Default Domain Policy Data collected on: 10/12/2012 5:28:08 PM General

Transcription

1 Default Domain Default Domain Data collected on: 10/12/2012 5:28:08 PM General Details Domain Owner Created Modified User Revisions Computer Revisions Unique ID GPO Status webrecon.local WEBRECON\Domain Admins 10/2/2012 6:17:02 AM 10/12/2012 2:37:32 PM 0 (AD), 0 (sysvol) 227 (AD), 227 (sysvol) {31B2F D-11D2-945F-00C04FB984F9} Links Location Enforced Link Status Path webrecon No webrecon.local This list only includes links in the domain of the GPO. Security Filtering The settings in this GPO can only apply to the following groups, users, and computers: Name NT AUTHORITY\Authenticated Users Delegation These groups and users have the specified permission for this GPO Name Allowed Permissions Inherited NT AUTHORITY\Authenticated Users Read (from Security Filtering) No NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No NT AUTHORITY\SYSTEM Edit settings, delete, modify security No Computer Configuration () Policies Windows s Security s Account Policies/Password Enforce password history Maximum password age Minimum password age Minimum password length Password must meet complexity requirements 24 passwords remembered 60 days 2 days 8 characters file://// /d$/webrecon/group%20policies/default%20domain%20% htm (1 of 7)10/12/2012 5:29:34 PM

2 Default Domain Store passwords using reversible encryption Account Policies/Account Lockout Account lockout duration Account lockout threshold Reset account lockout counter after 15 minutes 15 invalid logon attempts 15 minutes Account Policies/Kerberos Enforce user logon restrictions Maximum lifetime for service ticket Maximum lifetime for user ticket Maximum lifetime for user ticket renewal Maximum tolerance for computer clock synchronization 600 minutes 10 hours 7 days 5 minutes Local Policies/Security Options Interactive Logon Interactive logon: Do not display last user name Interactive logon: Do not require CTRL+ALT+DEL Interactive logon: Message text for users attempting to log on --, ---- Web Recon LLC, , AUTHORIZED ACCESS ONLY, , ---- By accessing or attempting to access the, -- networks and systems of WebRecon LLC, ---- you agree to be bound to the terms and the, conditions of the Technology Acceptable, Use Agreement (TAUA). Access to these, systems is logged and monitored., ----, -- Interactive logon: Message title for users attempting to log on Interactive logon: Prompt user to change password before expiration Interactive logon: Require Domain Controller authentication to unlock workstation Interactive logon: Smart card removal behavior "WebRecon" 3 days Lock Workstation Microsoft Network Client Microsoft network client: Digitally sign communications (always) Microsoft network client: Digitally sign communications (if server agrees) Microsoft network client: Send unencrypted password to third-party SMB servers Microsoft Network Server Microsoft network server: Amount of idle time required before suspending session Microsoft network server: Digitally sign communications (always) Microsoft network server: Digitally sign communications (if client agrees) Microsoft network server: Disconnect clients when logon hours expire 15 minutes Other file://// /d$/webrecon/group%20policies/default%20domain%20% htm (2 of 7)10/12/2012 5:29:34 PM

3 Default Domain Interactive logon: Display user information when the session is locked User display name, domain and user names Public Key Policies/Encrypting File System Certificates Issued To Issued By Expiration Date Intended Purposes Administrator Administrator 9/8/2112 6:24:25 AM File Recovery For additional information about individual settings, launch Group Object Editor. Public Key Policies/Trusted Root Certification Authorities Properties Allow users to select new root certification authorities (CAs) to trust Client computers can trust the following certificate stores To perform certificate-based authentication of users and computers, CAs must meet the following criteria Third-Party Root Certification Authorities and Enterprise Root Certification Authorities Registered in Active Directory only Windows Firewall with Advanced Security Global s version Disable stateful FTP Disable stateful PPTP IPsec exempt IPsec through NAT Preshared key encoding SA idle time Strong CRL check Domain Profile s Firewall state Inbound connections Outbound connections Apply local firewall rules Apply local connection security rules Display notifications Allow unicast responses Log dropped packets Log successful connections Log file path On Yes Yes %systemroot%\system32\logfiles\firewall\pfirewall.log Log file maximum size (KB) 8096 Connection Security s file://// /d$/webrecon/group%20policies/default%20domain%20% htm (3 of 7)10/12/2012 5:29:34 PM

