Description:This policy setting controls whether winlogon sends Multiple Provider Router (MPR) notifications. MPR handles communication between the Windows operating system and the installed network providers. MPR checks the registry to determine which providers are installed on the system and the order they are cycled through. MPR is a legacy utility that provides notifications to registered credential managers or network providers when there is a logon event or a password change event. Although this functionality can be used by legitimate applications, it can also be abused by attackers to harvest logon information. The recommended state for this setting is: Disabled. Default Value: Enabled. (Winlogon sends MPR notifications if a credential manager is configured.) Fix: To establish the recommended configuration via GP, set the following UI path to Disabled: (1) GPO: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Logon Options\Enable MPR notifications for the system (2) REG: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System!EnableMPR

[Enabled/Disabled]

(1) GPO: Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Logon Options\\Enable MPR notifications for the system (2) REG: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System!EnableMPR