risk, key domain controller services (NTDS, Netlogon, and DFSR) must be bound to dedicated static ports (TCP 38901, 38902, and 5722 respectively). This allows network administrators to configure precise firewall rules permitting only these ports. Crucially, **the system-wide dynamic RPC range must NOT be narrowed** (such as restricting it globally to 50000-50100). Restricting the global dynamic range introduces severe risks: 1. **Port Exhaustion**: Under standard server load, limiting the global ephemeral range to a small number of ports can exhaust available sockets, resulting in network failures and domain isolation outages. 2. **Replication Failure**: High volumes of directory transactions can exhaust localized RPC ports. 3. **No Added Security Value**: Narrowing the dynamic range globally does not mitigate standard exploits, and endpoints communicate with local security authority protocols (LSAD/SAMR) over SMB named pipes (`\PIPE\lsass`) rather than directly via dynamic TCP sockets. Therefore, the system-wide dynamic RPC port range must remain at its default start port (`49152`) and number of ports (`16384`), and any narrowing configurations must be avoided. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Once an adversary establishes initial access on a Tier 2 client workstation or a Member Server, they will attempt to move laterally across the network to identify high-value targets, harvest credentials, and locate Tier 0 administrative pathways. Lateral movement commonly relies on standard management and remote connection protocols, including SMB (TCP 445), RPC (TCP 135 and dynamic ports), RDP (TCP 3389), and WinRM (TCP 5985/5986). In a standard enterprise design, workstations do not require inbound connections from other workstations, and member servers rarely require inbound connections from peer member servers in the same tier. Configuring local firewalls via Group Policy to explicitly block inbound SMB, RPC, RDP, and WinRM traffic originating from peer subnets (while maintaining administrative exceptions from authorized management subnets and Domain Controllers) stops host-to-host lateral propagation and containment is maintained. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In environments without hardware-enforced line-encryption, an attacker who gains physical or logical access to internal network switches can perform Man-in-the-Middle (MitM) attacks (e.g., ARP spoofing, DHCP spoofing) or passive packet sniffing. Implementing IPsec Transport Mode using Connection Security Rules ensures that domain-joined hosts cryptographically authenticate each other before transmitting payloads. Benefits of IPsec isolation include: 1. **Host Authentication**: Ensures only trusted, domain-joined systems communicating via Kerberos V5 or certificates can exchange packets with critical servers. 2. **Data Integrity & Confidentiality**: Prevents packet tampering and sniffing on the wire. For DC-to-DC replication, mandating ESP encryption secures highly sensitive directory updates. 3. **Mitigation of Relay Attacks**: Even if credentials are intercepted, they cannot be easily replayed to services protected by IPsec isolation rules. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Internet Protocol Security (IPsec) is the foundational cryptographic framework that underpins domain isolation (**[REQ-NET-004]**) and line-encryption across Active Directory networks. However, default IPsec settings in legacy Windows environments permit outdated cryptographic primitives, including 3DES, DES, MD5, SHA-1, and Diffie-Hellman Groups 1, 2, and 5. These algorithms are mathematically broken or provide insufficient security margins against modern adversaries. Hardening IPsec cryptographic parameters mitigates multiple specific threat vectors: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Legacy versions of SSL (2.0 and 3.0) and TLS (1.0 and 1.1) are cryptographically weak and vulnerable to various attacks (such as BEAST, POODLE, and SWEET32) that can lead to credential exposure and session hijacking. Domain services, including LDAPS and WinRM, must enforce the usage of TLS 1.2 and TLS 1.3 (where supported) to prevent protocol downgrade attacks. In addition to disabling insecure protocol versions, the TLS cipher suites and Elliptic Curves must be restricted to modern, collision-resistant options. CBC (Cipher Block Chaining) mode and RC4 ciphers are prone to padding oracle attacks. Restricting configurations to AES-GCM (Galois/Counter Mode) authenticated encryption suites combined with strong Elliptic Curve Diffie-Hellman (ECDHE) curves (such as Curve25519 and NIST P-384) guarantees confidentiality, integrity, and perfect forward secrecy (PFS). By default, legacy .NET Framework applications (targeting .NET 3.5 or earlier) and WinHTTP-based APIs do not enforce TLS 1.2 or TLS 1.3, potentially defaulting to weak protocols like SSL 3.0 or TLS 1.0. Enabling `SchUseStrongCrypto` and `SystemDefaultTlsVersions` forces .NET to use the system default secure TLS versions. Restricting `DefaultSecureProtocols` forces WinHTTP clients to use TLS 1.2. Disabling the strong-name bypass (`AllowStrongNameBypass` = `0`) prevents full-trust assemblies from skipping signature validation, protecting the .NET runtime from loading tampered assemblies. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Server Message Block (SMB) version 1.0 (SMBv1) is obsolete, highly insecure, and vulnerable to critical exploits (such as MS17-010 / EternalBlue, which enabled the global spread of WannaCry and NotPetya). SMBv2, while newer, lacks modern cryptographic protection and is prone to Man-in-the-Middle (MitM) interception and NTLM relaying. Enforcing SMBv3 (minimum version 3.0.0 or 3.1.1) provides significant security advantages: 1. **AES-GCM Encryption**: Protects data in transit from passive sniffing and tampering. Enforcing encryption is critical on Domain Controllers (specifically for Sysvol and Netlogon shares) and servers hosting sensitive business files. 2. **Pre-Authentication Integrity**: Prevents tampering with SMB negotiation packets (mitigating downgrade attacks). 3. **SMB Signing**: Adds a cryptographic signature to all packets. Mandating SMB signing (specifically `Digitally sign communications (always)`) protects against SMB Relay attacks, where an attacker intercepts a NTLM authentication hash on the local network and replays it to a target server to gain unauthorized access. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Defender Firewall with Advanced Security (WFAS) serves as the host-level stateful firewall protecting Active Directory resources from unauthorized network access. However, without correct logging and behavioral configuration, the firewall does not provide adequate defensive or diagnostic value: 1. **Visibility Gaps**: By default, Windows Defender Firewall does not log dropped packets. If logging is disabled, security administrators cannot detect failed connection attempts, reconnaissance scans (port scanning), or unauthorized network communications. 2. **Log Rotational Coverage**: The default firewall log size limit of 4096 KB (4 MB) is insufficient for enterprise environments. High volumes of traffic or network scanning will cause the log to roll over rapidly, destroying valuable historical entries needed for security audits and incident investigation. 3. **Deterministic Administrative Control**: Allowing local administrators to create local rules or local connection security rules (IPsec) on critical Tier 0 systems, such as Domain Controllers, risks bypassing centrally defined domain firewall GPOs. Restricting rule merging ensures a uniform security baseline. 4. **Behavioral Notification Control**: Disabling interactive firewall notifications prevents desktop alerts from prompting administrative users, reducing operational noise and social engineering opportunities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory clients and servers routinely query Domain Controllers to retrieve Group Policy Objects (GPOs), startup/shutdown scripts, and user logon scripts from the `SYSVOL` and `NETLOGON` shares. By default, these connections are made over standard UNC paths and do not strictly enforce integrity validation (SMB signing) or mutual authentication. Enforcing these channel-level controls mitigates the following threat vectors: 1. **GPO Spoofing and Execution Tampering**: An attacker positioned on the local network using man-in-the-middle (MitM) techniques (such as ARP spoofing or DNS poisoning) can intercept GPO retrieval traffic. Without Hardened UNC Paths, the attacker can spoof the Domain Controller and inject a malicious GPO or a modified script, which then executes with local SYSTEM privileges on the client host. Enforcing integrity and mutual authentication on `SYSVOL` and `NETLOGON` blocks this spoofing vector. 2. **Insecure Guest Logons**: Disabling insecure guest logons stops the workstation or server from automatically authenticating to untrusted remote SMB shares using guest credentials. This prevents attackers from setting up rogue SMB servers that trick hosts into leaking NetNTLM credentials or executing untrusted files. 3. **LDAP Session Hijacking**: Forcing outgoing LDAP client connections to negotiate signing protects directory queries made by Member Servers or Domain Controllers (acting as clients) from interception, packet tampering, or sniffing. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Remote Management (WinRM) and Remote Procedure Call (RPC) are standard management interfaces in Windows environments. However, by default, these interfaces allow backward-compatible configurations that pose significant security risks. Hardening these service channels blocks the following exploit vectors: 1. **Plaintext Credential Harvesting**: Allowing Basic authentication on WinRM clients and services allows transmission of administrative passwords in plaintext (or easily decodable formats) if secure channels are not established. Disabling Basic and Digest authentication forces the use of Kerberos or certificate-based authentication. 2. **Replay and Eavesdropping**: WinRM allows unencrypted traffic by default, which exposes administrative payloads and remote command execution streams to sniffing and hijacking. Forcing encryption protects the confidentiality and integrity of remote management sessions. 3. **RunAs Credential Exposure**: If WinRM is allowed to cache or store RunAs credentials for remote task execution, those credentials reside in the host's memory, where an administrative attacker can harvest them using memory extraction tools. 4. **Anonymous RPC Enumeration**: Restricting unauthenticated RPC clients prevents anonymous attackers from performing remote enumeration of active services, RPC interfaces, and registry endpoints, limiting remote reconnaissance capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Management Instrumentation (WMI) is a core Windows administration framework built upon the Distributed Component Object Model (DCOM) and Remote Procedure Call (RPC) protocols. By default, WMI runs inside a shared service host process (`svchost.exe -k netsvcs`) and dynamically allocates ephemeral high-order TCP ports (range `49152-65535`) for remote client connections. Leaving WMI in its default configuration presents four critical security risks: 1. **The Dynamic RPC Port Dilemma & Attack Surface Exposure**: Because remote WMI clients dynamically negotiate communication ports via the RPC Endpoint Mapper (RPCSS on TCP port 135), network administrators who allow remote WMI must either open the entire ephemeral dynamic port range (`49152-65535`) on network firewalls or disable host firewalls entirely. Opening thousands of dynamic ports circumvents perimeter filtering and exposes every local service listening on high-order sockets to unauthorized network traversal. Pinning WMI to a dedicated static port (TCP `24158`) allows network and host firewalls to block the broad dynamic range and enforce strict microsegmentation. 2. **Lateral Movement and Living-off-the-Land Exploitation (MITRE ATT&CK T1047)**: Adversaries frequently leverage WMI to orchestrate stealthy lateral movement, execute remote code, query system configuration, and deploy backdoors without triggering interactive logon events (Event ID 4624 Type 3 network logons). Widely abused post-exploitation toolkits (such as Impacket's `wmiexec.py`, SharpWMI, and PowerShell CIM cmdlets) abuse DCOM interfaces to spawn malicious processes under `WmiPrvSE.exe` (e.g., `Win32_Process.Create`). Restricting WMI to static port 24158 and strictly scoping firewall access to authorized PAW subnets eliminates unmonitored cross-subnet living-off-the-land attacks. 3. **Wire Eavesdropping and Session Tampering Mitigation (CVE-2021-26414)**: Remote DCOM communications that operate below authentication level 6 (`RPC_C_AUTHN_LEVEL_PKT_PRIVACY`) do not encrypt payload data. Attackers positioned on the network path could intercept sensitive administrative data returned in WMI queries (such as system configurations, installed software inventories, environment variables, or process lists) or tamper with in-flight RPC commands. Enforcing `AuthenticationLevel = 6` mandates packet-level Kerberos or NTLM encryption across all WMI communications, fully satisfying Microsoft DCOM security hardening requirements (KB5004442). 4. **Process Isolation and Memory Containment**: By default, the `winmgmt` service shares a single `svchost.exe` process instance with multiple other system services (such as IP Helper, Background Intelligent Transfer Service, and Windows Update). Moving WMI into a standalone host process (`SERVICE_WIN32_OWN_PROCESS`, `Type = 16`) isolates its heap, thread pools, security tokens, and memory space. If an adjacent service running in a shared host process is compromised, process isolation prevents direct in-memory manipulation, token stealing, or tampering with directory management capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory domains heavily rely on the Server Message Block (SMB) protocol (TCP 445) for distributing group policies and replication via the SYSVOL and NETLOGON file shares. Because every joined domain member requires access to these shares, TCP port 445 cannot simply be blocked at the network perimeter or host firewall level on Domain Controllers. However, adversaries and post-exploitation frameworks (such as Impacket PsExec, SMBExec, AExec, Coercer, PetitPotam, and Mimikatz) routinely abuse this open SMB surface. Windows Remote Procedure Call (RPC) supports two primary transport protocols: 1. **RPC over TCP/IP (`ncacn_ip_tcp`)**: Binds each service dynamically (or to configured static ports) across ephemeral TCP ports (49152-65535). 2. **RPC over Named Pipes (`ncacn_np`)**: Multiplexes RPC requests directly through SMB named pipes over TCP port 445. Standard Layer 3 and Layer 4 firewall rules can only permit or block the entire TCP port 445. If TCP 445 is permitted, an attacker with network access can connect to sensitive SMB named pipes (such as `\PIPE\svcctl` or `\PIPE\atsvc`) to execute remote code or trigger authentication coercion without ever needing access to dynamic RPC ports. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Domain Controllers (DCs) represent the Tier 0 security boundary of an Active Directory forest. In a multi-DC environment, security controls must prevent lateral movement and credential escalation between these core servers. If an adversary gains administrative control of a single Domain Controller, they will immediately attempt to pivot to other DCs. By default, standard firewall configurations allow remote management protocols (RDP, WinRM, WMI) from all Tier 0 assets—including other Domain Controllers. Enforcing intra-DC remote management blocking resolves this vector: 1. **Lateral Movement Containment**: Restricting management traffic between DCs (e.g. blocking RDP TCP 3389, WinRM TCP 5985/5986, WMI TCP 24158, and ADWS TCP 9389 from other DC IP addresses) prevents a compromised DC from being used to compromise other domain controllers. 2. **Replication Integrity**: Normal Active Directory replication and synchronization protocols (RPC replication, DNS, Kerberos, SMB) remain open and unaffected, while administrative logon and command execution protocols are blocked. 3. **Zero Trust Tiering**: Assumes that even Tier 0 systems must not trust other Tier 0 systems for remote command execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `krbtgt` account is a built-in local service account that serves as the Key Distribution Center (KDC) service account in Active Directory. The long-term secret cryptographic keys derived from the `krbtgt` account password are used by the KDC to sign and encrypt all Kerberos Ticket Granting Tickets (TGTs) issued within the domain, as well as to compute the Privilege Attribute Certificate (PAC) signatures that vouch for user identity, security identifiers (SIDs), and group memberships. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Active Directory (AD) Recycle Bin is an essential disaster recovery, availability, and incident response capability. In modern enterprise environments, directory availability is directly tied to core organizational operations. Accidental administrative errors, script bugs, malicious insider sabotage, and destructive cyberattacks (such as ransomware operations deploying wipers like HermeticWiper or deleting Tier 0 infrastructure to inhibit incident response) pose critical risks to Active Directory object integrity. Enabling and properly configuring the Active Directory Recycle Bin provides vital security and operational defenses: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Group Policy Objects (GPOs) rely on XML-based Administrative Template files (`.admx`) and language-specific resource files (`.adml`) to display registry-based policy settings within administrative tools. By default, the Group Policy Management Editor loads templates from the local computer's `%SystemRoot%\PolicyDefinitions` folder. In an enterprise AD environment, this behavior introduces several security and operational risks: 1. **Configuration Drift**: If different Domain Controllers or management workstations have different template versions installed, editing GPOs can result in missing configurations, corrupted settings, or inadvertent reversion of newer security settings. 2. **Missing Security Controls**: As operating systems evolve, new security controls (such as disabling legacy name resolution or enforcing LSA protection) are introduced in newer templates. Without updated templates, administrators cannot manage these settings via the GPMC GUI. Establishing the **Central Store** in the SYSVOL share ensures that all administrators edit GPOs using a single, authoritative set of administrative templates. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Group Policy Objects (GPOs) natively manage core Windows operating system components but lack administrative control definitions for third-party Commercial Off-The-Shelf (COTS) software (such as Google Chrome, Microsoft Edge, Adobe Acrobat Reader) and advanced security guide extensions. Implementing third-party and custom GPO templates provides the following benefits: 1. **Centralized Configuration**: Administrators can enforce security configurations across all enterprise workstations and member servers (e.g. disabling insecure browser protocols, locking PDF execution properties) directly from the Group Policy Management Console. 2. **Reduced Attack Surface**: Custom templates (such as [Security-ADMX GitHub Repository](https://github.com/Harvester57/Security-ADMX) or the Microsoft Security Guide template) expose hidden or advanced registry configurations, allowing administrators to restrict features like WDigest authentication or LSA credential caching that are not exposed in standard out-of-the-box Windows templates. 3. **Consistency**: Linking COTS hardening GPOs ensures that third-party applications remain compliant with corporate security baselines, preventing local user overrides. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Server Update Services (WSUS) role allows administrators to centralize the approval and distribution of security updates and patches. However, update services execute code with system privileges. If a shared, mutualized WSUS server (managed by Tier 1 or Tier 2 administrators) is used to patch Tier 0 Domain Controllers: 1. **Lateral Movement Target**: A compromise of the shared WSUS server or its database allows an attacker to inject malicious metadata, forcing Domain Controllers to execute arbitrary code or load compromised updates. 2. **Bypasses Administration Isolation**: Standard network administrators could inadvertently or maliciously deploy payloads to Tier 0 servers. 3. **HTTP Traffic Manipulation**: If WSUS communication is configured over cleartext HTTP (the default port 8530), attackers inside the network can perform man-in-the-middle attacks to inject custom update packages. To mitigate these threats, Tier 0 Domain Controllers and PAWs must pull updates from a dedicated WSUS server located inside the Tier 0 security boundary, configured exclusively with SSL/TLS encryption. