Questions tagged [group-policy]

Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an Active Directory environment.

Filter by
Sorted by
Tagged with
3 votes
1 answer
62 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
user avatar
0 votes
0 answers
90 views

Apply policy to specific users OR computers

I was directed to post my question here from stackoverflow. Need some guidance implementing a policy. Specifically a block removable storage policy. Let's say I have 100 computers named PC1-PC100. PC1-...
user avatar
3 votes
1 answer
348 views

Risk around "Allow log on locally" for Domain Service Accounts

My organisation mandated that Windows Domain Service accounts internally should not have the "Allow log on locally" permission, and essentially be non-interactive. What exactly is the potential risk ...
user avatar
0 votes
2 answers
197 views

Preventing Users from Using QR Code Password and Scanner for Authentication [duplicate]

A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user: Provides their username Scans the QR code with a handheld ...
user avatar
2 votes
1 answer
82 views

Multi-business data sharing and trust issues

Is there a way to establish data sharing between multiple (a couple dozen) businesses where it is the case that some companies don't trust others? This means that these companies are willing to share ...
user avatar
  • 121
1 vote
1 answer
369 views

How to prevent USB Block Policy to be circumvented?

I know that I can disable USB devices using group policy for the computers of my company. What I want to achieve is allow users to use the USB port only for charging their phones, connect their mouse ...
user avatar
  • 329
1 vote
2 answers
6k views

How to verify if a RADIUS server certificate is really validated on Windows 10?

A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?) The self-...
user avatar
  • 15.9k
1 vote
2 answers
103 views

Win10 Group Policy - Allow specific programs to run: Protection from malware?

In Windows 10 group policy editor you can restrict and allow only certain programs to run. I'm wondering if that protects against malware? I can think of following cases: 1) If you start a program ...
user avatar
3 votes
1 answer
1k views

'Continue experiences on this device' group policy

In an enterprise or office setting, should I set 'Continue experiences on this device' under the group policy to be disabled? Why should I set it to be disabled, or why shouldn't I set it to be ...
user avatar
2 votes
1 answer
76 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
user avatar
0 votes
1 answer
78 views

confirm? group policy is not a reliable way to make a program run on a user's computer

I know very little about Windows domains and Group Policy. However, if you use Group Policy to set a requirement that PCs joining your domain have to download and run a program, then by default that ...
user avatar
  • 653
1 vote
0 answers
108 views

Accessing SNTP MD5 Authorized Time Sync Server through GPO

I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
user avatar
  • 151
3 votes
0 answers
101 views

What options exist for logging off users after x time of inactivity? [closed]

I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in. Things I've thought about trying: ...
user avatar
6 votes
3 answers
1k views

Group Policy - Best Practice for Default Security Settings

I am currently working on hardening our Windows OS systems. I'm reviewing guidance from CIS and Microsoft Security Compliance Manager. What I have found is that many of the security settings are ...
user avatar
  • 171
9 votes
1 answer
373 views

Will enforcing this restriction on Domain Admins "break the network"?

Let's say we secure all servers in the domain.. Domain controllers allow RDP access only from jump servers Domain admins can't connect to non-dc servers And so forth This is all swell and should be ...
user avatar
  • 1,530
2 votes
2 answers
5k views

Missing Powershell Logging Options in Group Policy Editor

I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
user avatar
  • 303
0 votes
3 answers
2k views

Why is task manager often disabled on managed computers?

Many managed(e.g. school, government) computers disable windows task manager. In the case of school computers, the computer often allows arbitrary programs to be run, can allow batch files, and ...
user avatar
  • 344
1 vote
1 answer
112 views

Is this a "standard" security policy?

For our development we work primarily on AWS. We have data on S3 with varying levels of security, prod, integration, development, etc. When working with data, we often have to run ad-hoc analysis. ...
user avatar
1 vote
0 answers
104 views

Cannot disable read access the Windows 7 security log

So we have some Windows 7 systems with some security requirements. I am trying to disable read access the security log. The command “wevtutil gl security” shows a result of the following: ...
user avatar
6 votes
1 answer
5k views

Should the "Users" group be removed from Windows Servers "Allow log on locally" Security GPO setting?

I know by default RDP does not allow any non-admin user to RDP into a machine unless we specify it. But a non-admin user can logon to the machine at the console. I was looking at the "Allow log on ...
user avatar
  • 503
2 votes
1 answer
222 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
user avatar
5 votes
2 answers
2k views

Python security hardening

I’m working for a large organization which is using some Windows products that require python to work. Python is used to execute built in utility scripts and the user never recognizes that python is ...
user avatar
  • 51
2 votes
2 answers
2k views

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
user avatar
2 votes
2 answers
7k views

Safe user/group for rsyslog to read application log?

I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody What exactly is nobody:...
user avatar
15 votes
3 answers
85k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...
user avatar
  • 680