3/20/ :47:14 AM 12/13/ :05:38 AM

Transcription

1 Policy Data collected on: 12/19/ :10:47 PM General Details Domain Owner Created Modified User Revisions Computer Revisions 3/20/ :47:14 AM 12/13/ :05:38 AM 175 (AD), 175 (sysvol) 66 (AD), 66 (sysvol) Links GPO Status Location Enforced Link Status Path Security Filtering The settings in this GPO can only apply to the following groups, users, and computers: Name WMI Filtering NT AUTHORITY\Authenticated Users WMI Filter Name None Description Not applicable Delegation These groups and users have the specified permission for this GPO Name Allowed Permissions Inherited \Domain Admins Edit settings, delete, modify security No \Enterprise Admins Edit settings, delete, modify security No NT AUTHORITY\Authenticated Users Read (from Security Filtering) No NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No

2 NT AUTHORITY\SYSTEM Edit settings, delete, modify security No Computer Configuration () Policies Windows Settings Security Settings Account Policies/Password Policy Policy Enforce password history Maximum password age Minimum password age Minimum password length Password must meet complexity requirements System Services Remote Registry (Startup Mode: Automatic) Permissions No permissions specified Setting 9 passwords remembered 90 days 0 days 8 characters Auditing No auditing specified Administrative Templates Policy definitions (ADMX files) retrieved from the central store. Network/Link-Layer Topology Discovery Turn on Mapper I/O (LLTDIO) driver Allow operation while in domain Allow operation while in public network Prohibit operation while in private network System/Logon Always wait for the network at computer startup and logon Windows Components/Windows Update Configure Automatic Updates No auto-restart with logged on users for d Preferences scheduled automatic updates installations Control Panel Settings

3 Services Service (name: RemoteRegistry) RemoteRegistry (order: 1) General Action Startup type: Wait timeout if service is locked: Service Account Log on service as: Start service Automatic 30 seconds No change Recovery First failure: No change Second failure: No change Subsequent failures: No change Common Options Stop processing items on this extension if an error occurs on this item No Remove this item when it is no longer applied No Apply once and do not reapply No User Configuration () Policies Windows Settings Scripts Logon Name Parameters \\\SysVol\\scripts\login.bat Internet Explorer Maintenance Connection/Connection Settings This GPO contains connection settings. Security/Security Zones and Content Ratings Security Zones and Privacy These settings will not apply to users that log on to computers that have the Internet Explorer Enhanced Security Configuration (ESC) enabled. To create settings for users on computers that have ESC enabled, create a new GPO and edit that GPO on a computer where ESC is enabled. Internet (Security Level: Medium-high).NET Framework-reliant components Run components not signed with Authenticode Run components signed with Authenticode

4 ActiveX controls and plug-ins Download signed ActiveX controls Download unsigned ActiveX controls Initialize and script ActiveX controls not marked as safe Run ActiveX controls and plug-ins Script ActiveX controls marked safe for scripting Downloads File download Font download Microsoft VM Java permissions High safety Miscellaneous Access data sources across domains Allow META REFRESH Display mixed content Don't prompt for client certificate selection when no certificates or only one certificate exists Drag and drop or copy and paste files Installation of desktop items Launching applications and unsafe files Launching programs and files in an IFRAME Navigate sub-frames across different domains Software channel permissions Medium safety Submit nonencrypted form data Userdata persistence Scripting Active scripting Allow paste operations via script

5 Scripting of Java applets User Authentication Logon Automatic logon only in Intranet zone Local intranet (Security Level: Custom).NET Framework-reliant components Run components not signed with Authenticode Run components signed with Authenticode ActiveX controls and plug-ins Download signed ActiveX controls Download unsigned ActiveX controls Initialize and script ActiveX controls not marked as safe Run ActiveX controls and plug-ins Script ActiveX controls marked safe for scripting Downloads File download Font download Microsoft VM Java permissions Medium safety Miscellaneous Access data sources across domains Allow META REFRESH Display mixed content Don't prompt for client certificate selection when no certificates or only one certificate exists Drag and drop or copy and paste files Installation of desktop items Launching applications and unsafe files Launching programs and files in an IFRAME Navigate sub-frames across different domains