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In default Active Directory deployments, newly provisioned user and computer accounts are automatically instantiated within two legacy default containers located at the root of the domain: * **Default Users Container**: `CN=Users,DC=domain,DC=com` * **Default Computers Container**: `CN=Computers,DC=domain,DC=com` From an enterprise security and systems architecture perspective, placing active operational assets in these default locations creates severe defensive gaps, policy blind spots, and lateral movement vulnerabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory environments, particularly those with administrative tiering, require strict logical organization to maintain security boundaries and prevent operational errors. The lack of standard naming conventions leads to several security and operational risks: 1. **Administrative Confusions and Misconfigurations**: Without clear identifiers, administrators might link a highly restrictive Tier 0 GPO to a Tier 2 Client Workstations OU, causing system outages or security bypasses. 2. **Audit and Monitoring Gaps**: Security monitoring tools and SIEM parsers rely on predictable account and resource patterns (such as `a0-` for Tier 0 admin actions) to flag abnormal logons or lateral movement attempts. 3. **Privilege Escalation**: Predictable naming conventions for standard accounts, combined with clear tier prefixes for administrative accounts, prevent users from mistakenly allocating administrative permissions to non-admin accounts. 4. **Configuration Drift**: Group Policy Objects without descriptions or identifiers become "orphaned" or modified by different teams without clear change tracking, leading to undocumented changes that weaken the security posture. Enforcing structured GPO, OU, and Account naming conventions, combined with a mandatory description template for GPOs, establishes self-documenting metadata that can be programmatically audited to ensure long-term directory integrity. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Disaster Recovery is a core pillar of Active Directory security. If Domain Controllers are corrupted or compromised, administrators must recover from trusted, clean states. The System State contains the Active Directory database (ntds.dit), the SYSVOL share, registry settings, certificates, and DNS records. To ensure resilience: 1. **Daily Frequency**: Create System State Backups daily on at least two Domain Controllers to minimize data loss. 2. **Storage Isolation (Offline/Immutable)**: Backups must be stored on separate physical or virtual storage. In high-security systems, enforce write-once-read-many (WORM) storage or store backups in an offline, physically secured media rotation to prevent modifications by compromised accounts. 3. **Regular Validation**: Run recovery exercises quarterly in an isolated network sandbox to verify that restored DCs are functional and free of replication loops. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Keeping Domain Controllers, member servers, and clients patched is critical to resolve OS and RPC vulnerabilities. In isolated, air-gapped networks, direct connection to Microsoft Update servers is impossible, requiring all patches to be imported offline. Establishing an offline WSUS sync protocol: 1. **Prevents Network exposure**: Domain Controllers and administrative hosts do not require access to external network zones. 2. **Maintains Integrity**: Allows checking update metadata and approvals in a controlled sandbox environment before propagating them to production. 3. **Automates Distribution**: Uses standard WSUS client policies to distribute approved updates locally with minimal network overhead. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Active Directory configurations naturally drift over time as a result of administrative changes, new trust relationships, and changing group policies. Administrators must actively search for misconfigurations, weak permissions, and signs of compromise. In isolated, air-gapped networks, online security analysis services cannot be reached. Therefore: 1. **Periodic Scans**: Execute security audits locally using offline-compatible tools (such as PingCastle, BloodHound/SharpHound, Locksmith, or ORADAD). 2. **Directory Health Monitoring**: Run PingCastle monthly to generate local XML/HTML reports indicating domain vulnerabilities and tracking AD configuration health. 3. **Lateral Movement Auditing**: Execute SharpHound quarterly to construct lateral movement path graphs, enabling defenders to identify complex trust relationships or delegation chains leading to Tier 0 compromise. 4. **Active Directory Certificate Services Auditing**: Run Locksmith monthly to identify misconfigured certificate templates, insecure enrollment settings, and potential AD CS privilege escalation paths. 5. **Data Isolation**: Transfer the diagnostic reports, CSV exports, and export ZIPs out of production to secure, offline assessment platforms to limit exposure of sensitive configuration data. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 During critical system failures (such as a kernel panic or Blue Screen of Death - BSOD), Windows by default displays a simplified error screen intended for general consumers, hiding the actual bugcheck code and parameters. Enabling detailed stop error parameters is crucial because: 1. **Offline Diagnostics**: In air-gapped, isolated environments, administrators cannot easily query online resources, transmit automated memory dumps, or contact cloud support. 2. **Immediate Visibility**: Having the exact stop code (e.g., `0x0000000A`) and the four parameters visible on the screen or virtual console allows operators to diagnose driver, memory, or hardware issues immediately. 3. **Improves Mean Time to Recovery (MTTR)**: Speeds up troubleshooting during disaster recovery or critical server restore processes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Inactive computer and user accounts remain in the directory due to gaps in the employee offboarding or machine decommissioning processes. These stale accounts represent a significant security risk: 1. **Backdoor Persistence**: Attackers targeting a domain can take control of inactive accounts (especially stale administrative accounts or service accounts with never-expiring passwords) to establish persistent, quiet access that is rarely monitored. 2. **Resource-Based Delegation Exploits**: Stale computer accounts can be targeted by attackers to construct resource-based constrained delegation (RBCD) attacks, allowing them to impersonate high-privilege services and eventually compromise the domain. 3. **Password Aging bypass**: Standard computers automatically change their passwords every 30 days. If a machine is powered off or disconnected, its password age increases. If computer passwords are not rotated, or if a stale computer account remains enabled, it increases the risk of offline password dumping and hash-relay. Automatically disabling and isolating user accounts after 180 days of inactivity, and computer accounts after 90 days of inactivity, minimizes the active attack surface of the directory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Install From Media (IFM) feature allows administrators to promote a new Domain Controller using an offline backup dataset rather than copying the entire Active Directory database over the network. To generate this dataset, administrators run the `ntdsutil` tool (e.g., `ntdsutil "ac i ntds" "ifm" "create full c:\Staging" q q`). This process generates a staging folder containing: 1. The Active Directory database file (`ntds.dit`). 2. Copies of the `SYSTEM` and `SECURITY` registry hives (which contain the boot key needed to decrypt the database file). If these staged IFM folders are left behind on member servers, administrative shares, or staging volumes, any user or attacker who compromises that machine can copy the files and extract all Active Directory password hashes offline. Securing active directory requires ensuring that temporary IFM datasets are deleted immediately after the new Domain Controller is promoted. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host highly sensitive Tier 0 credentials. If administrative workstations are allowed to execute arbitrary binaries, scripts, or installation packages, they become highly susceptible to malware infections, remote access trojans, and credential harvesting tools (like Mimikatz). Enforcing strict execution controls via AppLocker ensures that: 1. **Execution Control**: Only signed operating system files, approved software binaries, and scripts are allowed to execute. 2. **Standard User Restrictions**: Any standard users or unauthorized accounts cannot run executable files or installers from writeable directories (like `%TEMP%` or `%USERPROFILE%`). 3. **Defends Against AppLocker Bypasses**: Abusing trusted, signed Microsoft binaries (such as `msbuild.exe`, `installutil.exe`, `regasm.exe`, `regsvcs.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under `%WINDIR%` (such as `Tasks`, `Temp`, `tracing`, `spool\drivers\color`, etc.). 4. **Defense-in-Depth**: Even if an administrator is tricked into downloading a malicious file, AppLocker blocks the execution of the binary, preventing the compromise of the endpoint. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (LSASS) process manages security policies, user authentication, and credential tokens on Windows systems. Attackers targeting administrative workstations commonly attempt to extract plain-text credentials or NT hashes from LSASS memory using debugging tools (e.g., Mimikatz, Procdump). Enabling LSA Protection ensures that: 1. **Protected Process Light (PPL)**: The LSASS process runs as a Protected Process Light (PPL). 2. **Access Restriction**: Only verified, digitally signed code can load into LSASS, and standard processes (even those running as local system/administrator) cannot read the memory space of LSASS or inject code into it. 3. **Mitigating Dump Attacks**: Credential harvesting tools cannot dump LSASS memory to disk or scrape keys from LSA memory blocks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) represent Tier 0 administrative assets. Any user or group that has local administrative rights on a PAW can bypass operating system security boundaries, disable system protections, capture keystrokes, or extract cached credentials. Restricting local Administrators group membership ensures that: 1. **Administrative Rights Restriction**: Standard domain users and lower-tiered administrators (e.g., workstation support admins) are strictly prevented from executing code in an elevated context on the PAW. 2. **Tier Separation**: Administrative credentials from lower security tiers cannot compromise the PAW. Only dedicated Tier 0 administrators are allowed local administrative access. 3. **Authorized Control**: Membership is strictly controlled and reset periodically via Group Policy (Restricted Groups), preventing persistent privilege creep. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the secure root of trust for administering Tier 0 Active Directory resources. Because these devices are physical endpoints, they are susceptible to theft, loss, and unauthorized physical access. To achieve maximum protection, the PAW BitLocker configuration enforces a significantly more stringent baseline than standard client endpoints: 1. **TPM and Startup PIN**: Enforcing a pre-boot Startup PIN combined with TPM validation ensures that the drive cannot be unlocked or booted without explicit administrator presence. Network Unlock is prohibited on PAWs to prevent automatic decryption when connected to a local switch, ensuring physical presence verification is mandatory for every boot. 2. **Disabling Sleep/Standby States (S1-S3)**: When a system enters a standby/sleep state, the BitLocker volume decryption keys remain stored in the volatile memory (RAM). An attacker with brief physical access to a sleeping PAW can exploit Direct Memory Access (DMA) interfaces (such as Thunderbolt, FireWire, or PCIe slots) or perform a cold-boot attack to extract the decryption keys directly from the RAM. Disabling S1-S3 standby states forces the system to either shut down (S5) or hibernate (S4), writing the RAM contents back to the encrypted disk and purging the keys from volatile memory. 3. **Kernel DMA Protection**: This blocks peripheral devices (Thunderbolt, PCIe) from initiating DMA requests unless the OS is fully booted, authorized, and running driver-level Input-Output Memory Management Unit (IOMMU) protection, preventing DMA memory extraction during the pre-boot and OS load phases. 4. **Enhanced Startup PINs**: This allows administrators to use alphanumeric characters, symbols, uppercase and lowercase letters, and spaces in their pre-boot Startup PIN rather than just numbers, increasing entropy and resistance to PIN-guessing attacks. 5. **Active Directory Backup & Recovery Password Rotation**: Ensures all BitLocker recovery keys are automatically backed up to Active Directory before encryption begins. In addition, when a recovery key is used to unlock a PAW, it must be automatically rotated and updated in Active Directory to prevent the reuse of compromised recovery keys. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated administrative bastions that operate at the pinnacle of the enterprise security architecture (Tier 0). Compromise of a PAW grants adversaries the credentials necessary to commandeer identity infrastructure, cloud tenants, and enterprise directory data. If an attacker obtains physical access to a PAW, or if malicious code gains low-level administrative control, vulnerabilities in the boot chain or legacy firmware interfaces can be exploited to bypass operating system security boundaries, defeat BitLocker disk encryption, or implant persistent firmware bootkits before the Windows kernel loads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Virtualization-Based Security (VBS) and Windows Defender Credential Guard isolate sensitive security processes (like LSA) inside a hardware-virtualized container to prevent memory dumping and credential harvesting. However, these OS-level security boundaries are entirely reliant on hardware-level protections. Enabling hardware virtualization and DMA protection guarantees: 1. **Isolated Execution Environment**: Enforcing CPU Virtualization Extensions (Intel VT-x or AMD-V) in the UEFI allows the hypervisor to isolate the VBS secure kernel from the host Windows operating system. 2. **Physical DMA Protection**: Enforcing IOMMU (Intel VT-d or AMD-Vi) at the firmware level enables Kernel DMA Protection. This blocks malicious peripherals (e.g., PCIe cards or Thunderbolt devices) from executing unauthorized Direct Memory Access (DMA) attacks to read or write to host system memory, preventing attackers from extracting BitLocker keys or credential secrets directly from RAM. 3. **Hardware Root of Trust**: Activating the Trusted Platform Module (TPM) 2.0 enables cryptographic boot measurement logging (PCR banks). TPM 2.0 ensures that the system boot configuration has not been modified prior to unsealing the BitLocker volume decryption keys. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Platform Binary Table (WPBT) is an ACPI firmware table that allows hardware manufacturers (OEMs) to execute proprietary binaries in kernel space during the Windows boot phase. Windows automatically extracts the binary from the table and runs it with system privileges before security software, third-party agents, or standard driver verifications are fully initialized. While designed to facilitate automated driver provisioning and anti-theft services, this mechanism represents a significant security risk: 1. **Firmware-to-OS Attack Vector**: Malicious actors utilizing UEFI rootkits, physical firmware flashing tools, or supply-chain firmware implants can compromise the WPBT table to execute arbitrary code at boot, bypassing Secure Boot and operating system-level integrity checks. 2. **Privilege Escalation Risks**: Historically, OEM software delivered via the WPBT has introduced high-severity local privilege escalation and remote code execution vulnerabilities due to inadequate code review or poor permission management. 3. **Control and Transparency**: Executing firmware-rooted binaries without administrative visibility or operating system validation bypasses normal software lifecycle and endpoint protection policies. Disabling WPBT execution prevents Windows from parsing the ACPI table and running the embedded software, mitigating boot-level integrity bypasses. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) contain Tier 0 administrative tokens. A compromise of a PAW leads to a direct compromise of the Active Directory database (NTDS.dit) and full domain domain control. Mitigating credential dumping is the single most critical security objective for a PAW. 1. **Virtualization-Based Security (VBS)**: VBS establishes an isolated, secure kernel space using hypervisor hardware virtualization. This secure kernel is separated from the host operating system, preventing root-level exploits from accessing virtualized memory blocks. 2. **Credential Guard**: Running within the VBS secure kernel, Credential Guard stores credential secrets (NTLM hashes, Kerberos TGTs) inside an isolated memory container. By shifting these secrets outside the standard Local Security Authority (LSA) process memory space, it blocks credential-dumping utilities (like Mimikatz) from harvesting secrets from memory. 3. **Secure Launch**: System Guard Secure Launch protects firmware boot integrity by using hardware-enforced boot measurements. It isolates the hypervisor startup from potential rootkits or boot-level malware. 4. **UEFI Memory Attributes Table (MAT)**: Enforcing UEFI MAT ensures that the bootloader validates page permissions in firmware, preventing buffer overflow or execution redirection vulnerabilities in pre-boot configurations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) represent Tier 0 boundary systems. Because they handle the highest levels of domain authorization, physical threat vectors must be mitigated to the absolute maximum threshold: 1. **Direct Memory Access (DMA) Defenses**: External interfaces (e.g., Thunderbolt, USB4, PCIe ExpressCard, FireWire) allow attached devices to bypass the OS kernel and read physical RAM contents directly via high-speed buses. Attackers use physical DMA exploitation devices (such as PCILeech) to dump memory-resident Kerberos TGT tickets, NTLM hashes, and LSA secrets: * **Device Setup Class Blocking**: Disabling the SBP-2 setup class (`{d48179be-ec20-11d1-b6b8-00c04fa372a7}`) and the IEEE 1394 host controller class (`{6bdd1fc1-810f-11d0-bec7-08002be2092f}`) prevents Windows from binding drivers to FireWire storage and controllers. * **Hardware ID Blocking**: Explicitly blocking hardware IDs `PCI\CC_0C0A` (Thunderbolt), `PCI\CC_0C0010` (1394 OHCI FireWire), `PCI\CC_0607` (CardBus), and `PCI\CC_0605` (PCMCIA) halts driver installation for unauthorized high-speed expansion buses at the PCI enumeration layer. * **BitLocker DMA Under Lock**: Enforcing `DisableExternalDMAUnderLock` blocks DMA device operations whenever the PAW workstation is locked, closing the physical window for drive-by attacks on unattended stations. * **Tightened Enumeration Policy on PAWs**: While standard enterprise endpoints might permit external DMA after user authentication, PAWs enforce a strict **Block all** policy (`DeviceEnumerationPolicy = 0`). External peripherals whose drivers do not natively support DMA-remapping isolation are permanently prevented from accessing system memory. 2. **Cold Boot Exploits & RAM Decay**: Dynamic RAM retains memory contents for seconds or minutes following power loss, especially when cooled with aerosol duster or liquid nitrogen. In standard standby states (S1-S3), the RAM chips remain continuously powered and active. If a PAW is stolen or accessed while in standby, BitLocker master keys and volatile credentials can be read directly from memory. Disabling standby states forces the system to either remain active or transition to Hibernation (S4)/Shutdown, where RAM contents are encrypted on the BitLocker volume and protected by the TPM 2.0 PCR baseline. Enforcing a password on resume guarantees re-authentication upon wake. 3. **USB Exfiltration Protection**: Restricting write access on removable drives (`RDVDenyWriteAccess`) ensures administrative materials, directory backups, or sensitive credentials cannot be copied to unencrypted USB media. Setting `RDVDenyCrossOrg = 0` prevents cross-organization removable storage exemptions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections on high-value administrative assets like Privileged Access Workstations (PAWs). In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the **Microsoft Vulnerable Driver Blocklist** via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to **Kernel Mode Code Integrity (KMCI) only** (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits on administrative hosts without introducing administrative overhead or blocking standard user-mode admin applications. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated administrative bastions that operate at the pinnacle of the enterprise security architecture (Tier 0). Compromise of a PAW grants adversaries the credentials necessary to commandeer identity infrastructure, cloud tenants, and enterprise directory data. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Print Spooler service (`Spooler`) has been a recurring source of critical privilege escalation and coercion exploits (e.g., the PrintNightmare family). To secure Privileged Access Workstations (PAWs), which host highly privileged Tier 0 credentials: 1. **Disable the Print Spooler**: PAWs should never act as print servers or need print capabilities. Disabling the `Spooler` service completely eliminates this massive attack surface. 