Other Security Options
The remaining Security Options and a few related policies. None of them fits the earlier pages neatly, and each closes a specific hole.
Where
secpol.msc → Local Policies → Security Options, except where a gpedit.msc path is given.
Auditing behavior
| CIS |
Setting |
Set to |
Why |
| 2.3.2.1 |
Audit: Force audit policy subcategory settings to override audit policy category settings |
Enabled |
The detailed audit policy wins over the old category settings |
| 2.3.2.2 |
Audit: Shut down system immediately if unable to log security audits |
Disabled |
Enabled sounds safer but lets an attacker crash the machine by filling the log |
System objects
| CIS |
Setting |
Set to |
Why |
| 2.3.15.1 |
System objects: Require case insensitivity for non-Windows subsystems |
Enabled |
Prevents File.txt and file.txt being different objects, which some attacks rely on |
| 2.3.15.2 |
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) |
Enabled |
Non-admin users can't modify shared objects they didn't create |
Devices
| CIS |
Setting |
Set to |
| 2.3.4.1 |
Devices: Prevent users from installing printer drivers |
Enabled (Level 2) |
| 2.3.4.2 |
Devices: Allowed to format and eject removable media |
Administrators |
Legacy and process hardening (MS Security Guide)
gpedit.msc → Computer Configuration → Administrative Templates → MS Security Guide. These need the SecGuide template from the Security Compliance Toolkit; if the folder is absent, use the registry values.
| CIS |
Setting |
Set to |
Registry |
Why |
| 18.4.1 |
Configure SMB v1 client driver |
Enabled: Disable driver |
HKLM\SYSTEM\CurrentControlSet\Services\mrxsmb10\Start = 4 |
Covered on the SMB page |
| 18.4.2 |
Configure SMB v1 server |
Disabled |
HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 = 0 |
Same |
| 18.4.3 |
Enable Certificate Padding |
Enabled |
HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config\EnableCertPaddingCheck = 1 |
Closes a signature-verification bypass (CVE-2013-3900) |
| 18.4.4 |
Enable Structured Exception Handling Overwrite Protection (SEHOP) |
Enabled |
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation = 0 |
Blocks a classic exploit technique |
| 18.4.5 |
NetBT NodeType configuration |
Enabled: P-node |
HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\NodeType = 2 |
NetBIOS uses WINS only, never broadcasts. Broadcasts are how name-poisoning attacks work. |
| 18.4.6 |
WDigest Authentication |
Disabled |
...\SecurityProviders\WDigest\UseLogonCredential = 0 |
Covered under Authentication Protocols |
| 18.7.8 |
Configure RPC packet level privacy setting for incoming connections |
Enabled |
HKLM\SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled = 1 |
Print spooler RPC requires encryption (CVE-2021-1678) |
| 18.9.54 |
Configure the behavior of the sudo command (System) |
Enabled: Disabled |
HKLM\SOFTWARE\Policies\Microsoft\Windows\Sudo\Enabled = 0 |
Windows 11's sudo lets a normal user run elevated commands inline; off unless the organization uses it |
MSS legacy settings
gpedit.msc → Administrative Templates → MSS (Legacy), or the registry:
| CIS |
Setting |
Set to |
Registry |
Why |
| 18.5.9 |
(SafeDllSearchMode) Enable Safe DLL search mode |
Enabled |
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1 |
System folders are searched before the current directory, so a planted DLL in a user folder isn't loaded |
| 18.5.12 |
(WarningLevel) Percentage threshold for the security event log at which the system will generate a warning |
Enabled: 90% |
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel = 90 |
An event fires before the log fills |
| 18.5.1 |
(AutoAdminLogon) |
Disabled |
Covered under Sign-in Options |
|
Group Policy processing
| STIG |
Setting |
Path |
Set to |
Why |
| WN11-CC-000090 |
Configure registry policy processing: Process even if the Group Policy objects have not changed |
gpedit.msc → System → Group Policy |
Enabled (both boxes: do not apply during periodic background processing unticked; process even if not changed ticked) |
If someone changes a policy-set registry value by hand, the next refresh puts it back instead of assuming nothing changed |
Time
| CIS |
Setting |
Path |
Set to |
Why |
| 18.9.53.1.1 |
Enable Windows NTP Client |
System → Windows Time Service → Time Providers |
Enabled |
Clocks that drift break Kerberos and make logs impossible to correlate |
Apply the registry ones
reg add "HKLM\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v NodeType /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v WarningLevel /t REG_DWORD /d 90 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Sudo" /v Enabled /t REG_DWORD /d 0 /f
Verify
MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,"0"
Next
Listening Ports