This policy setting allows users to change the size of the pagefile. By making the pagefile extremely large or extremely small, an attacker could easily affect the performance of a compromised computer.
When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local or located in Active Directory, they can be groups, users, or computers.
Fix:
(1) ...
This policy setting allows local users to be enumerated on domain-joined computers.
If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers.
If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers.
Fix:
(1) GPO: Computer Configuration\Administrative Templates\System\Logon! ...
This policy setting allows you to control whether a domain user can sign in using a PIN.
If you enable this policy setting, a domain user can set up and sign in with a PIN.
If you disable or don't configure this policy setting, a domain user can't set up and use a PIN.
Note that the user's domain password will be cached in the system vault when using this feature.
Fix:
( ...
This policy setting allows you to manage the behavior of Windows SmartScreen. Windows SmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.
If you enable this policy setting, Windows SmartScreen behavior may be controlled by setting ...
This policy setting prevents users from adding new Microsoft accounts on this computer.
If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of ...
This policy setting allows accounts to log on using the task scheduler service. Because the task scheduler is often used for administrative purposes, it may be needed in enterprise environments. However, its use should be restricted in high security environments to prevent misuse of system resources or to prevent attackers from using the right to launch malicious code after gaining user level acce ...
This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup cla ...
This policy setting helps prevent Terminal Services clients from saving passwords on a computer. Note If this policy setting was previously configured as Disabled or Not configured, any previously saved passwords will be deleted the first time a Terminal Services client disconnects from any server.
Fix:
(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop ...
This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not allow RunAs credentials to be stored for any plug-ins.
If you enable this policy setting, the WinRM service will not allow the RunAsUser or RunAsPassword configuration values to be set for any plug-ins. If a plug-in has already set the RunAsUser and RunAsPassword configuration values, the Ru ...
Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.
If you leave this policy setting enabled, Users will be able to use MSDT to collect and send diagnostic data to a support professional to resolve a problem.
By default, the support provider is set to Microsoft Corporation.
If you disable this policy setting, MSDT will not be able to run in su ...