2. **Point and Print Restrictions**: As a defense-in-depth fallback, restricting print driver installations and updates to Administrators ensures that even if the spooler service is temporarily enabled for maintenance, standard users cannot load arbitrary, untrusted drivers. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem on Privileged Access Workstations (PAWs): 1. **Kernel Attack Surface Reduction**: Restricting the system to only load trusted fonts installed in the `%windir%\Fonts` system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. **Mitigation of Document-Based Exploits**: Prevents malicious font files embedded in administrative documents, scripts, or web tools from triggering parsing vulnerabilities in the context of high-privileged administrative accounts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host the most sensitive administrative credentials in an Active Directory environment, including Tier 0 Domain Admin Kerberos tickets, directory service RPC sessions, and PKI private key operations. Because PAWs are dedicated, single-purpose administrative endpoints, securing the Service Host (`svchost.exe`) process is critical to preventing kernel-level security evasion, process injection, and credential theft. Adversaries attempting to compromise administrative sessions frequently target `svchost.exe`: 1. **Process Injection & Credential Harvesting**: Infiltrating an administrative session by injecting into a high-privilege `svchost.exe` process (`CreateRemoteThread`, `QueueUserAPC`, `SetThreadContext`) allows attackers to execute shellcode within the `NT AUTHORITY\SYSTEM` security context, evading endpoint monitoring and attempting to access memory spaces holding privileged administrative tokens. 2. **Reflective DLL Loading & Dynamic Code Execution**: Advanced persistent threat (APT) frameworks execute memory-only payloads by allocating executable memory (`VirtualAlloc` with `PAGE_EXECUTE_READWRITE`) to bypass disk-based file scanners. 3. **Ghost Service Implants (MITRE ATT&CK T1574.002)**: Dropping unsigned service DLLs and registering them under legitimate `svchost.exe` service groups to gain persistent administrative access. Enabling `svchost.exe` mitigation options on PAWs restricts the behavior of every `svchost.exe` process through kernel-level mitigation policies: * **Microsoft-Only Binary Enforcement (`PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON`)**: Requires all binaries and dynamic-link libraries (DLLs) loaded into `svchost.exe` to be digitally signed by Microsoft. This prevents attackers from injecting custom, unsigned malicious DLLs into `svchost.exe` instances to tamper with administrative service processes. Any attempt to load non-Microsoft code is blocked with `STATUS_INVALID_IMAGE_HASH` (`0xC0000428`). * **Dynamic Code Execution Blocking (`PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON`)**: Disallows the generation and execution of dynamic code within `svchost.exe` processes. This neutralizes in-memory shellcode execution, JIT compilation abuse, and typical process hollowing attack vectors. * **Service Host Isolation**: On modern Windows 10/11 Enterprise systems with more than 3.5 GB of RAM, services run in separate, dedicated `svchost.exe` processes, ensuring each administrative service host is strictly isolated and independently enforced. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kernel-mode Hardware-enforced Stack Protection uses CPU hardware features to protect the operating system kernel from memory corruption exploits, specifically Return-Oriented Programming (ROP) attacks. On highly critical endpoints such as Privileged Access Workstations (PAWs), attackers aim to achieve kernel-mode execution to subvert administrative separation controls, bypass Endpoint Detection and Response (EDR) software, and extract domain credential secrets from isolated zones. Intel Control-flow Enforcement Technology (CET) and AMD Shadow Stack technologies create a separate, hardware-secured copy of the call stack (the "shadow stack"). Before returning from a function, the CPU compares the return address on the standard stack with the address stored on the hardware-secured shadow stack. If a mismatch is detected, the processor terminates the thread or crashes the system, neutralizing control-flow hijacking attempts. Deploying Kernel-mode Hardware-enforced Stack Protection on PAWs guarantees that the administrative gateway machines remain resilient against advanced kernel exploits. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Legacy name resolution protocols and insecure default network configurations are heavily targeted by attackers for credential harvesting and man-in-the-middle (MitM) positioning: 1. **Legacy Name Resolution (LLMNR / NetBIOS)**: LLMNR and NBT-NS serve as fallback protocols when DNS resolution fails. When a host queries an unresolvable name, it broadcasts requests over the local subnet. An attacker can spoof responses (e.g., using Responder) to capture NTLMv2 hashes or perform authentication relay attacks. NetBIOS name release requests can be forged to disrupt local names unless protected. 2. **NetBIOS Node Type and Name Release**: Setting the Node Type to P-node (point-to-point, value 2) disables broadcast resolution fallbacks. Enabling name release protection (`NoNameReleaseOnDemand`) prevents attackers from spoofing name release requests to deregister local names. 3. **ICMP Redirects**: ICMP redirect packets can be used by an attacker on the same subnet to dynamically redirect routing for specific hosts through the attacker's machine, enabling full MitM packet sniffing and modification. Disabling ICMP redirects prevents this vector. 4. **IP Source Routing**: Source routing allows a sender to specify the exact network path a packet should follow. This is commonly abused to bypass firewall routing rules or establish communication paths that violate network segment isolation. 5. **Disable Default IPv6 DNS Servers**: Disabling default IPv6 DNS servers prevents automated fallback to unauthenticated, dynamic local IPv6 DNS servers advertised by rogue routers or malicious tools (like mitm6), which would otherwise redirect query traffic and coerce NTLM or Kerberos authentication. 6. **Disable Web Proxy Auto-Discovery (WPAD)**: Disabling WPAD removes another name resolution mechanism that Responder exploits to harvest credentials. By disabling the `WinHttpAutoProxySvc` service and configuring `WpadOverride = 1`, the workstation is protected from rogue web proxy configurations. 7. **Restrict Net Session Enumeration (NetCease)**: By default, any authenticated domain user can query session information from remote hosts. Attackers utilize session enumeration to locate high-privileged user sessions (e.g., Domain Admins) across the network. Hardening the `SrvsvcSessionInfo` default security descriptor blocks this remote reconnaissance. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 User Account Control (UAC) is a fundamental defense mechanism in Windows. It limits the privilege levels of running applications, executing administrative actions with standard user tokens unless elevated privileges are explicitly approved. Hardening UAC settings ensures: 1. **Secure Desktop Enforcement**: The elevation prompt is displayed on a separate, secure desktop environment that isolated system threads run on. This prevents third-party malware running in user space from intercepting credentials or programmatically clicking "Yes" to elevate itself. 2. **Auto-Denial of Standard User Elevation**: Standard users should not be allowed to request elevation. If a standard user triggers a task requiring administrative rights, the prompt should auto-deny rather than requesting an administrator password, preventing users from attempting to bypass controls or exposing local admin passwords on a non-secure user terminal. 3. **Admin Approval Mode**: Forcing built-in administrators to run in Admin Approval Mode ensures that even administrative users do not run web browsers or document editors with administrative tokens by default. 4. **Sudo Command Control**: The `sudo` command introduced in Windows 11 (24H2) allows users to run elevated commands from an unelevated console. Leaving this feature unconfigured or allowing execution within the current console session can expose elevated processes to command injection or token interception in the same console session. Restricting `sudo` to opening a new elevated window (`1`) or disabling it entirely (`0`) mitigates session hijacking risks. 5. **Network UAC Restrictions (`LocalAccountTokenFilterPolicy`)**: Restricting the elevation of local accounts during network logons prevents lateral movement. When set to `0`, local accounts (except for the built-in Administrator RID 500 account) connecting remotely via network shares or administrative interfaces cannot obtain administrative tokens, neutralizing pass-the-hash attacks using secondary local administrative accounts. 6. **Installer Detection (`EnableInstallDetection`)**: Detecting installer program behavior prevents silent software execution. When enabled, any execution of an install file or setup program by standard users or administrators triggers a UAC elevation prompt, preventing unauthorized silent program deployments. 7. **UAC Virtualization (`EnableVirtualization`)**: Virtualizing writes redirection keeps the operating system directory space clean. It redirects legacy application registry and file writes targeting system folders (like `Program Files` or `System32`) to user-profile-specific folders, allowing legacy applications to run without requiring administrative rights. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The AutoPlay and AutoRun features in Windows are designed to automatically execute programs or open media when a removable drive, network share, or CD-ROM is inserted or connected. Attackers exploit these features by placing malicious scripts, payloads, or executables on USB drives or external storage media. If AutoPlay is enabled, connecting the drive triggers automatic execution of these scripts or programs without user interaction or approval, allowing malware to achieve immediate execution in the context of the logged-on user. Disabling AutoPlay across all drive types completely mitigates this physical transmission vector. Additionally, non-volume devices (such as mobile phones, cameras, or media players) can still trigger AutoPlay behavior. Disallowing AutoPlay for non-volume devices ensures these devices do not introduce unauthorized execution pathways when plugged into standard client machines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Remote Desktop Protocol (RDP) is one of the primary mechanisms used by attackers for lateral movement and administrative session hijacking. For Privileged Access Workstations (PAWs), which manage Tier 0 administrative assets: 1. **Lateral Movement Prevention**: PAWs represent physical console endpoints used to administer the forest. They must never accept inbound network connections. Disabling incoming RDP connections prevents attackers from pivoting from compromised general workstations to the PAW. 2. **Session Security**: Eliminating RDP listener ports prevents credential sniffing, password spraying, and remote exploitation of remote desktop services vulnerabilities on the administrative root of trust. 3. **Remote Assistance Block**: Disabling solicited remote assistance prevents potential remote command execution or remote support hijacking. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 In an isolated, air-gapped network, workstations cannot connect directly to Microsoft's online Update servers. If the system is left in its default configuration: 1. **DNS/Firewall Pollution**: Workstations will continuously attempt to resolve and connect to public Windows Update URLs (e.g., `*.update.microsoft.com`), filling firewall and local DNS resolver cache logs with timeouts and block events. 2. **Missing Updates**: Workstations will fail to receive security patches, critical updates, and Windows Defender definitions. 3. **Control Bypass**: Attackers or unapproved software could attempt to install out-of-band features or packages if update routes are not explicitly locked to internal sources. Enforcing the intranet update service location redirects all system update queries to the local WSUS server. Furthermore, enforcing Windows **Delivery Optimization** download mode to `Group (2)` limits peer-to-peer update sharing strictly to computers within the same active directory domain/group or local subnet boundaries, reducing bandwidth constraints on WAN/intranet segments and preventing unmanaged peer sharing. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Exploit Protection provides a set of advanced memory and vulnerability mitigations. These mitigations protect both the operating system and applications from memory corruption, buffer overflows, execution redirection, and process hijack attempts. By enforcing system-wide mitigations: 1. **Data Execution Prevention (DEP)**: Enforces non-executable memory pages, preventing attackers from executing shellcode injected into data-only memory regions (such as the stack or heap). 2. **Address Space Layout Randomization (ASLR)**: Randomizes the locations where system components, executable code, and memory allocations are loaded. Enabling Mandatory ASLR (Force Relocate Images), Bottom-Up ASLR, and High Entropy ASLR makes memory structures unpredictable, thwarting return-oriented programming (ROP) exploits. 3. **Control Flow Guard (CFG)**: Verifies control flow integrity for indirect call targets at compile time, preventing attackers from hijacking indirect jumps to point to arbitrary payloads. 4. **Structured Exception Handler Overwrite Protection (SEHOP)**: Blocks exploits that overwrite Structured Exception Handlers (SEH) to gain control of execution paths during error handling. 5. **Heap Termination on Corruption**: Immediately terminates a process if corruption is detected in its heap. This blocks heap-based buffer overflow exploitation before execution control can be seized. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malicious actors with standard user credentials can potentially bypass local security policies, local endpoint detection and response (EDR) agents, and group policy restrictions by booting the system into Safe Mode. In Safe Mode, many security agents and services do not load, creating an environment where local controls can be circumvented. By configuring `SafeModeBlockNonAdmins = 1`: 1. **Prevent Credential Bypass**: Standard users are blocked from logging in during Safe Mode, ensuring they cannot exploit the disabled security agents to execute unauthorized programs or extract system information. 2. **Maintenance Integrity**: Safe Mode remains accessible exclusively to system administrators for debugging and recovery, ensuring administrative capability is preserved while mitigating standard user risk. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Windows Defender Firewall is the primary host-based security control protecting endpoints from unauthorized incoming network connections and regulating outgoing network behaviors. A secure baseline requires enabling the firewall on all profiles, setting inbound connections to block by default, disabling notification prompts that can be bypassed by users, and implementing detailed auditing/logging to monitor network anomalies. Additionally: 1. **Outbound LOLBins Blocking**: Malicious actors frequently abuse built-in Windows administrative utilities (known as Living Off the Land Binaries, or LOLBins) to download malicious payloads, exfiltrate sensitive data, and communicate with external command-and-control (C2) servers. Blocking outbound network communication for binaries that have no legitimate business requirement to connect to external networks (such as `mshta.exe`, `certutil.exe`, `bitsadmin.exe`, `regsvr32.exe`, `rundll32.exe`, `cscript.exe`, `wscript.exe`, and `hh.exe`) significantly mitigates these threat vectors. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. If Secure Boot is disabled: 1. **Bootkits & Rootkits**: Attackers with physical access or local administrator privileges can replace the system bootloader with a malicious bootloader (bootkit). This bootkit executes before the Windows operating system loads, allowing it to bypass all Windows security controls, disable antivirus software, and run completely undetected. 2. **Virtualization-Based Security**: Advanced Windows defenses (like Credential Guard and Device Guard) depend on hardware-rooted trust. If Secure Boot is disabled, Virtualization-Based Security (VBS) cannot verify platform integrity, rendering these protections ineffective. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing smart card requirements at the local operating system level on administrative workstations provides vital physical and logical isolation: 1. **Password Logon Interface Block**: Requiring a smart card at logon tells Winlogon to suppress the default username and password fields. This forces the credential provider to only accept certificate-based smart card inserts. An attacker who has somehow acquired a user's password (e.g. via social engineering or physical shoulder surfing) will be unable to log on interactively because the endpoint will not display the password input fields. 2. **Mitigation of Credential Replay Attacks**: Traditional password logons store NTHashes locally in the LSA database or cache, which can be extracted by dumping LSASS memory. By using smart card credentials, the logon process utilizes public-key cryptography (Kerberos PKINIT) where the private key never leaves the secure boundaries of the smart card's hardware security chip. 3. **Session Interruption and Removal Enforcement**: Enforcing smart card logons naturally aligns with the smart card removal behavior requirement. Removing the smart card locks the session, and re-entry is impossible without physically re-inserting the token and inputting the PIN. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 To enforce strict isolation and minimize the attack surface of Tier 0 Privileged Access Workstations, all unnecessary legacy protocols, optional features, and runtime engines must be disabled. 1. **PowerShell 2.0 Engine**: Legacy PowerShell 2.0 does not support modern logging, transcription, or security monitoring mechanisms such as the Antimalware Scan Interface (AMSI). Attackers leverage "downgrade attacks" by executing PowerShell scripts using the `-version 2.0` parameter to bypass script block logging and security tooling. Disabling the engine and its parent runtimes eliminates this bypass vector. 2. **.NET Framework 3.5**: The .NET 3.5 Framework includes the runtime files for .NET 2.0 and 3.0. PowerShell 2.0 requires .NET 2.0/3.5 to run. Disabling `.NET Framework 3.5` removes legacy runtime binaries that are susceptible to downgrade attacks and removes support for older, unpatched software. 3. **SMBv1 Protocol**: The legacy SMBv1 protocol is cryptographically weak, lacks authentication integrity protection, and has been the target of catastrophic remote code execution attacks (such as EternalBlue). Leaving the SMBv1 driver active allows relaying and man-in-the-middle attacks. 4. **Internet Explorer 11**: Internet Explorer contains obsolete MSHTML render engine components. Disabling this legacy browser reduces vulnerability to web-based code execution. 5. **Work Folders, XPS, DirectPlay, and Client Protocols**: Services and tools such as Work Folders, XPS Viewer, DirectPlay, Telnet Client, TFTP Client, and Simple TCP/IP Services contain legacy network parsers and protocols that are completely unnecessary for a secure administrative system. 6. **WSL and Windows Sandbox**: Virtualization layers such as the Windows Subsystem for Linux (WSL) and Windows Sandbox allow the execution of unmonitored binaries, containers, and Linux utilities. On a PAW, these components present an unacceptable audit-bypass risk and must be disabled. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malicious documents (e.g., weaponized Word, Excel, or PowerPoint files) containing embedded VBA macros are a prevalent initial access and execution vector. Similarly, embedding malicious OLE packages inside Outlook items (such as RTF-formatted emails) allows attackers to trigger script execution or execute arbitrary packages via `packager.dll` when an administrator opens or previews the email. Hardening these settings ensures: 1. **Internet Macro Blocking**: VBA macros in files downloaded from the Internet or untrusted external attachments are blocked from executing, regardless of user consent. 2. **Macro Code Signing**: Any locally run macros are restricted to trusted, digitally signed code, preventing the execution of ad-hoc unverified user scripts. 3. **OLE Package Disablement**: Restricting Outlook OLE package activation (`ShowOLEPackageObj = 0`) blocks the execution of dangerous embedded objects in email messages. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated management perimeter for Tier 0 Active Directory assets, enterprise PKI, and virtualization hosts. Because PAWs possess access tokens and administrative credentials with domain-wide authority, eliminating untrusted code execution pathways is paramount: 1. **Elimination of Legacy Scripting Engines**: Windows Script Host (`wscript.exe` and `cscript.exe`) executes legacy VBScript and JScript engines. These hosts are prominent Living-off-the-Land Binaries (LOLBins / LOLBAS) that offer attackers opportunities for defense evasion, memory injection, and unconstrained script execution (MITRE ATT&CK T1059.005, T1059.007, T1218). PAWs have no operational requirement for legacy script execution. 