4 Default Domain Administrative Templates definitions (ADMX files) retrieved from the local machine. Control Panel/User Accounts Apply the default user logon picture to all users Network/Network Connections/Windows Firewall/Domain Profile Windows Firewall: Allow ICMP exceptions Windows Firewall: Allow inbound file and printer sharing exception Allow unsolicited incoming messages from these IP addresses: Syntax: Type "*" to allow messages from any network, or else type a comma-separated list that contains any number or combination of these: IP addresses, such as Subnet descriptions, such as /24 The string "localsubnet" Example: to allow messages from , , and from any system on the local subnet or on the x subnet, type the following in the "Allow unsolicited" incoming messages from these IP addresses": , ,localsubnet, /24 Windows Firewall: Allow inbound remote administration exception Allow unsolicited incoming messages from these IP addresses: Syntax: Type "*" to allow messages from any network, or else type a comma-separated list that contains any number or combination of these: IP addresses, such as Subnet descriptions, such as /24 The string "localsubnet" Example: to allow messages from , , and from any system on the local subnet or on the x subnet, type the following in the "Allow unsolicited" incoming messages from these IP addresses": , ,localsubnet, /24 Windows Firewall: Allow inbound Remote Desktop exceptions file://// /d$/webrecon/group%20policies/default%20domain%20% htm (4 of 7)10/12/2012 5:29:34 PM

5 Default Domain Allow unsolicited incoming messages from these IP addresses: Syntax: Type "*" to allow messages from any network, or else type a comma-separated list that contains any number or combination of these: IP addresses, such as Subnet descriptions, such as /24 The string "localsubnet" Example: to allow messages from , , and from any system on the local subnet or on the x subnet, type the following in the "Allow unsolicited" incoming messages from these IP addresses": , ,localsubnet, /24 Windows Firewall: Allow local port exceptions Windows Firewall: Allow local program exceptions Windows Firewall: Allow logging Log dropped packets Log successful connections Log file path and name: %systemroot%\system32\logfiles\firewall\pfirewall.log Size limit (KB): 8096 Windows Firewall: Protect all network connections Network/Network Connections/Windows Firewall/Standard Profile Windows Firewall: Protect all network connections Windows Components/AutoPlay Policies Turn off Autoplay Turn off Autoplay on: All drives Windows Components/Desktop Gadgets Restrict unpacking and installation of gadgets that are not digitally signed. Windows Components/Event Log Service/Application \\WRECON-2008AD\SystemLogs\EventViewer\App\Application.evtx file://// /d$/webrecon/group%20policies/default%20domain%20% htm (5 of 7)10/12/2012 5:29:34 PM

6 Default Domain Windows Components/Event Log Service/Security \\WRECON-2008AD\SystemLogs\EventViewer\Security\Security.evtx Windows Components/Event Log Service/Setup \\WRECON-2008AD\SystemLogs\EventViewer\Setup\Setup.evtx Turn on logging Windows Components/Event Log Service/System \\WRECON-2008AD\SystemLogs\EventViewer\System\System.evtx Windows Components/Internet Explorer Prevent "Fix settings" functionality Prevent performance of First Run Customize settings Select your choice Go directly to home page file://// /d$/webrecon/group%20policies/default%20domain%20% htm (6 of 7)10/12/2012 5:29:34 PM

7 Default Domain Turn off Reopen Last Browsing Session Turn on menu bar by default Windows Components/Windows Logon Options Display information about previous logons during user logon Report when logon server was not available during user logon Preferences Control Panel s Power Options Power Plan (Windows Vista) (Name: High performance) Power Plan (Windows Vista and later) (Order: 1) Properties Action Make this the active Power Plan: Name Update High performance When computer is: Plugged in Running on batteries Require a password on wakeup: Yes Yes Turn off hard disk after: Never Never Allow hybrid sleep: Off Off Hibernate after: Never Never Lid close action: Sleep Sleep Power button action: Shutdown Shutdown Start menu power button: Hibernate Hibernate Link State Power Management: Off Off Minimum processor state: After 100 minutes After 5 minutes Maximum processor state: After 100 minutes After 100 minutes Turn off display after: After 15 minutes After 10 minutes Adaptive display: On On Critical battery action: Do nothing Hibernate Low battery level: After 10 minutes After 10 minutes Critical battery level: After 5 minutes After 5 minutes Low battery notification: Off Off Low battery action: Do nothing Do nothing Common Options Stop processing items on this extension if an error occurs on this item Remove this item when it is no longer applied Apply once and do not reapply No No No User Configuration () No settings defined. file://// /d$/webrecon/group%20policies/default%20domain%20% htm (7 of 7)10/12/2012 5:29:34 PM