6 Software channel permissions Medium safety Submit nonencrypted form data Userdata persistence Scripting Active scripting Allow paste operations via script Scripting of Java applets User Authentication Logon Automatic logon only in Intranet zone Sites Require server verification ( for all sites in this zone d Include all local (intranet) sites not listed in other zones d Include all sites that bypass the proxy server d Include all network paths (UNCs) d Sites in this zone None Trusted sites (Security Level: Medium).NET Framework-reliant components Run components not signed with Authenticode Run components signed with Authenticode ActiveX controls and plug-ins Download signed ActiveX controls Download unsigned ActiveX controls Initialize and script ActiveX controls not marked as safe Run ActiveX controls and plug-ins Script ActiveX controls marked safe for scripting Downloads File download

7 Font download Microsoft VM Java permissions High safety Miscellaneous Access data sources across domains Allow META REFRESH Display mixed content Don't prompt for client certificate selection when no certificates or only one certificate exists Drag and drop or copy and paste files Installation of desktop items Launching applications and unsafe files Launching programs and files in an IFRAME Navigate sub-frames across different domains Software channel permissions Medium safety Submit nonencrypted form data Userdata persistence Scripting Active scripting Allow paste operations via script Scripting of Java applets User Authentication Logon Automatic logon only in Intranet zone Restricted sites (Security Level: High).NET Framework-reliant components Run components not signed with Authenticode Run components signed with Authenticode ActiveX controls and plug-ins Download signed ActiveX controls

8 Download unsigned ActiveX controls Initialize and script ActiveX controls not marked as safe Run ActiveX controls and plug-ins Script ActiveX controls marked safe for scripting Downloads File download Font download Microsoft VM Java permissions Java Miscellaneous Access data sources across domains Allow META REFRESH Display mixed content Don't prompt for client certificate selection when no certificates or only one certificate exists Drag and drop or copy and paste files Installation of desktop items Launching applications and unsafe files Launching programs and files in an IFRAME Navigate sub-frames across different domains Software channel permissions High safety Submit nonencrypted form data Userdata persistence Scripting Active scripting Allow paste operations via script Scripting of Java applets User Authentication

9 Logon for user name and password Sites Sites in this zone None Privacy Privacy Level Medium Web Sites Always allow None Always block None Administrative Templates Policy definitions (ADMX files) retrieved from the central store. Control Panel Prohibit access to the Control Panel Control Panel/Personalization Password protect the screen saver Prevent changing desktop background Screen saver timeout Number of seconds to wait to enable the screen saver Seconds: 600 Desktop/Desktop Allow only bitmapped wallpaper Desktop Wallpaper Wallpaper Name: c:\windows\ Wallpaper.bmp Example: Using a local path: C:\windows\web\wallpaper\home.jpg Example: Using a UNC path: \\Server\Share\Corp.jpg Wallpaper Style: Stretch

10 Active Desktop Disallows HTML and Jpg Wallpaper all items Active Desktop d Prohibit changes Microsoft Access 2010/Application Settings/Security/Trust Center/Trusted Locations Allow Trusted Locations on the network Trusted Location #1 Path: \\****\Common\Pride Forms Date: Description: Allow sub folders: d Microsoft Office Access 2007/Application Settings/Security/Trust Center/Trusted Locations Allow Trusted Locations not on the computer Trusted Location #1 Path: \\****\Common\Pride Forms Date: Description: On the Spot Allow sub folders: d Microsoft Office Outlook 2007/Tools Account Settings/Exchange/Cached Exchange Mode Use Cached Exchange Mode for new and d existing Outlook profiles Microsoft Office Outlook 2007/Tools Options.../Preferences/ Options/Tracking Options Options