2. **Defense-in-Depth Beyond Application Control**: Even in environments where Windows Defender Application Control (WDAC) or AppLocker is deployed, disabling WSH at the registry engine layer ensures that `wscript.exe` and `cscript.exe` fail immediately upon invocation, preventing script execution even if policies are in audit mode or rule bypasses are attempted. 3. **Comprehensive 64-Bit and WOW6432Node Lockdown**: Attackers frequently execute 32-bit binaries (`%SystemRoot%\SysWOW64\wscript.exe`) on 64-bit systems to bypass 64-bit security hooks. Enforcing `Enabled = 0` and `TrustPolicy = 2` across both native 64-bit and WOW6432Node registry paths ensures that 32-bit execution is completely disabled. 4. **TrustPolicy Hardening**: Configuring `TrustPolicy = 2` ensures that even if WSH were selectively invoked, unsigned and untrusted scripts are disallowed system-wide. 5. **Fail-Safe File Extension Remapping**: Remapping `.vbs`, `.vbe`, `.js`, `.jse`, `.wsf`, `.wsh`, and `.hta` file associations to `txtfile` (`notepad.exe`) ensures that if an administrator inspects an administrative script or artifact, opening the file in Windows Explorer displays the plain text in Notepad rather than executing the script. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the `AvailableUpdates` registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is **`0x5944`** (hex) / **`22852`** (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at **`0x4000`** (hex) / **`16384`** (decimal) upon successful completion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated administrative hosts used to manage high-value assets such as Domain Controllers and identity systems. Because they handle Tier 0 administrative credentials, they are highly targeted by adversaries. **Windows Defender Application Control (WDAC)** provides kernel-enforced application control to ensure that only trusted code executes on PAWs. Standard application control options like AppLocker operate primarily in user mode, whereas WDAC enforces integrity at both the kernel (KMCI) and user mode (UMCI) levels. Implementing a baseline WDAC policy that restricts software execution exclusively to Microsoft-signed code and trusted system components blocks unauthorized administrative tools, remote monitoring agents, and malicious payloads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Computer Browser service (`Browser`, driven by the kernel driver `bowser.sys`) maintains an inventory of network servers and domains across local network segments using unauthenticated NetBIOS over TCP/IP (NetBT) broadcast frames and legacy Server Message Block version 1 (SMBv1) protocol datagrams. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Infrared Monitor Service (`irmon`, hosted within `svchost.exe` via `irmon.dll`) provides management and discovery functions for the legacy Infrared Data Association (IrDA) optical protocol stack and Object Exchange (OBEX) protocol. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Internet Connection Sharing service (`SharedAccess` / ICS) provides Network Address Translation (NAT), dynamic addressing (embedded DHCP server), and name resolution (DNS proxy) capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Subsystem for Linux (WSL) service (`LxssManager`) manages the lifecycle, execution, and resource allocation of Linux distributions within Windows, utilizing syscall translation or lightweight Hyper-V micro-virtual machines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Microsoft FTP Service (`FTPSVC`) is an IIS server component that provides File Transfer Protocol (FTP) hosting services over TCP port 21. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The OpenSSH SSH Server service (`sshd`) provides inbound secure shell access, remote command-line session hosting, and secure file transfer (SFTP/SCP) over TCP port 22. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Remote Procedure Call (RPC) Locator service (`RpcLocator`) manages the legacy RPC name service database, historically used in pre-Windows 2000 architectures to locate RPC server interfaces. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Routing and Remote Access Service (`RemoteAccess` / RRAS) provides software-based packet routing, Network Address Translation (NAT), and incoming VPN server termination capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Simple TCP/IP Services (`simptcp`) implement a suite of legacy diagnostic protocols (Echo, Discard, Character Generator, Daytime, and Quote of the Day) operating across 10 distinct TCP and UDP network ports. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Special Administration Console (SAC) Helper service (`sacsvr`) facilitates Emergency Management Services (EMS), an out-of-band administrative console subsystem engineered for headless enterprise server hardware to enable text-based diagnostic access over physical or virtual serial (COM) ports. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Simple Service Discovery Protocol (SSDP) Discovery service (`SSDPSRV`) listens on UDP port 1900 multicast (`239.255.255.250` for IPv4 and `[FF02::C]` / `[FF05::C]` for IPv6) to discover Universal Plug and Play (UPnP) networked devices such as consumer printers, media renderers, and smart appliances. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The UPnP Device Host service (`upnphost`) allows a host to configure, announce, and expose dynamic Universal Plug and Play (UPnP) devices and control points to the local area network over unauthenticated HTTP endpoints. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Web Management Service (`WMSvc`) enables remote web server management for Internet Information Services (IIS), listening for incoming remote connections over HTTPS TCP port 8172. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Media Player Network Sharing Service (`WMPNetworkSvc`, hosted by `wmpnetwk.exe` or `svchost.exe`) shares local Windows Media Player multimedia libraries across the network using Universal Plug and Play (UPnP) and Digital Living Network Alliance (DLNA) protocols. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Windows Mobile Hotspot Service (`icssvc`) manages software-based wireless access point (SoftAP) hosting and network tethering features. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The World Wide Web Publishing Service (`W3SVC`) is the core engine for Internet Information Services (IIS), responsible for managing HTTP/HTTPS listeners, routing requests to `w3wp.exe` worker processes, and hosting web applications. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Accessory Management Service (`XboxGipSvc`, hosted in `svchost.exe` via `XboxGipSvc.dll`) manages Xbox gamepads, wireless gaming dongles, and consumer gaming accessories by interfacing directly with the Xbox Game Input Protocol (GIP) driver stack (`xboxgip.sys`). Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Auth Manager (`XblAuthManager`, hosted in `svchost.exe` via `XblAuthManager.dll`) provides programmatic token brokering and identity authentication services for consumer Microsoft Accounts (MSA) and the Xbox Live ecosystem. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Game Save Service (`XblGameSave`, hosted in `svchost.exe` via `XblGameSave.dll`) performs background synchronization of game save containers and application state to Microsoft Xbox Live consumer cloud infrastructure. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Xbox Live Networking Service (`XboxNetApiSvc`, hosted in `svchost.exe` via `XboxNetApiSvc.dll`) provides network interface abstraction, peer-to-peer session negotiation, and Teredo NAT traversal tunneling for consumer gaming applications. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM PAW platforms. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents Adobe Reader from launching any child processes. Malicious PDF documents frequently attempt to exploit application vulnerabilities or trick users into executing embedded links, which spawns command shells (cmd.exe, powershell.exe) or scripting hosts (wscript.exe) to download and launch secondary malware payloads. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes. This prevents malicious files containing embedded VBA macros or exploiting unpatched vulnerabilities (such as CVE-2021-40444) from launching scripting environments or system commands to download and execute code. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents executable files (such as .exe, .com, .scr, .vbs, .js, or .pif) from launching directly from email clients (like Outlook) or webmail accessed via browser sessions. This stops phishing attacks where users accidentally launch malicious attachments or download payloads directly from web-based email links. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks execution of unrecognized, newly compiled, or low-prevalence executable files. This provides initial protection against zero-day malware campaigns and targeted custom payloads that have not yet established reputation telemetry in the Microsoft Cloud Protection network. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents JavaScript or VBScript running locally from launching executable binaries that were downloaded from the internet. Attackers use malicious scripts inside documents or web browsers to download payloads (like ransomware or trojans) to the disk and launch them using local script engines. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Prevents Microsoft Office applications (Word, Excel, PowerPoint) from creating or writing executable files (e.g., .exe, .dll, .scr) to the local filesystem. Malicious documents often attempt to drop payloads directly into the local temp folders or AppData directories before executing them. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Office applications from writing code or injecting threads directly into external processes. Threat actors use code injection (such as process hollowing or remote thread creation) inside Office macros to hide execution under clean, trusted system binaries like explorer.exe or svchost.exe. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks Microsoft Outlook or other Office communication applications (e.g., Teams, Skype) from creating child processes. This prevents malware payloads delivered through emails, chats, or calendar invites from spawning command-line utilities or scripting environments. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and PAW platforms. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks the execution of unsigned or untrusted processes on removable storage devices (USB drives, external SSDs). This stops physical access vectors, rogue USB drops, and automated worm propagation techniques from running unauthorized installers or scripts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Blocks VBA macros inside Microsoft Office documents from invoking Win32 API calls. Malicious documents use macros to call kernel memory functions (such as VirtualAlloc, WriteProcessMemory, or CreateThread) to load and execute shellcode in memory without dropping files to disk, bypassing file scanners. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTrustedCredManAccessPrivilege` allows a process to access the Windows Credential Manager as a trusted caller via internal Credential Manager APIs. The Credential Manager securely stores user domain credentials, web passwords, and certificate secrets used for network authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeNetworkLogonRight` determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTcbPrivilege` identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via `LsaRegisterLogonProcess` and invoke `LsaLogonUser` to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeInteractiveLogonRight` determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (`explorer.exe`) and interactive desktop session. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeBackupPrivilege` grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the `FILE_FLAG_BACKUP_SEMANTICS` flag in Win32 `CreateFile` calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePagefilePrivilege` allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (`pagefile.sys`) via the `NtCreatePagingFile` API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateTokenPrivilege` allows a process to invoke the native API `NtCreateToken` to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (`lsass.exe`) following successful authentication. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreateGlobalPrivilege` allows a process to create named kernel and user objects (such as named pipes, shared memory sections, mutexes, and events) in the `\BaseNamedObjects` global namespace accessible across all terminal services sessions and interactive logon sessions. In terminal services and multi-user Windows environments, each interactive session is isolated into a private namespace (`\Sessions\X\BaseNamedObjects`). The global namespace is reserved for system services that must communicate across session boundaries. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeCreatePermanentPrivilege` allows a process to create permanent object directory objects in the Windows Object Manager namespace (`\DirectoryObject`) via APIs like `NtCreateDirectoryObject`. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDebugPrivilege` allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to `OpenProcess` with permissions such as `PROCESS_ALL_ACCESS` or `PROCESS_VM_READ` succeed even against processes owned by other users or `NT AUTHORITY\SYSTEM`. This privilege is intended strictly for kernel/application developers debugging live processes. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeEnableDelegationPrivilege` allows a security principal to modify the `userAccountControl` attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) `TRUSTED_FOR_DELEGATION` (Unconstrained Delegation); (2) `TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION` (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRemoteShutdownPrivilege` allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as `InitiateSystemShutdownEx` or `shutdown.exe /m \\computer`). This function is exposed over named pipe `\PIPE\InitShutdown` and RPC interface `winreg`/`shutdown`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeImpersonatePrivilege` grants a program the ability to impersonate a client that has connected to its local RPC interfaces, named pipes, or COM servers via `ImpersonateNamedPipeClient`, `CoImpersonateClient`, or `RpcImpersonateClient`. Impersonation allows a server process to temporarily run in the security context of the calling client to verify access permissions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLoadDriverPrivilege` allows a process to dynamically load and unload kernel-mode device drivers (`.sys` files) via `NtLoadDriver` or the Service Control Manager (`CreateService` with `SERVICE_KERNEL_DRIVER`). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeLockMemoryPrivilege` allows a process to lock physical memory pages in RAM using APIs such as `VirtualLock` and Address Windowing Extensions (AWE) via `AllocateUserPhysicalPages`. Locking pages prevents the Windows virtual memory manager from paging data out to disk in `pagefile.sys`, ensuring high-performance memory retention. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSecurityPrivilege` controls access to the Windows Security Event Log (`Security.evtx`) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via `ACCESS_SYSTEM_SECURITY`. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeSystemEnvironmentPrivilege` allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs `GetFirmwareEnvironmentVariable` and `SetFirmwareEnvironmentVariable`. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeManageVolumePrivilege` allows a process to perform low-level disk and volume maintenance tasks, including running defragmentation tools, modifying volume quotas, and invoking the `SetFileValidData` Win32 API. The `SetFileValidData` function allows a caller to extend the valid data length of an allocated file without zeroing out the intervening disk clusters. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeProfileSingleProcessPrivilege` allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeRestorePrivilege` grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying `FILE_FLAG_BACKUP_SEMANTICS` in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeTakeOwnershipPrivilege` allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via `SetNamedSecurityInfo` or `SetSecurityInfo`. The Windows security model grants the owner of an object implicit `WRITE_DAC` authority. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyNetworkLogonRight` explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The `SeDenyRemoteInteractiveLogonRight` explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate in high-security operations centers (SOC/NOC) or dedicated administrative enclaves. Tier 0 administrative operators interact with domain controllers, public key infrastructure (PKI), and cloud identity tenants. Allowing application notifications to render above the lock screen exposes highly confidential administrative context and authentication challenges to physical observation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate in dedicated management enclaves with restricted internet egress. Connecting to public consumer clouds to download wallpapers, marketing suggestions, or consumer games introduces unvetted network connections, violates administrative isolation, and increases attack surface on Tier 0 assets. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) handle the most sensitive infrastructure secrets in the Active Directory enterprise: Domain Controller recovery keys, Kerberos KRBTGT hashes, schema definitions, and cloud tenant administrative tokens. Generative AI assistants integrated into the operating system shell present an existential security and confidentiality hazard on dedicated Tier 0 management consoles. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration, identity synchronization, and domain-level maintenance. Administrative sessions on PAWs interact with sensitive directory export files (`ntds.dit` snippets, LDIFDE exports, sensitive PowerShell scripts, and recovery key backups). Allowing interactive, peer-to-peer, or modern shell file sharing from a PAW shatters data containment and provides immediate exfiltration channels. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate under strict dedicated role segregation. An administrator logging into a Tier 0 PAW authenticates directly with their Tier 0 privileged identity (e.g., Domain Admin smart card or FIDO2 key). The Windows Explorer "Run as different user" context menu verb (`runasuser`) invites multi-account usage patterns, credential confusion, and potential interactive credential theft. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the trusted execution environment for managing Active Directory Domain Services, forest trusts, and cryptographic root keys. Permitting multimedia sensors, unauthenticated camera feeds, dynamic slideshow image parsing, voice assistants, or keystroke learning databases on a Tier 0 console creates intolerable physical security, acoustic surveillance, and local memory exploitation risks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) enforce the most stringent security configurations across the enterprise to safeguard Tier 0 identity assets. Group Policy client configuration is applied by specialized Client-Side Extensions (CSEs). The GUID `{35378EAC-683F-11D2-A89A-00C04FBBCFA2}` corresponds to the core **Registry Client-Side Extension** (`gptext.dll`), which reads and applies the administrative templates and security settings packaged within Group Policy Objects. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the most secure bastion tier in an enterprise Active Directory deployment, operating within isolated administrative networks with strictly regulated inbound and outbound communications. Telemetry, diagnostic data collection, and application inventory background tasks represent unnecessary attack surface and data leakage risks when running on Tier 0 consoles. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 On Privileged Access Workstations (PAWs), File Explorer (`explorer.exe`) provides the interactive desktop shell within which all Tier 0 administrative tasks, credential entry, and management utilities operate. If an adversary or malicious script can exploit a memory corruption vulnerability within the Explorer process, they can execute arbitrary shellcode within the interactive administrative desktop station, compromising Kerberos tickets, session tokens, and Active Directory management sessions. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to high-privilege administrative tasks, such as managing Active Directory Domain Services, Azure AD Connect, PKI infrastructure, and Domain Controllers. Standard user activities—including general web browsing, personal email, and social media—are strictly forbidden on PAWs by foundational Tier 0 isolation principles. Even when direct interactive browsing is prohibited, background operating system components associated with legacy Internet Explorer, WinINet, and the Windows RSS Platform (`msfeeds.dll`, `msfeedssync.exe`) remain installed on Windows clients. Hardening these legacy components is essential to prevent background exploitation vectors on Tier 0 consoles. