Other Security Options¶

The remaining Security Options and a few related policies. None of them fits the earlier pages neatly, and each closes a specific hole.

Where¶

secpol.msc → Local Policies → Security Options, except where a gpedit.msc path is given.

Auditing behavior¶

CIS	Setting	Set to	Why
2.3.2.1	Audit: Force audit policy subcategory settings to override audit policy category settings	Enabled	The detailed audit policy wins over the old category settings
2.3.2.2	Audit: Shut down system immediately if unable to log security audits	Disabled	Enabled sounds safer but lets an attacker crash the machine by filling the log

System objects¶

CIS	Setting	Set to	Why
2.3.15.1	System objects: Require case insensitivity for non-Windows subsystems	Enabled	Prevents `File.txt` and `file.txt` being different objects, which some attacks rely on
2.3.15.2	System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)	Enabled	Non-admin users can't modify shared objects they didn't create

Devices¶

CIS	Setting	Set to
2.3.4.1	Devices: Prevent users from installing printer drivers	Enabled (Level 2)
2.3.4.2	Devices: Allowed to format and eject removable media	Administrators

Legacy and process hardening (MS Security Guide)¶

gpedit.msc → Computer Configuration → Administrative Templates → MS Security Guide. These need the SecGuide template from the Security Compliance Toolkit; if the folder is absent, use the registry values.

CIS	Setting	Set to	Registry	Why
18.4.1	Configure SMB v1 client driver	Enabled: Disable driver	`HKLM\SYSTEM\CurrentControlSet\Services\mrxsmb10\Start = 4`	Covered on the SMB page
18.4.2	Configure SMB v1 server	Disabled	`HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 = 0`	Same
18.4.3	Enable Certificate Padding	Enabled	`HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config\EnableCertPaddingCheck = 1`	Closes a signature-verification bypass (CVE-2013-3900)
18.4.4	Enable Structured Exception Handling Overwrite Protection (SEHOP)	Enabled	`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation = 0`	Blocks a classic exploit technique
18.4.5	NetBT NodeType configuration	Enabled: P-node	`HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\NodeType = 2`	NetBIOS uses WINS only, never broadcasts. Broadcasts are how name-poisoning attacks work.
18.4.6	WDigest Authentication	Disabled	`...\SecurityProviders\WDigest\UseLogonCredential = 0`	Covered under Authentication Protocols
18.7.8	Configure RPC packet level privacy setting for incoming connections	Enabled	`HKLM\SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled = 1`	Print spooler RPC requires encryption (CVE-2021-1678)
18.9.54	Configure the behavior of the sudo command (System)	Enabled: Disabled	`HKLM\SOFTWARE\Policies\Microsoft\Windows\Sudo\Enabled = 0`	Windows 11's `sudo` lets a normal user run elevated commands inline; off unless the organization uses it

MSS legacy settings¶

gpedit.msc → Administrative Templates → MSS (Legacy), or the registry:

CIS	Setting	Set to	Registry	Why
18.5.9	(SafeDllSearchMode) Enable Safe DLL search mode	Enabled	`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1`	System folders are searched before the current directory, so a planted DLL in a user folder isn't loaded
18.5.12	(WarningLevel) Percentage threshold for the security event log at which the system will generate a warning	Enabled: 90%	`HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel = 90`	An event fires before the log fills
18.5.1	(AutoAdminLogon)	Disabled	Covered under Sign-in Options

Group Policy processing¶

STIG	Setting	Path	Set to	Why
WN11-CC-000090	Configure registry policy processing: Process even if the Group Policy objects have not changed	`gpedit.msc` → System → Group Policy	Enabled (both boxes: do not apply during periodic background processing unticked; process even if not changed ticked)	If someone changes a policy-set registry value by hand, the next refresh puts it back instead of assuming nothing changed

Time¶

CIS	Setting	Path	Set to	Why
18.9.53.1.1	Enable Windows NTP Client	System → Windows Time Service → Time Providers	Enabled	Clocks that drift break Kerberos and make logs impossible to correlate

Apply the registry ones¶

reg add "HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f

One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:

Key	Value	Type	Data
`HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config`	`EnableCertPaddingCheck`	REG_DWORD	`1`
`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel`	`DisableExceptionChainValidation`	REG_DWORD	`0`
`HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters`	`NodeType`	REG_DWORD	`2`
`HKLM\SYSTEM\CurrentControlSet\Control\Print`	`RpcAuthnLevelPrivacyEnabled`	REG_DWORD	`1`
`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager`	`SafeDllSearchMode`	REG_DWORD	`1`
`HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security`	`WarningLevel`	REG_DWORD	`90`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\Sudo`	`Enabled`	REG_DWORD	`0`

Verify¶

MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,"0"

Try it¶

Pick any three rows, set them in secpol.msc, and find each in the secedit export by its registry path.
Read the whole Security Options list in secpol.msc once, slowly. Note the ones this site hasn't mentioned and look them up in the benchmark.

Build it¶

A secopts.reg file exported from regedit after you've set the values, which you can import on the next image and then verify with your reg query script.

Next¶

Listening Ports