Authentication Protocols¶
When a Windows machine proves who it is to another machine, it uses one of several protocols. The old ones leak enough information to crack passwords offline or to relay a login to another machine. These settings force the modern ones and restrict the rest.
Where¶
secpol.msc → Local Policies → Security Options unless noted.
LM, NTLM, and Kerberos¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 2.3.11.6 | Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM | Older responses can be captured and cracked; NTLMv2 resists that |
| 2.3.11.9 | Network security: Minimum session security for NTLM SSP based clients | Require NTLMv2 session security, Require 128-bit encryption | |
| 2.3.11.10 | Network security: Minimum session security for NTLM SSP based servers | Same | |
| 2.3.11.1 | Network security: Allow Local System to use computer identity for NTLM | Enabled | Services running as SYSTEM authenticate as the computer account instead of anonymously |
| 2.3.11.2 | Network security: Allow LocalSystem NULL session fallback | Disabled | SYSTEM won't fall back to an unauthenticated session if the computer identity fails |
| 2.3.11.3 | Network Security: Allow PKU2U authentication requests to this computer to use online identities | Disabled | No peer-to-peer authentication with Microsoft account identities |
| 2.3.11.4 | Network security: Configure encryption types allowed for Kerberos | AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types | Removes RC4 and DES from Kerberos; RC4 tickets are crackable offline |
| 2.3.11.5 | Network security: Force logoff when logon hours expire | Enabled | If the account has logon hours, the session ends when they do |
| 2.3.11.11 | Network security: Restrict NTLM: Audit Incoming NTLM Traffic | Enable auditing for all accounts | Logs every NTLM login to this machine, so you can find what still uses it |
| 2.3.11.12 | Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers | Audit all (or Deny all once nothing needs it) | Same, for logins from this machine outward |
Set the LM level from the dropdown; pick the last choice.
Password hashes¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 2.3.11.7 (rights) | Network security: Do not store LAN Manager hash value on next password change | Enabled | The LM hash is a 1980s format cracked in seconds |
| 18.4.6 | WDigest Authentication (gpedit.msc → Administrative Templates → MS Security Guide) |
Disabled | WDigest keeps the plaintext password in memory for single sign-on; tools like Mimikatz read it out. Registry: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 0. |
| 2.3.14.1 | System cryptography: Force strong key protection for user keys stored on the computer | User is prompted when the key is first used | Level 2. Private keys (certificates, EFS) prompt before use, so malware running as the user can't silently sign or decrypt. |
SMB and LDAP signing¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 2.3.8.1 | Microsoft network client: Digitally sign communications (always) | Enabled | Stops an attacker relaying this machine's SMB login to another machine |
| 2.3.8.2 | Microsoft network client: Digitally sign communications (if server agrees) | Enabled | |
| 2.3.8.3 | Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled | Some old servers ask for the password in plain text; refuse |
| 2.3.9.2 | Microsoft network server: Digitally sign communications (always) | Enabled | Same, server side |
| 2.3.9.3 | Microsoft network server: Disconnect clients when logon hours expire | Enabled | |
| 2.3.9.4 | Microsoft network server: Server SPN target name validation level | Accept if provided by client | Detects some relay attacks by checking the target name |
| 2.3.9.1 | Microsoft network server: Amount of idle time required before suspending session | 15 minutes | Idle SMB sessions get dropped |
| 2.3.11.8 | Network security: LDAP client signing requirements | Negotiate signing | LDAP queries from this machine are signed when the server supports it |
| 2.3.11.7 | Network security: LDAP client encryption requirements | Negotiate sealing | And encrypted |
| 2.3.5.x | Domain member: Digitally encrypt or sign secure channel data (always / when possible), Digitally encrypt secure channel data (when possible), Disable machine account password changes: Disabled, Maximum machine account password age: 30 days, Require strong (Windows 2000 or later) session key: Enabled | As listed | The channel between a domain member and its domain controller is signed, encrypted, and re-keyed monthly |
| 2.3.14 (Shutdown) | Shutdown: Clear virtual memory pagefile | Enabled | Passwords in memory can be swapped to disk and read later |
STIG additions¶
| STIG | Setting | Set to | Why |
|---|---|---|---|
| WN11-SO-000230 | System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing | Enabled | Only validated algorithms. Some older applications break; test before applying outside a STIG environment. |
| WN11-CC-000052 | ECC Curve Order (gpedit.msc → Network → SSL Configuration Settings) |
Enabled: NistP384 then NistP256 |
TLS prefers the longer key |
| WN11-SO-000085 | Interactive logon: Number of previous logons to cache | 10 or fewer | Cached domain credentials let a laptop log in offline; fewer cached means fewer hashes on disk to steal |
Credential delegation¶
gpedit.msc → Computer Configuration → Administrative Templates → System → Credentials Delegation:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.4.1 | Encryption Oracle Remediation | Enabled: Force Updated Clients | Refuses CredSSP connections from unpatched clients (CVE-2018-0886) |
| 18.9.4.2 | Remote host allows delegation of non-exportable credentials | Enabled | Restricted Admin and Remote Credential Guard work, so an RDP session doesn't leave reusable credentials on the remote host |
Verify¶
MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,5
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4,537395200
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4,537395200
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic=4,2
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\UseMachineId=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\allownullsessionfallback=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\pku2u\AllowOnlineID=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\SupportedEncryptionTypes=4,2147483640
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\SmbServerNameHardeningLevel=4,1
MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4,1
And:
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential
0.
Example¶
LmCompatibilityLevel=4,0 and UseLogonCredential = 1. Every share connection sends a crackable response, and every logged-in user's plaintext password sits in LSASS memory. Set the level to 5 and WDigest to 0, then restart; the password is gone from memory at next logon.