11 Process requests and responses on arrival Process receipts on arrival Delete blank voting and meeting responses after processing d Request a read receipt for all messages a user sends d Request delivery rcpt for all msgs a user sends (Exchange only) d When Outlook is asked to respond to a read receipt request: Always send a response Microsoft Outlook 2010/Account Settings/Exchange/Cached Exchange Mode Use Cached Exchange Mode for new and d existing Outlook profiles Microsoft Outlook 2010/Outlook Options/Preferences/ Options/Tracking Options Options Process requests and responses on arrival Process receipts on arrival Delete blank voting and meeting responses after processing d Request a read receipt for all messages a user sends d Request delivery rcpt for all msgs a user sends (Exchange only) d When Outlook is asked to respond to a read receipt request: Always send a response Network/Network Connections Prohibit access to the New Connection Wizard Start Menu and Taskbar Force classic Start Menu Remove Default Programs link from the Start menu. Remove Games link from Start Menu

12 Remove Help menu from Start Menu Remove Network Connections from Start Menu Remove Run menu from Start Menu Remove the Action Center icon System Don't run specified Windows applications List of disallowed applications a2009.exe aim6.exe Antivirus2009.exe AntivirusPro2009.exe av2009.exe av2009[1].exe AV2009Install.exe AV2009Install[1].exe AV2009Install_880405[1].exe AV2009Install_880405[2].exe CarbonitePreinstaller.exe cha-ching!.exe ChromeSetup.exe Firefox Setup exe Google_Updater.exe ieexplorer32.exe incredimail.exe install.exe

13 Install_AIM.exe ituneshelper.exe MSA.cpl MSA.exe MSASetup.exe msconfig.exe msgr8us.exe msmsgs.exe msnmsgr.exe MSx.exe MWSOEMON.EXE myspaceim.exe OOo_3.0.1_Win32Intel_install_wJRE_en-US.exe pokerstarsupdate.exe Power-Antivirus-2009.exe rstrui.exe Safari.exe SafariSetup.exe setup.exe tune.exe Windows6.0-KB x86.msu WindowsXP-KB SP3-x86-ENU.exe wlsetup-custom.exe YahooMessenger.exe

14 Prevent access to registry editing tools regedit from running silently? Yes Windows Components/Desktop Gadgets Turn off desktop gadgets Windows Components/Desktop Window Manager Do not allow window animations Windows Components/Internet Explorer d AutoComplete for forms changing Advanced page settings changing home page settings Home Page Do not allow users to enable or disable add-ons Prevent participation in the Customer Experience Improvement Program Prevent performance of First Run Customize settings Select your choice Go directly to home page Windows Components/Internet Explorer/Browser menus Help menu: Remove 'For Netscape Users' menu option Windows Components/Internet Explorer/Internet Control Panel the Connections page the Content page the Programs page Windows Components/Internet Explorer/Internet Control Panel/Security Page

15 Site to Zone Assignment List Enter the zone assignments here. ********** 2 Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone Download unsigned ActiveX controls Download unsigned ActiveX controls Windows Components/Internet Explorer/Toolbars customizing browser toolbars Windows Components/Windows Explorer Hides the Manage item on the Windows Explorer context menu Windows Components/Windows Explorer/Previous Versions Hide previous versions list for local files Hide previous versions list for remote files Hide previous versions of files on backup location Windows Components/Windows Messenger Do not allow Windows Messenger to be run Do not automatically start Windows Messenger initially Windows Components/Windows Update Remove access to use all Windows Update features Configure notifications: Preferences Control Panel Settings

16 Power Options Power Scheme (name: Home/Office Desk) Home/Office Desk (order: 1) Properties Action Make this the active Power Scheme: Update When computer is: Plugged in Running on batteries Turn off monitor: After 30 minutes After 5 minutes Turn off hard disks: Never After 10 minutes System standby: Never After 5 minutes System hibernates: Never After 20 minutes Common Options Stop processing items on this extension if an error occurs on this item No Run in logged-on user's security context (user policy option) No Remove this item when it is no longer applied No Apply once and do not reapply No