Questions tagged [group-policy]
Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an Active Directory environment.
27
questions
0
votes
0
answers
73
views
Difference between running executable from disk vs removable media
I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
0
votes
1
answer
323
views
Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access
My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
4
votes
1
answer
518
views
Why did Microsoft publish the CPassword AES key ca. 2012?
As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more.
...
0
votes
0
answers
123
views
Apply policy to specific users OR computers
I was directed to post my question here from stackoverflow.
Need some guidance implementing a policy. Specifically a block removable storage policy.
Let's say I have 100 computers named PC1-PC100. PC1-...
3
votes
1
answer
797
views
Risk around "Allow log on locally" for Domain Service Accounts
My organisation mandated that Windows Domain Service accounts internally should not have the "Allow log on locally" permission, and essentially be non-interactive.
What exactly is the potential risk ...
0
votes
2
answers
432
views
Preventing Users from Using QR Code Password and Scanner for Authentication [duplicate]
A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user:
Provides their username
Scans the QR code with a handheld ...
2
votes
1
answer
99
views
Multi-business data sharing and trust issues
Is there a way to establish data sharing between multiple (a couple dozen) businesses where it is the case that some companies don't trust others?
This means that these companies are willing to share ...
1
vote
1
answer
635
views
How to prevent USB Block Policy to be circumvented?
I know that I can disable USB devices using group policy for the computers of my company. What I want to achieve is allow users to use the USB port only for charging their phones, connect their mouse ...
1
vote
2
answers
11k
views
How to verify if a RADIUS server certificate is really validated on Windows 10?
A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?)
The self-...
1
vote
2
answers
132
views
Win10 Group Policy - Allow specific programs to run: Protection from malware?
In Windows 10 group policy editor you can restrict and allow only certain programs to run.
I'm wondering if that protects against malware? I can think of following cases:
1) If you start a program ...
3
votes
1
answer
2k
views
'Continue experiences on this device' group policy
In an enterprise or office setting, should I set 'Continue experiences on this device' under the group policy to be disabled? Why should I set it to be disabled, or why shouldn't I set it to be ...
2
votes
1
answer
103
views
Block AzureRM PowerShell Module
Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
0
votes
1
answer
104
views
confirm? group policy is not a reliable way to make a program run on a user's computer
I know very little about Windows domains and Group Policy. However, if you use Group Policy to set a requirement that PCs joining your domain have to download and run a program, then by default that ...
1
vote
0
answers
141
views
Accessing SNTP MD5 Authorized Time Sync Server through GPO
I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
3
votes
0
answers
119
views
What options exist for logging off users after x time of inactivity? [closed]
I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in.
Things I've thought about trying:
...
6
votes
3
answers
1k
views
Group Policy - Best Practice for Default Security Settings
I am currently working on hardening our Windows OS systems. I'm reviewing guidance from CIS and Microsoft Security Compliance Manager. What I have found is that many of the security settings are ...
9
votes
1
answer
408
views
Will enforcing this restriction on Domain Admins "break the network"?
Let's say we secure all servers in the domain..
Domain controllers allow RDP access only from jump servers
Domain admins can't connect to non-dc servers
And so forth
This is all swell and should be ...
2
votes
2
answers
5k
views
Missing Powershell Logging Options in Group Policy Editor
I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
0
votes
3
answers
2k
views
Why is task manager often disabled on managed computers?
Many managed(e.g. school, government) computers disable windows task manager. In the case of school computers, the computer often allows arbitrary programs to be run, can allow batch files, and ...
1
vote
1
answer
131
views
Is this a "standard" security policy?
For our development we work primarily on AWS. We have data on S3 with varying levels of security, prod, integration, development, etc.
When working with data, we often have to run ad-hoc analysis. ...
1
vote
0
answers
140
views
Cannot disable read access the Windows 7 security log
So we have some Windows 7 systems with some security requirements. I am trying to disable read access the security log. The command “wevtutil gl security” shows a result of the following:
...
6
votes
1
answer
5k
views
Should the "Users" group be removed from Windows Servers "Allow log on locally" Security GPO setting?
I know by default RDP does not allow any non-admin user to RDP into a machine unless we specify it. But a non-admin user can logon to the machine at the console.
I was looking at the "Allow log on ...
2
votes
1
answer
237
views
How do I audit the effect of security policy on a computer?
I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
6
votes
2
answers
3k
views
Python security hardening
I’m working for a large organization which is using some Windows products that require python to work.
Python is used to execute built in utility scripts and the user never recognizes that python is ...
2
votes
2
answers
3k
views
ByPass usb GPO with iphone -and probably other mobile-
So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's.
I have access to local user without privs.
Although my usb stick ...
2
votes
2
answers
7k
views
Safe user/group for rsyslog to read application log?
I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody
What exactly is nobody:...
16
votes
3
answers
89k
views
Windows groups and permissions: Authenticated Users group meaning
What is the purpose of the "Authenticated Users" group in Windows?
Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...