Resources/SecurityOptions.json
|
{ "Source": "Generated by CI/Update-SecurityOptionCatalog.ps1 from HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SeCEdit\\Reg Values (Windows 10.0.26300.0)", "SecurityOptions": [ { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoConnectedUser", "Name": "Accounts: Block Microsoft accounts", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "This policy is disabled" }, { "Value": "1", "Text": "Users can't add Microsoft accounts" }, { "Value": "3", "Text": "Users can't add or log on with Microsoft accounts" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LimitBlankPasswordUse", "Name": "Accounts: Limit local account use of blank passwords to console logon only", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\AuditBaseObjects", "Name": "Audit: Audit the access of global system objects", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FullPrivilegeAuditing", "Name": "Audit: Audit the use of Backup and Restore privilege", "RegistryType": 3, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SCENoApplyLegacyAuditPolicy", "Name": "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\CrashOnAuditFail", "Name": "Audit: Shut down system immediately if unable to log security audits", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DCOM\\MachineAccessRestriction", "Name": "DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax", "RegistryType": 1, "Display": "Text" }, { "Key": "MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DCOM\\MachineLaunchRestriction", "Name": "DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax", "RegistryType": 1, "Display": "Text" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\UndockWithoutLogon", "Name": "Devices: Allow undock without having to log on", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllocateDASD", "Name": "Devices: Allowed to format and eject removable media", "RegistryType": 1, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Administrators" }, { "Value": "1", "Text": "Administrators and Power Users" }, { "Value": "2", "Text": "Administrators and Interactive Users" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Print\\Providers\\LanMan Print Services\\Servers\\AddPrinterDrivers", "Name": "Devices: Prevent users from installing printer drivers", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllocateCDRoms", "Name": "Devices: Restrict CD-ROM access to locally logged-on user only", "RegistryType": 1, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllocateFloppies", "Name": "Devices: Restrict floppy access to locally logged-on user only", "RegistryType": 1, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SAM\\ComputerAccountReuseAllowList", "Name": "Domain controller: Allow computer account re-use during domain join", "RegistryType": 4, "Display": "Text" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SubmitControl", "Name": "Domain controller: Allow server operators to schedule tasks", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\VulnerableChannelAllowList", "Name": "Domain controller: Allow vulnerable Netlogon secure channel connections", "RegistryType": 4, "Display": "Text" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\NTDS\\Parameters\\LdapEnforceChannelBinding", "Name": "Domain controller: LDAP server channel binding token requirements", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Never" }, { "Value": "1", "Text": "When supported" }, { "Value": "2", "Text": "Always" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\NTDS\\Parameters\\LDAPServerIntegrity", "Name": "Domain controller: LDAP server signing requirements", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "1", "Text": "None" }, { "Value": "2", "Text": "Require signing" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\NTDS\\Parameters\\LDAPServerEnforceIntegrity", "Name": "Domain controller: LDAP server signing requirements Enforcement", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RefusePasswordChange", "Name": "Domain controller: Refuse machine account password changes", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SAM\\RefuseDefaultMachinePwd", "Name": "Domain controller: Refuse setting default machine account password", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireSignOrSeal", "Name": "Domain member: Digitally encrypt or sign secure channel data (always)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SealSecureChannel", "Name": "Domain member: Digitally encrypt secure channel data (when possible)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\SignSecureChannel", "Name": "Domain member: Digitally sign secure channel data (when possible)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange", "Name": "Domain member: Disable machine account password changes", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\MaximumPasswordAge", "Name": "Domain member: Maximum machine account password age", "RegistryType": 4, "Display": "Number", "Unit": "days" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RequireStrongKey", "Name": "Domain member: Require strong (Windows 2000 or later) session key", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DontDisplayLockedUserId", "Name": "Interactive logon: Display user information when the session is locked", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "1", "Text": "User display name, domain and user names" }, { "Value": "2", "Text": "User