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate at the highest classification boundary in the enterprise, dedicated strictly to Tier 0 Active Directory and cloud identity administration. Permitting automated background credential rehydration after reboots, or omitting authoritative legal notice warnings, severely undermines physical device security and legal prosecution capabilities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated physical or virtual workstations exclusively utilized by Tier 0 identity administrators to manage Active Directory Domain Services, PKI root certification authorities, and privileged directory infrastructure. During an active administrative session, a PAW routinely hosts high-privilege credentials: * In-memory Kerberos Ticket Granting Tickets (TGTs) belonging to Domain Admins, Enterprise Admins, or Schema Admins. * Physical hardware security tokens (FIDO2 keys, PIV/CAC smart cards, YubiKeys) plugged into USB ports with unlocked PIN caching. * Open elevated PowerShell consoles, Active Directory Administrative Center sessions, and Microsoft Management Consoles (MMCs) possessing unconstrained administrative control over the directory. If an administrator steps away from their PAW without manually locking the console (e.g., to attend a meeting, take a phone call, or converse with colleagues), an unlocked workstation presents an existential threat to the entire Active Directory forest. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated management boundary for Tier 0 Active Directory assets. In a hardened PAW environment, local software installations are strictly restricted to enterprise-vetted administrative tooling deployed via central configuration management. Permitting any permissive Windows Installer settings—especially `AlwaysInstallElevated`—presents an immediate local privilege escalation hazard that could allow a non-administrative account or background worker to seize full `NT AUTHORITY\SYSTEM` control of the PAW. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are architected according to the "Clean Source" principle: a PAW is dedicated strictly to a single administrative tier, and administrators log in directly with their Tier 0 credentials. The Secondary Logon service (`seclogon.dll`), which facilitates `RunAs` and `CreateProcessWithLogonW`, is not only unnecessary on a dedicated PAW console, but poses an acute attack surface and violates Tier 0 credential hygiene. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account logon events captures authentication requests processed by the local system or the workstation, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Dedicated Privileged Access Workstations (PAWs) are the cornerstone of Tier 0 infrastructure security. While PAWs predominantly run native 64-bit administrative consoles, administrative utilities, MMC snap-ins, or legacy automation tools may invoke 32-bit processes under WOW64. Enforcing Structured Exception Handling Overwrite Protection (SEHOP) system-wide prevents stack corruption exploits from subverting the exception handling mechanism on high-privilege management stations. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host the most sensitive administrative sessions in the enterprise, including Domain Admin, Enterprise Admin, and Tier 0 identity management credentials. Any unauthorized file placement, symbolic link manipulation, or DLL planting in `%SystemRoot%` or system object manager namespaces could allow an unprivileged attacker or rogue maintenance utility to compromise the entire workstation integrity, leading to identity store takeover. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host high-integrity administrative tooling, PowerShell sessions, and directory management utilities where memory safety is critical to preventing credential harvesting. Mandatory Address Space Layout Randomization (ASLR) image relocation enforces systematic randomization across all executable binaries and loaded DLLs, depriving adversaries of static memory targets for Return-Oriented Programming (ROP) exploitation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 directory assets, where sensitive Kerberos TGTs, domain administrator password hashes, and enterprise PKI keys are processed in volatile memory. Speculative execution side-channel vulnerabilities (Spectre, Meltdown, MDS) allow unprivileged local code or sandboxed scripts to circumvent hardware security boundaries, leaking confidential kernel memory across address spaces. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 On Privileged Access Workstations (PAWs), Windows Defender Application Control (WDAC) and AppLocker enforce rigorous publisher signature rules to guarantee that only cryptographically verified, Microsoft-signed, or enterprise-approved binaries can execute. A vulnerability in legacy Authenticode processing (CVE-2013-3900) allows adversaries to append unauthorized code or secondary payloads to signed PE files without breaking the signature, creating a critical evasion pathway on administrative systems. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration, identity synchronization, and domain-level maintenance. Administrative batch scripts running on PAWs often operate in high-integrity or `SYSTEM` contexts to orchestrate directory backups, certificate rollover tasks, or network diagnostics. Allowing concurrent processes to modify active scripts creates a critical privilege escalation vector. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) process the highest-value authentication secrets in the enterprise, including Kerberos Ticket Granting Tickets (TGTs), domain administrator password hashes, and directory replication metadata. Time-Travel Debugging (TTD) records complete CPU instruction sequences and process memory states into persistent `.run` trace files. If left unconstrained on a PAW, an adversary could weaponize TTD to harvest Tier 0 credentials without triggering traditional LSASS access alerts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 On Privileged Access Workstations (PAWs), cryptographic trust validation is paramount. Administrative sessions connect to Domain Controllers via LDAPS, manage Active Directory Certificate Services (AD CS), authenticate via smart cards / Windows Hello for Business, and execute digitally signed PowerShell scripts. Allowing any local or interactive addition of root certificates to the PAW root store creates a catastrophic risk of rogue CA insertion, enabling transparent interception of Tier 0 authentication traffic. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to administrative tasks against Tier 0 Active Directory Domain Controllers, Certificate Authorities, and identity infrastructure. In a PAW environment, the presence of legacy process injection pathways creates an unacceptable threat surface that could allow an attacker or malicious user-mode software to hook administrative tools (e.g., PowerShell, RSAT, MMC, `dsa.msc`, `ntdsutil`) and compromise Tier 0 credentials. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are strictly isolated systems dedicated to managing Tier 0 assets. Web browsing and direct email access are prohibited on PAWs. However, administrative files, deployment scripts, security patches, and utility binaries may occasionally be transferred to PAWs via approved, encrypted management channels or staging shares. Preserving Mark-of-the-Web (MOTW) zone information ensures that the operating system's internal defense layers remain fully informed of the file's external provenance. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 Active Directory infrastructure, where administrators interact with domain controllers, certificate templates, and password vaulting solutions. Allowing consumer multimedia recording subsystems (such as Game DVR and the Windows Game Bar) to run on a PAW console creates an intolerable risk of unmonitored administrative session capture and credential exposure. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated management boundary for Active Directory forest infrastructure. In a PAW environment, the interactive console must remain completely locked against unauthenticated input, secondary application launching, or cached memory viewing when not actively in use by an authenticated administrator. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations host the credential material and management tools responsible for enterprise directory survival. While interactive logons on PAWs mandate hardware-backed multi-factor authentication (smart cards / WHfB), local fallback accounts (such as the local Administrator managed by Windows LAPS) must enforce an impervious password baseline to resist offline cryptanalysis: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Account lockout policies define the defensive response when incorrect credentials are submitted against user accounts. On Privileged Access Workstations, tight lockout thresholds protect administrative credentials from automated brute-force attacks and targeted dictionary probes: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Kerberos is the foundational authentication protocol of Active Directory Domain Services. Ticket lifetimes and synchronization constraints govern the operational window during which authentication tokens remain valid: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations serve as high-value execution environments where an active administrative session possesses unconstrained directory authority. Unattended, unlocked consoles present an immediate target for physical tampering, unauthorized keystroke injection (e.g., Rubber Ducky payloads), and unauthorized administrative actions: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 By default, Windows caches authentication verifiers for previously logged-on domain accounts to permit user authentication when an Active Directory Domain Controller cannot be reached. On Privileged Access Workstations, this feature poses an existential risk to Tier 0 directory security: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Restricting local account authentication boundaries, disabling legacy password hashes, and enforcing explicit user identity validation are vital to securing Tier 0 administrative workstations against remote compromise: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Legacy LAN Manager (LM) and NT LAN Manager version 1 (NTLMv1) authentication protocols are critically vulnerable to cryptographic recovery, offline dictionary cracking, and man-in-the-middle relaying. On Tier 0 Privileged Access Workstations, legacy authentication must be purged and session security fortified: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Local Security Authority Subsystem Service (LSASS) manages active logon sessions and authentication tokens. In legacy Windows architectures, the WDigest provider retained cleartext passwords in memory, creating one of the most prolific post-exploitation attack vectors in Windows history: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Modern credential protection relies on hardware-bound asymmetric cryptographic tokens rather than reusable passwords. However, legacy convenience features and unhardened PIN mechanisms can undermine this architecture if not strictly configured on administrative workstations: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations serve as the dedicated management plane for Active Directory Domain Controllers, Tier 0 PKI, and identity federation infrastructure. Introducing consumer cloud identities into this trusted boundary creates critical security exposures: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Netlogon Remote Protocol (MS-NRPC) secure channel forms the cryptographic communication link between domain-joined workstations and Active Directory Domain Controllers. On Privileged Access Workstations, protecting this channel from tampering, session key downgrade, and credential stagnation is essential to directory integrity: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The Server Message Block (SMB) protocol is utilized extensively for administrative file transfers, Group Policy retrieval, and remote management. Hardening SMB client and server parameters on Privileged Access Workstations prevents cleartext credential exposure, terminates stale dormant sessions, and eliminates unauthenticated network shares: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Unauthenticated network enumeration provides initial access actors with reconnaissance data required to map administrative privileges, local accounts, and shared directory resources: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Interactive logon controls establish the initial verification boundary between the physical user, hardware input devices, and the Windows kernel. On Tier 0 Privileged Access Workstations, interactive logon settings must eliminate credential harvesting prompts, shoulder surfing, and denial-of-service vectors: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 The WebClient service (`WebClient`, driven by `davclnt.sys`) handles Web Distributed Authoring and Versioning (WebDAV) file requests over HTTP and HTTPS. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host high-privilege administrative sessions used to manage Active Directory Domain Controllers and Tier 0 identity infrastructure. Standard Kerberos pre-authentication transmits the initial authentication request (AS-REQ) containing timestamp data that can be intercepted by adversaries monitoring network traffic, facilitating offline dictionary attacks and password cracking. Furthermore, accounts configured without Kerberos pre-authentication (`DONT_REQ_PREAUTH`) remain susceptible to AS-REP roasting attacks. Kerberos Armoring, or Flexible Authentication Secure Tunneling (FAST - RFC 6113), establishes an encrypted channel between the Kerberos client and the Key Distribution Center (KDC) using the client computer's account credential or machine certificate. This protects the AS-REQ and AS-REP exchanges against sniffing, offline cracking, and message tampering. In accordance with Tier 0 hardening baselines, the PAW configuration is strictly tightened compared to standard end-user workstations. While standard endpoints negotiate FAST opportunistically, PAWs configure **Fail authentication requests when Kerberos armoring is not available** (`RequireFast = 1`). This policy mandates that all authentication service (AS) and ticket-granting service (TGS) exchanges must be armored. If a Domain Controller does not support FAST or an attacker attempts a protocol downgrade, authentication is immediately terminated, ensuring that Tier 0 credentials are never exposed over unarmored channels. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the sensitive administrative bridge between Tier 0 operators and Tier 0 Active Directory Domain Controllers. Any security compromise of a PAW results in complete loss of forest integrity. Legacy Server Message Block version 1 (SMBv1) introduces catastrophic architectural vulnerabilities that cannot be permitted on privileged hardware. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are high-value targets operating within dedicated administrative management zones. Permitting unauthenticated broadcast resolution protocols on a PAW introduces critical risks of credential relay and network-level denial of service. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) establish highly privileged administrative sessions (including Kerberos-authenticated WinRM, Remote Desktop with Restricted Admin mode, and LDAP over TLS) to Tier 0 infrastructure. Preserving absolute network routing integrity is critical to prevent traffic interception or session manipulation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are hardened bastion hosts utilized by directory administrators to manage Active Directory domain controllers, Kerberos policies, and enterprise identity databases. Because PAWs operate under maximum privilege conditions, fundamental session security, DLL loading mechanisms, physical console timeouts, and security audit log thresholds must be enforced with zero tolerance for compromise. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host high-privilege administrative sessions where access to Active Directory domain controllers, PKI certificate authorities, and Tier 0 identity assets is executed. Hardware peripherals utilized on PAWs are strictly constrained to high-assurance authentication devices, such as smart card readers, cryptographic hardware security keys (FIDO2/YubiKeys), and dedicated administrative input hardware. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are high-security administrative bastion hosts dedicated exclusively to Tier 0 directory services management. Maintaining a deterministic, tamper-resistant system state on PAWs is a foundational requirement of the Microsoft Clean Source and tiering security models. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) provide a dedicated, isolated execution environment for managing Tier 0 Active Directory Domain Services, Public Key Infrastructure (PKI), and critical identity systems. The Windows Connected Devices Platform (CDP / Project Rome) introduces capabilities—such as cross-device task roaming, shared activity feeds, and cloud-synchronized clipboard buffers—that are fundamentally incompatible with the strict tiering and isolation guarantees required on a PAW. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) reside in isolated administrative zones dedicated to the management of Active Directory Domain Controllers and enterprise tier-0 identity infrastructure. Automated internet communication channels, web wizard downloads, and dynamic HTTP driver retrieval represent intolerable attack surfaces on privileged hosts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate in the Tier 0 administrative plane, handling Kerberos Ticket Granting Tickets (TGTs), Smart Card PINs, and administrative authentication tokens for Active Directory Domain Controllers. Protecting the Local Security Authority Subsystem Service (`lsass.exe`) against DLL injection and persistence is a vital baseline defense. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated management perimeter for Active Directory Domain Controllers and enterprise tier-0 administrative roles. Visual information disclosure, network re-association controls at lock screen, and consumer authentication features introduce critical exposure to administrative credential theft and physical exploitation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are high-assurance hardware platforms dedicated exclusively to Tier 0 directory administration. Modern laptop hardware supporting Modern Standby (S0 Low Power Idle) allows network adapters (Wi-Fi, Ethernet, cellular) to maintain active IP stacks and receive incoming network frames while the machine is sleeping or the lid is closed. Allowing unattended network activity on a PAW directly violates Tier 0 physical and network isolation standards. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 Active Directory Domain Services, root certificate authorities, and core directory security infrastructure. Permitting any form of Remote Assistance on a PAW constitutes an intolerable security architecture violation that shatters Active Directory administrative tiering. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) execute high-privilege Remote Procedure Call (RPC) routines when administering Domain Controllers, certificate authorities, and directory services. Hardening the RPC resolution mechanism is essential to protect administrative credentials and prevent malicious traffic redirection. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) perform high-consequence administrative operations across Tier 0 infrastructure. Precise timekeeping is a non-negotiable prerequisite for Kerberos ticket validation, security event audit sequencing, and cryptographic certificate verification. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration and Tier 0 infrastructure management. Application installation on a PAW must adhere to the strictest change management, code signing, and administrative boundaries. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the highest-trust endpoints within an Active Directory enterprise architecture. Physical access to an unlocked PAW grants direct compromise capability over Tier 0 directory services. If biometric facial verification is utilized for PAW operator logon, it must enforce the highest cryptographic and hardware liveness guarantees. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated, single-purpose endpoints reserved exclusively for Tier 0 Active Directory and infrastructure administration. Windows consumer-oriented shell enhancements—such as promotional subscription cards, consumer OneDrive prompts, and personal Microsoft Account (MSA) suggestions—introduce severe architectural and operational risks to high-assurance administrative hosts. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) operate within dedicated administrative perimeters for Tier 0 Active Directory management. Wireless projection capabilities (Miracast over Wi-Fi Direct) introduce serious risks of over-the-air hijacking and unauthenticated input injection if not strictly hardened. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to high-privilege Tier 0 Active Directory management tasks. Credential collection interfaces must maintain maximum visual confidentiality and prevent information disclosure regarding administrative identities. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are the dedicated administrative bastion hosts for Tier 0 Active Directory Domain Services, enterprise root certification authorities, and identity synchronization infrastructure. Workstations in this tier manage unconstrained directory objects, Kerberos Ticket Granting Service (TGS) sessions, and domain administrator secrets. The default Windows diagnostic telemetry, crash reporting, and preview build mechanisms pose catastrophic security risks to high-assurance Tier 0 environments. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated platform for Tier 0 Active Directory operations. Protecting the workstation from remote initial access vectors is paramount. The Windows App Installer protocol and package execution mechanisms present a severe vector for untrusted payload delivery that must be comprehensively disabled. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) serve as the dedicated management plane for Active Directory Domain Controllers, Tier 0 directory services, and critical identity infrastructure. Every interactive logon, administrative command execution, PowerShell script block, and remote management session initiated from a PAW carries severe security sensitivity. Default event log capacities (20 MB) or legacy 192 MB baselines roll over rapidly during heavy administrative activity or forensic investigations, destroying vital attribution evidence. Expanding the **Security** log to **1 GB** (`1,048,576 KB`), **System** and **Application** logs to **128 MB** (`131,072 KB`), and **Setup** log to **32 MB** (`32,768 KB`) establishes a robust local forensic buffer that preserves audit trails across extended operational periods: Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) represent Tier 0 administrative boundaries. Protecting these high-value machines against unauthorized code execution requires enforcing all layers of Windows execution policy and download origin tracking. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are hardened environments dedicated to Tier 0 infrastructure management. General web browsing on a PAW is strictly prohibited by design. However, legacy operating system binaries and background feed engines remain embedded in the Windows platform, requiring absolute administrative disabling to prevent exploitation. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) must maintain the highest standard of endpoint protection against ransomware and lateral movement attempts. Remote Encryption Protection detects and terminates network ransomware attempting to encrypt files over SMB shares. Enforcing Block mode terminates the malicious remote process or network connection attempting rapid or unauthorized file encryption, safeguarding Tier 0 administrative assets from network-based extortion attacks. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) are dedicated exclusively to Tier 0 Active Directory and core infrastructure administration. Because administrative consoles are used to generate disaster-recovery scripts, inspect Active Directory objects, and manage domain secrets, the operating system search subsystem must be strictly constrained against cryptographic degradation and side-channel leakage. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) execute mission-critical directory administration tools. Essential system management utilities (such as Windows Terminal and system runtime dependencies) are maintained through modern packaging pipelines, requiring rigorous patch hygiene without exposing the privileged environment to uncoordinated operating system upgrades. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) provide the highest level of security isolation for Tier 0 Active Directory administration. They operate under a strict "clean source" principle where only vetted administrative binaries and management consoles are permitted to execute. Windows Widgets and News and Interests dynamically embed web rendering runtimes (Microsoft Edge WebView2) into the taskbar shell, directly violating core PAW security architecture. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) process the enterprise's most sensitive credentials, including Active Directory Domain Admin tokens, Kerberos krbtgt keys, and enterprise root CA certificates. Permitting any automated, unattended credential persistence across reboots is fundamentally incompatible with Tier 0 security architectures. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) manage the enterprise's most sensitive Tier 0 identity boundaries. While Windows Sandbox allows isolated testing of administrative scripts or packages, running any virtualized container on a PAW without absolute host-isolation controls introduces severe risks to directory security. Microsoft Windows Server 2016 Microsoft Windows Server 2019 Microsoft Windows Server 2022 Microsoft Windows 10 Microsoft Windows 11 Privileged Access Workstations (PAWs) host the most sensitive interactive sessions and management credentials across the entire enterprise directory structure. Because PAWs are high-value targets for sophisticated adversaries seeking lateral movement into Active Directory Domain Controllers, applying cumulative security patches without latency is vital to system survival. SE_DENY_INTERACTIVE_LOGON_NAME SE_DENY_NETWORK_LOGON_NAME SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS EfsConfiguration HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\System DisableBkGndGroupPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters SMB1 HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\mrxsmb10 Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Dnscache\Parameters EnableMDNS HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\.* NetbiosOptions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\DNSClient EnableMulticast HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\DNSClient EnableNetbios HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa LmCompatibilityLevel HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\NTDS\Parameters LDAPServerIntegrity HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\NTDS\Parameters LdapEnforceChannelBinding HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa RunAsPPL HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard EnableVirtualizationBasedSecurity HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard HVCIMATRequired HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard ConfigureSystemGuardLaunch HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard HypervisorEnforcedCodeIntegrity HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa LsaCfgFlags HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Spooler Start HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\LanmanServer\Parameters RequireSecuritySignature HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\LanmanWorkstation\Parameters RequireSecuritySignature HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters SupportedEncryptionTypes HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa RestrictRemoteSAM HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters CbacAndArmorLevel HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters PKINITFreshness HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitEnabled HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitBehavior HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netlogon\Parameters AuditNTLMInDomain HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netlogon\Parameters RestrictNTLMInDomain HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 AuditReceivingNTLMTraffic HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 RestrictReceivingNTLMTraffic HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 RestrictSendingNTLMTraffic HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\DNS\Parameters ServerLevelPluginDll HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll CN HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services DisablePasswordSaving HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fSingleSessionPerUser HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fDisableCdm HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fDisableCcm HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fDisableLpt HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fDisablePNPRedir HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fPromptForPassword HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fEncryptRPCTraffic HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MinEncryptionLevel HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MaxIdleTime HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MaxDisconnectionTime HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\SrpV2\Exe EnforcementMode HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\SrpV2\Msi EnforcementMode HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\SrpV2\Script EnforcementMode HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\SrpV2\Appx EnforcementMode HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\AppCompat Prevent16BitApp HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\AppIDSvc Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\CI\Config VulnerableDriverBlocklistEnable HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa SubmitQueue HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa DisableDomainCreds HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\Netlogon\Parameters AllowVulnerableChannel HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\Netlogon\Parameters RefusePasswordChange HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\Netlogon\Parameters DisablePasswordChange HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\Netlogon\Parameters MaximumPasswordAge HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\Netlogon\Parameters RequireStrongKey HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\LanmanServer\Parameters NullSessionPipes HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths Machine HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths Machine HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer AllowOnlineTips HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\System EnableFontProviders HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications NoCloudApplicationNotification HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\TabletPC PreventHandwritingDataSharing HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports PreventHandwritingErrorReports HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers DisableHTTPPrinting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\SearchCompanion DisableContentFileUpdates HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoOnlinePrintsWizard HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoPublishingWizard HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Messenger\Client CEIP HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\SQMClient\Windows CEIPEnable HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting Disabled HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting DoReport HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy DisableQueryRemoteServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo DisabledByGroupPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager AllowSharedLocalAppData HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Camera AllowCamera HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DataCollection DisableEnterpriseAuthProxy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors DisableLocation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Messaging AllowMessageSync HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\PushToInstall DisablePushToInstall HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowCloudSearch HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search EnableDynamicContentInWSB HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform NoGenTicket HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\WindowsInkWorkspace AllowSuggestedAppsInWindowsInkWorkspace HKEY_CURRENT_USER Software\Policies\Microsoft\Assistance\Client\1.0 NoImplicitFeedback HKEY_CURRENT_USER Software\Policies\Microsoft\Windows\CloudContent DisableTailoredExperiencesWithDiagnosticData HKEY_CURRENT_USER Software\Policies\Microsoft\Windows\CloudContent DisableWindowsSpotlightFeatures HKEY_CURRENT_USER Software\Policies\Microsoft\WindowsMediaPlayer PreventCodecDownload HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions MitigationOptions_FontBocking HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SCMConfig EnableSvchostMitigationPolicy HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa DsrmAdminLogonBehavior HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\W32Time\Parameters Type HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\W32Time\Config AnnounceFlags HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\W32Time\Parameters NtpServer HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Secureboot AvailableUpdates HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\XblAuthManager\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\XblGameSave\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\AxInstSV\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\bthserv\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\CDPUserSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\dmwappushservice\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\MapsBroker\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\lfsvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\SharedAccess\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\lltdsvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\wlidsvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\NgcSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\NgcCtnrSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\NcbService\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\PhoneSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\PrintNotify\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\PcaSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\QWAVE\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\RmSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\SensorDataService\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\SensrSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\SensorService\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\ShellHWDetection\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\ScDeviceEnum\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\SSDPSRV\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\WiaRpc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\OneSyncSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\upnphost\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\UserDataSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\UnistoreSvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\WalletService\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Audiosrv\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\FrameServer\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\stisvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\wisvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\icssvc\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\WpnService\Start Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\WpnUserService\Start Start HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableRealtimeMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableBehaviorMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableScriptScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender PUAProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender DisableLocalAdminMerge HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender HideExclusionsFromLocalAdmins HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableLocalAdminConfiguration HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableAutoExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Spynet SpynetReporting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Features PassiveRemediation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection AllowNetworkProtectionOnWinServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine EnableFileHashComputation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS EnableConvertWarnToBlock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS AllowSwitchToAsyncInspection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection OobeEnableRtpAndSigUpdate HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Reporting EnableDynamicSignatureDroppedEventReporting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan QuickScanIncludeExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisablePackedExeScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableEmailScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableHeuristics HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DaysWithoutCatchupQuickScan HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ASSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates AVSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats Threats_ThreatSeverityDefaultAction HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options UILockdown HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Defender\Features TamperProtection HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Environment MP_FORCE_USE_SANDBOX HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\AMSI FeatureBits HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender DisableGenericRePorts HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection BruteForceProtectionAggressiveness HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection RemoteEncryptionProtectionAggressiveness HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 56a863a9-875e-4185-98a7-b882c64b5ce5 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 5beb7efe-fd9a-4556-801d-275e5ffc04cc HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules e6db77e5-3df2-4cf1-b95a-636979351e5b HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d1e49aac-8f56-4280-b9ba-993a6d77406c HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules c1db55ab-c21a-4637-bb3f-a12568109d35 SE_NETWORK_LOGON_NAME SE_TCB_NAME SE_MACHINE_ACCOUNT_NAME SE_INCREASE_QUOTA_NAME SE_INTERACTIVE_LOGON_NAME SE_REMOTE_INTERACTIVE_LOGON_NAME SE_BACKUP_NAME SE_CHANGE_NOTIFY_NAME SE_SYSTEMTIME_NAME SE_CREATE_PAGEFILE_NAME SE_CREATE_TOKEN_NAME SE_CREATE_PERMANENT_NAME SE_DEBUG_NAME SE_DENY_NETWORK_LOGON_NAME SE_DENY_BATCH_LOGON_NAME SE_DENY_SERVICE_LOGON_NAME SE_DENY_INTERACTIVE_LOGON_NAME SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME SE_ENABLE_DELEGATION_NAME SE_REMOTE_SHUTDOWN_NAME SE_AUDIT_NAME SE_LOAD_DRIVER_NAME SE_LOCK_MEMORY_NAME SE_BATCH_LOGON_NAME SE_SERVICE_LOGON_NAME SE_SECURITY_NAME SE_SYSTEM_ENVIRONMENT_NAME SE_PROF_SINGLE_PROCESS_NAME SE_RESTORE_NAME SE_SHUTDOWN_NAME SE_SYNC_AGENT_NAME SE_TAKE_OWNERSHIP_NAME HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy SCENoApplyLegacyAuditPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel LogLevel HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters KeepAliveTime HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters PerformRouterDiscovery HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters TcpMaxDataRetransmissions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\DNSClient DisableIPv6DefaultDnsServers HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD AllowLLTDIOOnDomain HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD AllowLLTDIOOnPublicNet HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD EnableLLTDIO HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD ProhibitLLTDIOOnPrivateNet HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD AllowRspndrOnDomain HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD AllowRspndrOnPublicNet HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD EnableRspndr HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LLTD ProhibitRspndrOnPrivateNet HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Peernet Disabled HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars EnableRegistrars HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars DisableUPnPRegistrar HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars DisableInBand802DOT11Registrar HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars DisableFlashConfigRegistrar HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars DisableWPDRegistrar HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WCN\UI DisableWcnUi HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Policies\EarlyLaunch DriverLoadPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control PEFirmwareType HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Power HiberbootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE DisableExternalDMAUnderLock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg HKEY_LOCAL_MACHINE System\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClasses HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClassesRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDsRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses 2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 3 