display name only" }, { "Value": "3", "Text": "Do not display user information" }, { "Value": "4", "Text": "Domain and user names only" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableCAD", "Name": "Interactive logon: Do not require CTRL+ALT+DEL", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DontDisplayLastUserName", "Name": "Interactive logon: Don't display last signed-in", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DontDisplayUserName", "Name": "Interactive logon: Don't display username at sign-in", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\MaxDevicePasswordFailedAttempts", "Name": "Interactive logon: Machine account lockout threshold", "RegistryType": 4, "Display": "Number", "Unit": "invalid logon attempts" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs", "Name": "Interactive logon: Machine inactivity limit", "RegistryType": 4, "Display": "Number", "Unit": "seconds" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoticeText", "Name": "Interactive logon: Message text for users attempting to log on", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoticeCaption", "Name": "Interactive logon: Message title for users attempting to log on", "RegistryType": 1, "Display": "Text" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\CachedLogonsCount", "Name": "Interactive logon: Number of previous logons to cache (in case domain controller is not available)", "RegistryType": 1, "Display": "Number", "Unit": "logons" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\PasswordExpiryWarning", "Name": "Interactive logon: Prompt user to change password before expiration", "RegistryType": 4, "Display": "Number", "Unit": "days" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ForceUnlockLogon", "Name": "Interactive logon: Require Domain Controller authentication to unlock workstation", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ScForceOption", "Name": "Interactive logon: Require Windows Hello for Business or smart card", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ScRemoveOption", "Name": "Interactive logon: Smart card removal behavior", "RegistryType": 1, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "No Action" }, { "Value": "1", "Text": "Lock Workstation" }, { "Value": "2", "Text": "Force Logoff" }, { "Value": "3", "Text": "Disconnect if a remote Remote Desktop Services session" }, { "Value": "4", "Text": "Disconnect if a remote Remote Desktop Services session, regardless of logon method" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\RequireSecuritySignature", "Name": "Microsoft network client: Digitally sign communications (always)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\EnableSecuritySignature", "Name": "Microsoft network client: Digitally sign communications (if server agrees)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\EnablePlainTextPassword", "Name": "Microsoft network client: Send unencrypted password to third-party SMB servers", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\AutoDisconnect", "Name": "Microsoft network server: Amount of idle time required before suspending session", "RegistryType": 4, "Display": "Number", "Unit": "minutes" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableS4U2SelfForClaims", "Name": "Microsoft network server: Attempt S4U2Self to obtain claim information", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Default" }, { "Value": "1", "Text": "Enabled" }, { "Value": "2", "Text": "Disabled" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RequireSecuritySignature", "Name": "Microsoft network server: Digitally sign communications (always)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableSecuritySignature", "Name": "Microsoft network server: Digitally sign communications (if client agrees)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\EnableForcedLogOff", "Name": "Microsoft network server: Disconnect clients when logon hours expire", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\SmbServerNameHardeningLevel", "Name": "Microsoft network server: Server SPN target name validation level", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Off" }, { "Value": "1", "Text": "Accept if provided by client" }, { "Value": "2", "Text": "Required from client" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SAM\\MinimumPasswordLengthAudit", "Name": "Minimum password length audit", "RegistryType": 4, "Display": "Number", "Unit": "characters" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM", "Name": "Network access: Do not allow anonymous enumeration of SAM accounts", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous", "Name": "Network access: Do not allow anonymous enumeration of SAM accounts and shares", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\DisableDomainCreds", "Name": "Network access: Do not allow storage of passwords and credentials for network authentication", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\EveryoneIncludesAnonymous", "Name": "Network access: Let Everyone permissions apply to anonymous users", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessionPipes", "Name": "Network access: Named Pipes that can be accessed anonymously", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SecurePipeServers\\Winreg\\AllowedExactPaths\\Machine", "Name": "Network access: Remotely accessible registry