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 4 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\Classes\. <ext> HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\Directory Service MaxSize HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\Directory Service Retention HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\DNS Server MaxSize HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\DNS Server Retention HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication MaxSize HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication Retention HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netbt\Parameters NoNameReleaseOnDemand HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netbt\Parameters NodeType HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters EnableICMPRedirect HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters DisableIPSourceRouting HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters DisableIPSourceRouting HKEY_CURRENT_USER Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad WpadOverride HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity SrvsvcSessionInfo HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient EnableMulticast HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient EnablemDNS HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient DisableIPv6DefaultDnsServers HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_ShowSharedAccessUI HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_AllowNetBridge_NLA HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_StdDomainUserSetLocation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy fMinimizeConnections HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy fBlockNonDomain HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config AutoConnectAllowedOEM HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers DisableWebPnPDownload HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers DisableHTTPPrinting HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters RestrictNullSessAccess HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System LocalAccountTokenFilterPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ConsentPromptBehaviorAdmin HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ConsentPromptBehaviorUser HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PromptOnSecureDesktop HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableInstallDetection HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableVirtualization HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Sudo Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutoRun HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoAutorun HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Explorer NoAutoplayfornonVolume HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices Deny_All HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Terminal Server fDenyTSConnections HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Terminal Server fAllowToGetHelp HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp UserAuthentication HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fAllowToGetHelp HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MaxTicketExpiryUnits HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MaxTicketExpiry HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fUseMailto HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fAllowFullControl HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System LocalAccountTokenFilterPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU NoAutoUpdate HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization DODownloadMode HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard EnableVirtualizationBasedSecurity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard HypervisorEnforcedCodeIntegrity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard LsaCfgFlags HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard ConfigureSystemGuardLaunch HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard HVCIMATRequired HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE AllowNetworkUnlock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE MinimumPIN HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseEnhancedPin HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPM HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPMPIN HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPMKey HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPMKeyPIN HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseAdvancedStartup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE EnableBDEWithNoTPM HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSAllowSecureBootForIntegrity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecovery HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSManageDRA HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecoveryPassword HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecoveryKey HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSHideRecoveryPage HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSActiveDirectoryInfoToStore HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRequireActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSHardwareEncryption HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSPassphrase HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVDiscoveryVolumeType HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVRecovery HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVManageDRA HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVRecoveryPassword HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVRecoveryKey HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVHideRecoveryPage HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVActiveDirectoryInfoToStore HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVRequireActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVHardwareEncryption HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVPassphrase HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVAllowUserCert HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE FDVEnforceUserCert HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDiscoveryVolumeType HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVRecovery HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVManageDRA HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVRecoveryPassword HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVRecoveryKey HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVHideRecoveryPage HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVActiveDirectoryInfoToStore HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVRequireActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVHardwareEncryption HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVPassphrase HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVAllowUserCert HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVEnforceUserCert HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg HKEY_LOCAL_MACHINE System\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control PEFirmwareType HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Power HiberbootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager DisableWpbtExecution HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE DisableExternalDMAUnderLock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg HKEY_LOCAL_MACHINE System\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClasses HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClassesRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDsRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection ExploitProtectionSettings HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection DisallowExploitProtectionOverride HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\kernel DisableExceptionChainValidation HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SafeModeBlockNonAdmins HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa RunAsPPL HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Spooler Start HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\AppCompat Prevent16BitApp HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\AppIDSvc Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Policies\EarlyLaunch DriverLoadPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions MitigationOptions_FontBocking HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SCMConfig EnableSvchostMitigationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_CURRENT_USER software\policies\microsoft\office\16.0\common\security vbawarnings HKEY_CURRENT_USER software\policies\microsoft\office\16.0\excel\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\word\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\powerpoint\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\outlook\security ShowOLEPackageObj HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\Classes\. <ext> HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Secureboot AvailableUpdates HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\CI\Config VulnerableDriverBlocklistEnable HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableRealtimeMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableBehaviorMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableScriptScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender PUAProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender DisableLocalAdminMerge HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender HideExclusionsFromLocalAdmins HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableLocalAdminConfiguration HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableAutoExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Spynet LocalSettingOverrideSpynetReporting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Features PassiveRemediation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection AllowNetworkProtectionOnWinServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine EnableFileHashComputation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS EnableConvertWarnToBlock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS AllowSwitchToAsyncInspection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection OobeEnableRtpAndSigUpdate HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Reporting EnableDynamicSignatureDroppedEventReporting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan QuickScanIncludeExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisablePackedExeScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableEmailScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableHeuristics HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DaysWithoutCatchupQuickScan HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ASSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates AVSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats Threats_ThreatSeverityDefaultAction HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options UILockdown HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Defender\Features TamperProtection HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Environment MP_FORCE_USE_SANDBOX HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\AMSI FeatureBits HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\System EnableSmartScreen HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\System ShellSmartScreenLevel HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\OneDrive DisableFileSyncNGSC HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments ScanWithAntiVirus HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 56a863a9-875e-4185-98a7-b882c64b5ce5 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d4f940ab-401b-4efc-aadc-ad5f3c50688a HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 01443614-cd74-433a-b99e-2ecdc07bfc25 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 5beb7efe-fd9a-4556-801d-275e5ffc04cc HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d3e037e1-3eb8-44c8-a917-57927947596d HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 3b576869-a4ec-4529-8536-b80a7769e899 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 26190899-1602-49e8-8b27-eb1d0a1ce869 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules e6db77e5-3df2-4cf1-b95a-636979351e5b HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d1e49aac-8f56-4280-b9ba-993a6d77406c HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules c1db55ab-c21a-4637-bb3f-a12568109d35 SE_TRUSTED_CREDMAN_ACCESS_NAME SE_NETWORK_LOGON_NAME SE_TCB_NAME SE_INTERACTIVE_LOGON_NAME SE_BACKUP_NAME SE_SYSTEMTIME_NAME SE_TIME_ZONE_NAME SE_CREATE_PAGEFILE_NAME SE_CREATE_TOKEN_NAME SE_CREATE_GLOBAL_NAME SE_CREATE_PERMANENT_NAME SE_CREATE_SYMBOLIC_LINK_NAME SE_DEBUG_NAME SE_ENABLE_DELEGATION_NAME SE_REMOTE_SHUTDOWN_NAME SE_IMPERSONATE_NAME SE_INC_BASE_PRIORITY_NAME SE_LOAD_DRIVER_NAME SE_LOCK_MEMORY_NAME SE_SECURITY_NAME SE_SYSTEM_ENVIRONMENT_NAME SE_MANAGE_VOLUME_NAME SE_PROF_SINGLE_PROCESS_NAME SE_SYSTEM_PROFILE_NAME SE_ASSIGNPRIMARYTOKEN_NAME SE_RESTORE_NAME SE_TAKE_OWNERSHIP_NAME SE_RELABEL_NAME SE_DENY_NETWORK_LOGON_NAME SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Classes SuppressionPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy SCENoApplyLegacyAuditPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel LogLevel HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\kernel DisableExceptionChainValidation HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager ProtectionMode HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management MoveImages HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management FeatureSettingsOverride HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management FeatureSettingsOverrideMask HKEY_LOCAL_MACHINE Software\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Command Processor LockBatchFilesWhenInUse HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\TTD RecordingPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots Flags HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows LoadAppInit_DLLs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs LoadAppInit_DLLs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments SaveZoneInformation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\GameDVR AllowGameDVR HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\WindowsInkWorkspace AllowWindowsInkWorkspace HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SECURITY\Cache NL$IterationCount HKEY_LOCAL_MACHINE SECURITY\Cache CachedLogonsCount HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest UseLogonCredential HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitEnabled HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitBehavior HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters RequireFast HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Group Policy NoBackgroundPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Group Policy NoGPOListChanges HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection BruteForceProtectionConfiguredState HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowCortana HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowCortanaAboveLock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowIndexingEncryptedStoresOrItems HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowSearchToUseLocation HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS EnableLAPS HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS BackupDirectory HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PasswordExpirationProtectionEnabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS ADPasswordEncryptionEnabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PasswordComplexity HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PasswordLength HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PasswordAgeDays HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PostAuthenticationResetDelay HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS PostAuthenticationActions HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters CbacAndArmorLevel HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\System EnumerateLocalUsers HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters AllowEncryptionOracle HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation AllowProtectedCreds HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit ProcessCreationIncludeCmdLine_Enabled HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging EnableScriptBlockLogging HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging EnableScriptBlockInvocationLogging HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging EnableModuleLogging HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames * HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\Transcription EnableTranscripting HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\Transcription EnableInvocationHeader HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\PowerShell\Transcription OutputDirectory HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\ADHardening\SYSVOLHoneypot DecoyGuid HKEY_LOCAL_MACHINE SOFTWARE\ADHardening\SYSVOLHoneypot DecoyPath HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\NTDS\Parameters TCP/IP Port HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netlogon\Parameters DCTcpipPort HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 SchUseStrongCrypto HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 SystemDefaultTlsVersions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 AllowStrongNameBypass HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 DefaultSecureProtocols HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319 SchUseStrongCrypto HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319 SystemDefaultTlsVersions HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727 SchUseStrongCrypto HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727 SystemDefaultTlsVersions HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\.NETFramework AllowStrongNameBypass HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\.NETFramework AllowStrongNameBypass HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp DefaultSecureProtocols HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp DefaultSecureProtocols HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters SMB1 HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths \\*\NETLOGON HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths \\*\SYSVOL HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation AllowInsecureGuestAuth HKEY_LOCAL_MACHINE System\CurrentControlSet\Services\LDAP ldapclientintegrity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Client AllowBasic HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Client AllowUnencryptedTraffic HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Client AllowDigest HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Service AllowBasic HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Service AllowUnencryptedTraffic HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Service DisableRunAs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\WinRS AllowRemoteShellAccess HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Rpc RestrictRemoteClients HKEY_LOCAL_MACHINE SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} Endpoints HKEY_LOCAL_MACHINE SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} AuthenticationLevel HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\winmgmt Type HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\WindowsUpdate WUServer HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\WindowsUpdate WUStatusServer HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\CrashControl DisplayParameters HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\AppCompat Prevent16BitApp HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\AppIDSvc Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa RunAsPPL HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE EncryptionMethodWithXtsOs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseAdvancedStartup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE EnableNonTpm HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPM HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseTPMPIN HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE UseEnhancedPINs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE MinPINLength HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecovery HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecoveryPassword HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSBackupSaveSource HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRequireActiveDirectoryBackup HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE OSRecoveryPasswordRotation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc251b-215d-4f10-ae40-e226dbe3c6a3 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc251b-215d-4f10-ae40-e226dbe3c6a3 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control PEFirmwareType HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Power HiberbootEnabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager DisableWpbtExecution HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard EnableVirtualizationBasedSecurity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard RequirePlatformSecurityFeatures HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard HypervisorEnforcedCodeIntegrity HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard LsaCfgFlags HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard ConfigureSystemGuardLaunch HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceGuard HVCIMATRequired HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE DisableExternalDMAUnderLock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg HKEY_LOCAL_MACHINE System\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClasses HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceClassesRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDs HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions DenyDeviceIDsRetroactive HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses 2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 3 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs 4 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection DeviceEnumerationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\CI\Config VulnerableDriverBlocklistEnable HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Policies\EarlyLaunch DriverLoadPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Spooler Start HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions MitigationOptions_FontBocking HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SCMConfig EnableSvchostMitigationPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks Enabled HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netbt\Parameters NoNameReleaseOnDemand HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Netbt\Parameters NodeType HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters EnableICMPRedirect HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip\Parameters DisableIPSourceRouting HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters DisableIPSourceRouting HKEY_CURRENT_USER Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad WpadOverride HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity SrvsvcSessionInfo HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient EnableMulticast HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient EnablemDNS HKEY_LOCAL_MACHINE Software\Policies\Microsoft\Windows NT\DNSClient DisableIPv6DefaultDnsServers HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_ShowSharedAccessUI HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_AllowNetBridge_NLA HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Network Connections NC_StdDomainUserSetLocation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy fMinimizeConnections HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy fBlockNonDomain HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config AutoConnectAllowedOEM HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers DisableWebPnPDownload HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Printers DisableHTTPPrinting HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters RestrictNullSessAccess HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System LocalAccountTokenFilterPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ConsentPromptBehaviorAdmin HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ConsentPromptBehaviorUser HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PromptOnSecureDesktop HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableInstallDetection HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableVirtualization HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Sudo Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutoRun HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoAutorun HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Explorer NoAutoplayfornonVolume HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Terminal Server fDenyTSConnections HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Terminal Server fAllowToGetHelp HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services fAllowToGetHelp HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU NoAutoUpdate HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization DODownloadMode HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection ExploitProtectionSettings HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection DisallowExploitProtectionOverride HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\kernel DisableExceptionChainValidation HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SafeModeBlockNonAdmins HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecureBoot\State UEFISecureBootEnabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ScForceOption HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_CURRENT_USER software\policies\microsoft\office\16.0\common\security vbawarnings HKEY_CURRENT_USER software\policies\microsoft\office\16.0\excel\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\word\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\powerpoint\security blockcontentexecutionfrominternet HKEY_CURRENT_USER software\policies\microsoft\office\16.0\outlook\security ShowOLEPackageObj HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Enabled HKEY_LOCAL_MACHINE SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings Enabled HKEY_CURRENT_USER SOFTWARE\Microsoft\Windows Script Host\Settings TrustPolicy HKEY_LOCAL_MACHINE SOFTWARE\Classes\. <ext> HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Secureboot AvailableUpdates HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableRealtimeMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableBehaviorMonitoring HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableScriptScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender PUAProtection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender DisableLocalAdminMerge HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender HideExclusionsFromLocalAdmins HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableLocalAdminConfiguration HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableAutoExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Features PassiveRemediation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection AllowNetworkProtectionOnWinServer HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine EnableFileHashComputation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS EnableConvertWarnToBlock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\NIS AllowSwitchToAsyncInspection HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection OobeEnableRtpAndSigUpdate HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Reporting EnableDynamicSignatureDroppedEventReporting HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan QuickScanIncludeExclusions HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisablePackedExeScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableEmailScanning HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DisableHeuristics HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Scan DaysWithoutCatchupQuickScan HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ASSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates AVSignatureDue HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates ScheduleDay HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats Threats_ThreatSeverityDefaultAction HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction 1 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options UILockdown HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows Defender\Features TamperProtection HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Environment MP_FORCE_USE_SANDBOX HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\AMSI FeatureBits HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 56a863a9-875e-4185-98a7-b882c64b5ce5 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d4f940ab-401b-4efc-aadc-ad5f3c50688a HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 01443614-cd74-433a-b99e-2ecdc07bfc25 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 5beb7efe-fd9a-4556-801d-275e5ffc04cc HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d3e037e1-3eb8-44c8-a917-57927947596d HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 3b576869-a4ec-4529-8536-b80a7769e899 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 26190899-1602-49e8-8b27-eb1d0a1ce869 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules e6db77e5-3df2-4cf1-b95a-636979351e5b HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules d1e49aac-8f56-4280-b9ba-993a6d77406c HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules c1db55ab-c21a-4637-bb3f-a12568109d35 SE_TRUSTED_CREDMAN_ACCESS_NAME SE_NETWORK_LOGON_NAME SE_TCB_NAME SE_INTERACTIVE_LOGON_NAME SE_BACKUP_NAME SE_CREATE_PAGEFILE_NAME SE_CREATE_TOKEN_NAME SE_CREATE_GLOBAL_NAME SE_CREATE_PERMANENT_NAME SE_DEBUG_NAME SE_ENABLE_DELEGATION_NAME SE_REMOTE_SHUTDOWN_NAME SE_IMPERSONATE_NAME SE_LOAD_DRIVER_NAME SE_LOCK_MEMORY_NAME SE_SECURITY_NAME SE_SYSTEM_ENVIRONMENT_NAME SE_MANAGE_VOLUME_NAME SE_PROF_SINGLE_PROCESS_NAME SE_RESTORE_NAME SE_TAKE_OWNERSHIP_NAME SE_DENY_NETWORK_LOGON_NAME SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Classes SuppressionPolicy HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy SCENoApplyLegacyAuditPolicy HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel LogLevel HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\kernel DisableExceptionChainValidation HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager ProtectionMode HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management MoveImages HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management FeatureSettingsOverride HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management FeatureSettingsOverrideMask HKEY_LOCAL_MACHINE Software\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config EnableCertPaddingCheck HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Command Processor LockBatchFilesWhenInUse HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\TTD RecordingPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots Flags HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows LoadAppInit_DLLs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments SaveZoneInformation HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\GameDVR AllowGameDVR HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\WindowsInkWorkspace AllowWindowsInkWorkspace HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SECURITY\Cache NL$IterationCount HKEY_LOCAL_MACHINE SECURITY\Cache CachedLogonsCount HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest UseLogonCredential HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\$($ServiceName) Start HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters EnableCbacAndArmor HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitEnabled HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters DevicePKInitBehavior HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters RequireFast HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Group Policy NoBackgroundPolicy HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Group Policy NoGPOListChanges HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\Lsa AllowCustomSSPsAPs HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 DCSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 ACSettingIndex HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection BruteForceProtectionConfiguredState HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowCortana HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowCortanaAboveLock HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowIndexingEncryptedStoresOrItems HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowSearchToUseLocation HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion SystemRoot .* ^(S-1-5-21-.*-512|S-1-5-21-.*-519|S-1-5-21-.*-518)$ ^(S-1-5-21-.*-512|S-1-5-21-.*-519|S-1-5-21-.*-518)$ ^(S-1-5-21-.*-512|S-1-5-21-.*-519|S-1-5-21-.*-518)$ reg_sz .* AUDIT_NONE reg_sz .* reg_dword 1 reg_dword 0 reg_sz .* reg_sz .* reg_dword 0 reg_dword 4 reg_dword 0 reg_dword 2 reg_dword 0 reg_sz `2` [REG_DWORD]) reg_dword 5 reg_dword 2 reg_dword 2 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 4 reg_dword 1 reg_dword 1 reg_sz `2147483640` (REG_DWORD, decimal representation of `0x7FFFFFF8` which enables AES128, AES256, and Future encryption types while explicitly disallowing DES and RC4) or `2147483584` (`0x7FFFFFC0` which restricts strictly to AES256 and Future encryption types) reg_sz O:BAG:BAD:(A;;RC;;;BA) reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 7 reg_dword 3 reg_dword 2 reg_dword 2 reg_dword 2 reg_sz .* reg_sz .* reg_dword 0 reg_sz MicrosoftDNS,CN=System,DC=[Domain]` reg_sz .* reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 3 reg_dword 900000 reg_dword 60000 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 1 reg_sz .* reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 30 reg_dword 1 reg_sz $NullSessionPipes reg_sz $AllowedExactPaths reg_sz $AllowedPaths reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz 1000000000000 reg_dword 1 reg_dword 1 reg_sz NTP reg_dword 5 reg_sz [NtpServerAddress],0x8 reg_dword 1 reg_dword 22852 reg_sz .* reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 7 reg_dword 7 reg_dword 7 reg_dword 0 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 5 reg_sz 1 reg_dword 2 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 2 reg_sz 1 ^(S-1-5-9|S-1-5-11|S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20|S-1-5-32-544)$ ^(S-1-5-9|S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-554|S-1-5-11|S-1-5-32-544|S-1-5-20|S-1-5-19|S-1-1-0)$ ^(S-1-5-32-544|S-1-5-19)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-546)$ ^(S-1-5-32-546)$ ^(S-1-5-32-546)$ ^(S-1-5-32-546)$ ^(S-1-5-32-546)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ reg_dword 1 reg_dword 0 AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE reg_dword 4 reg_dword 300000 reg_dword 0 reg_dword 3 reg_dword 3 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 3 reg_dword 2 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz {d48179be-ec20-11d1-b6b8-00c04fa372a7} reg_sz {6bdd1fc1-810f-11d0-bec7-08002be2092f} reg_sz PCI\CC_0C0A reg_sz PCI\CC_0C0010 reg_sz PCI\CC_0607 reg_sz PCI\CC_0605 reg_dword 0 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_sz `vbs`, `vbe`, `js`, `jse`, `wsf`, `wsh`, `hta`) reg_dword 268435456 reg_dword 0 reg_dword 268435456 reg_dword 0 reg_dword 134217728 reg_dword 0 reg_dword 1 reg_dword 2 reg_dword 0 reg_dword 2 reg_dword 2 reg_dword 1 reg_binary 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 3 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz `255` (0xFF, REG_DWORD) reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 4 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz .* reg_dword 1 reg_dword 6 reg_dword 1 reg_dword 2 reg_dword 2 reg_dword 2 reg_dword 2 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_sz reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 2 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_sz reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz {d48179be-ec20-11d1-b6b8-00c04fa372a7} reg_sz PCI\CC_0C0A reg_sz PCI\CC_0C0010 reg_dword 0 reg_sz C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_sz .* reg_dword 1 reg_dword 1 reg_dword 4 reg_dword 1 reg_dword 2 reg_dword 3 reg_sz 1000000000000 reg_dword 1 reg_dword 1 reg_sz .* reg_dword 3 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_sz `vbs`, `vbe`, `js`, `jse`, `wsf`, `wsh`, `hta`) reg_dword 22852 reg_dword 1 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 7 reg_dword 7 reg_dword 7 reg_dword 0 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 5 reg_sz 1 reg_dword 2 reg_dword 1 reg_sz Block reg_dword 1 reg_dword 3 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 ^(S-1-5-32-544|S-1-5-32-555)$ ^(S-1-5-32-544|S-1-5-32-545)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544|S-1-5-19)$ ^(S-1-5-32-544|S-1-5-19|S-1-5-32-545)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20|S-1-5-32-544|S-1-5-6)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20|S-1-5-32-544|S-1-5-6)$ ^(S-1-5-32-544|S-1-5-90-0)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544|S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420)$ ^(S-1-5-19|S-1-5-20)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-113|S-1-5-114)$ ^(S-1-5-113|S-1-5-114)$ reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz 4096` (`0x00001000`) instructs the Windows Shell verb evaluation engine to suppress the `runasuser` verb across all primary executable file classes (`exefile`, `batfile`, `cmdfile`, `mscfile`), removing the command from Explorer menus. reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_dword 0 AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_FAILURE AUDIT_FAILURE AUDIT_FAILURE AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE reg_dword 0 reg_dword 1 reg_dword 4294967295 reg_dword 72 reg_dword 3 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 0 reg_sz reg_sz 0`, inspect `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs` across representative fleet systems to ensure no legitimate, approved business software is broken. reg_dword 2 reg_dword 0 reg_dword 1 4294967295 86400 14 24 false false 900 900 10 reg_sz .* reg_sz .* reg_dword 1954 reg_sz 0`)**: reg_sz .* reg_sz .* reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 4 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 2 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* 20 24 false false 1800 5 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 1 reg_dword 4 reg_dword 20 reg_dword 30 reg_dword 8 reg_dword 3 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_dword 1 reg_dword 1 reg_sz .* reg_sz .* reg_sz .* reg_dword 0 reg_dword 0 reg_dword 1 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_sz * reg_dword 1 reg_dword 1 reg_sz C:\ProgramData\PowerShellTranscripts reg_sz .* reg_sz .* reg_sz .* reg_sz $Guid reg_sz $DecoyXmlPath reg_sz .* reg_dword 38901 reg_dword 38902 reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 2048 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 2048 reg_dword 2048 reg_dword 0 reg_sz .* reg_sz RequireIntegrity=1,RequireMutualAuthentication=1 reg_sz RequireIntegrity=1,RequireMutualAuthentication=1 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_sz ncacn_ip_tcp,0,24158 reg_dword 6 reg_dword 16 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz https://wsust0.corp.local:8531 reg_sz https://wsust0.corp.local:8531 reg_dword 1 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_sz .* reg_sz .* reg_dword 1 reg_dword 2 reg_dword 1 reg_sz .* reg_dword 7 reg_dword 1 reg_dword 0 reg_dword 2 reg_dword 2 reg_dword 1 reg_dword 8 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 2 reg_dword 1 reg_dword 0 reg_dword 3 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz {d48179be-ec20-11d1-b6b8-00c04fa372a7} reg_sz {6bdd1fc1-810f-11d0-bec7-08002be2092f} reg_sz PCI\CC_0C0A reg_sz PCI\CC_0C0010 reg_sz PCI\CC_0607 reg_sz PCI\CC_0605 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 4 reg_sz 1000000000000 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 0 reg_dword 2 reg_dword 2 reg_dword 1 reg_binary 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 3 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_sz `255` (0xFF, REG_DWORD) reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 0 reg_dword 4 reg_dword 1 reg_dword 2 reg_sz C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_sz .* reg_dword 1 reg_dword 1 reg_sz .* reg_dword 3 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_dword 0 reg_dword 2 reg_sz `vbs`, `vbe`, `js`, `jse`, `wsf`, `wsh`, `hta`) reg_dword 22852 reg_sz .* reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 4 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 7 reg_dword 7 reg_dword 7 reg_dword 0 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 5 reg_sz 1 reg_dword 2 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 reg_sz 1 ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20|S-1-5-32-544|S-1-5-6)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-19|S-1-5-20|S-1-5-32-544|S-1-5-6)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-32-544)$ ^(S-1-5-113|S-1-5-114)$ ^(S-1-5-113|S-1-5-114)$ reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz 4096` (`0x00001000`) across `batfile`, `cmdfile`, `exefile`, and `mscfile` classes, the operating system completely suppresses and removes the "Run as different user" option from all shell context menus. reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 1 reg_dword 0 AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS AUDIT_SUCCESS AUDIT_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE AUDIT_SUCCESS_FAILURE reg_dword 0 reg_dword 1 reg_dword 4294967295 reg_dword 72 reg_dword 3 reg_dword 1 reg_dword 1 reg_dword 1 reg_dword 2 reg_dword 1 reg_dword 0 reg_sz reg_dword 2 reg_dword 0 reg_dword 1 4294967295 86400 20 24 false false 1800 1800 5 reg_sz .* reg_sz .* reg_dword 1954 reg_sz 0`)**: reg_sz .* reg_sz .* reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 4 reg_dword 1 reg_dword 1 reg_dword 0 reg_dword 1 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz 0` guarantees that the operating system kernel and LSA subsystem unconditionally refuse to load third-party SSP and AP DLLs, closing the registry-based persistence vector. reg_sz .* reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_dword 2 reg_dword 0 reg_dword 0 reg_dword 0 reg_dword 0 reg_sz .* reg_sz .* reg_sz .* reg_sz .* reg_sz .*