paths", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SecurePipeServers\\Winreg\\AllowedPaths\\Machine", "Name": "Network access: Remotely accessible registry paths and sub-paths", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RestrictNullSessAccess", "Name": "Network access: Restrict anonymous access to Named Pipes and Shares", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictRemoteSAM", "Name": "Network access: Restrict clients allowed to make remote calls to SAM", "RegistryType": 1, "Display": "Text" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessionShares", "Name": "Network access: Shares that can be accessed anonymously", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\ForceGuest", "Name": "Network access: Sharing and security model for local accounts", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Classic - local users authenticate as themselves" }, { "Value": "1", "Text": "Guest only - local users authenticate as Guest" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\UseMachineId", "Name": "Network security: Allow Local System to use computer identity for NTLM", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\allownullsessionfallback", "Name": "Network security: Allow LocalSystem NULL session fallback", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\pku2u\\AllowOnlineID", "Name": "Network security: Allow PKU2U authentication requests to this computer to use online identities.\r\n\r\n", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\SupportedEncryptionTypes", "Name": "Network security: Configure encryption types allowed for Kerberos", "RegistryType": 4, "Display": "Bitmask", "Choices": [ { "Value": "1", "Text": "DES_CBC_CRC" }, { "Value": "2", "Text": "DES_CBC_MD5" }, { "Value": "4", "Text": "RC4_HMAC_MD5" }, { "Value": "8", "Text": "AES128_HMAC_SHA1" }, { "Value": "16", "Text": "AES256_HMAC_SHA1" }, { "Value": "2147483616", "Text": "Future encryption types" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash", "Name": "Network security: Do not store LAN Manager hash value on next password change", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel", "Name": "Network security: LAN Manager authentication level", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Send LM & NTLM responses" }, { "Value": "1", "Text": "Send LM & NTLM - use NTLMv2 session security if negotiated" }, { "Value": "2", "Text": "Send NTLM response only" }, { "Value": "3", "Text": "Send NTLMv2 response only" }, { "Value": "4", "Text": "Send NTLMv2 response only. Refuse LM" }, { "Value": "5", "Text": "Send NTLMv2 response only. Refuse LM & NTLM" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LDAP\\LDAPClientConfidentiality", "Name": "Network security: LDAP client encryption requirements", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "None" }, { "Value": "1", "Text": "Negotiate sealing" }, { "Value": "2", "Text": "Require sealing" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\LDAP\\LDAPClientIntegrity", "Name": "Network security: LDAP client signing requirements", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "None" }, { "Value": "1", "Text": "Negotiate signing" }, { "Value": "2", "Text": "Require signing" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinClientSec", "Name": "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients", "RegistryType": 4, "Display": "Bitmask", "Choices": [ { "Value": "524288", "Text": "Require NTLMv2 session security" }, { "Value": "536870912", "Text": "Require 128-bit encryption" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinServerSec", "Name": "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers", "RegistryType": 4, "Display": "Bitmask", "Choices": [ { "Value": "524288", "Text": "Require NTLMv2 session security" }, { "Value": "536870912", "Text": "Require 128-bit encryption" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\ClientAllowedNTLMServers", "Name": "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DCAllowedNTLMServers", "Name": "Network security: Restrict NTLM: Add server exceptions in this domain", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\AuditReceivingNTLMTraffic", "Name": "Network security: Restrict NTLM: Audit Incoming NTLM Traffic", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Disable" }, { "Value": "1", "Text": "Enable auditing for domain accounts" }, { "Value": "2", "Text": "Enable auditing for all accounts" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\AuditNTLMInDomain", "Name": "Network security: Restrict NTLM: Audit NTLM authentication in this domain", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Disable" }, { "Value": "1", "Text": "Enable for domain accounts to domain servers" }, { "Value": "3", "Text": "Enable for domain accounts" }, { "Value": "5", "Text": "Enable for domain servers" }, { "Value": "7", "Text": "Enable all" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictReceivingNTLMTraffic", "Name": "Network security: Restrict NTLM: Incoming NTLM traffic", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Allow all" }, { "Value": "1", "Text": "Deny all domain accounts" }, { "Value": "2", "Text": "Deny all accounts" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RestrictNTLMInDomain", "Name": "Network security: Restrict NTLM: NTLM authentication in this domain", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Disable" }, { "Value": "1", "Text": "Deny for domain accounts to domain servers" }, { "Value": "3", "Text": "Deny for domain accounts" }, { "Value": "5", "Text": "Deny for domain servers" }, { "Value": "7", "Text": "Deny all" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictSendingNTLMTraffic", "Name": "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Allow all" }, { "Value": "1", "Text": "Audit all" }, { "Value": "2", "Text": "Deny all" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SecurityLevel", "Name": "Recovery console: Allow automatic administrative logon", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SetCommand", "Name": "Recovery console: Allow floppy copy and access to all drives and all folders", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\SAM\\RelaxMinimumPasswordLengthLimits", "Name": "Relax minimum password length limits", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ShutdownWithoutLogon", "Name": "Shutdown: Allow system to be shut down without having to log on", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\ClearPageFileAtShutdown", "Name": "Shutdown: Clear virtual memory pagefile", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Policies\\Microsoft\\Cryptography\\ForceKeyProtection", "Name": "System cryptography: Force strong key protection for user keys stored on the computer", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "User input is not required when new keys are stored and used" }, { "Value": "1", "Text": "User is prompted when the key is first used" }, { "Value": "2", "Text": "User must enter a password each time they use a key" } ] }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FIPSAlgorithmPolicy\\Enabled", "Name": "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Kernel\\ObCaseInsensitive", "Name": "System objects: Require case insensitivity for non-Windows subsystems", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ProtectionMode", "Name": "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\SubSystems\\optional", "Name": "System settings: Optional subsystems", "RegistryType": 7, "Display": "MultiText" }, { "Key": "MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\AuthenticodeEnabled", "Name": "System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\FilterAdministratorToken", "Name": "User Account Control: Admin Approval Mode for the Built-in Administrator account", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableFullTokenForRemoteAuth", "Name": "User Account Control: Allow remote logon with elevated privileges for domain users in the local Administrators group when Administrator protection is enabled", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\RemoteAdminAllowList", "Name": "User Account Control: Allow remote logon with elevated privileges for specified domain users and groups when Administrator protection is enabled", "RegistryType": 7, "Display": "Choice" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableUIADesktopToggle", "Name": "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin", "Name": "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Elevate without prompting" }, { "Value": "1", "Text": "Prompt for credentials on the secure desktop" }, { "Value": "2", "Text": "Prompt for consent on the secure desktop" }, { "Value": "3", "Text": "Prompt for credentials" }, { "Value": "4", "Text": "Prompt for consent" }, { "Value": "5", "Text": "Prompt for consent for non-Windows binaries" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorEnhancedAdmin", "Name": "User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "1", "Text": "Prompt for credentials on the secure desktop" }, { "Value": "2", "Text": "Prompt for consent on the secure desktop" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorUser", "Name": "User Account Control: Behavior of the elevation prompt for standard users", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "0", "Text": "Automatically deny elevation requests" }, { "Value": "1", "Text": "Prompt for credentials on the secure desktop" }, { "Value": "3", "Text": "Prompt for credentials" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\TypeOfAdminApprovalMode", "Name": "User Account Control: Configure type of Admin Approval Mode", "RegistryType": 4, "Display": "Choice", "Choices": [ { "Value": "1", "Text": "Legacy Admin Approval Mode (Default)" }, { "Value": "2", "Text": "Admin Approval Mode with Administrator protection" } ] }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableInstallerDetection", "Name": "User Account Control: Detect application installations and prompt for elevation", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ValidateAdminCodeSignatures", "Name": "User Account Control: Only elevate executables that are signed and validated", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableSecureUIAPaths", "Name": "User Account Control: Only elevate UIAccess applications that are installed in secure locations", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", "Name": "User Account Control: Run all administrators in Admin Approval Mode", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop", "Name": "User Account Control: Switch to the secure desktop when prompting for elevation", "RegistryType": 4, "Display": "Boolean" }, { "Key": "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableVirtualization", "Name": "User Account Control: Virtualize file and registry write failures to per-user locations", "RegistryType": 4, "Display": "Boolean" } ] } |