Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [group-policy]

The tag has no usage guidance.

0
votes
1answer
36 views

How to verify if a RADIUS server certificate is really validated on Windows 10?

A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?) The self-...
1
vote
2answers
40 views

Win10 Group Policy - Allow specific programs to run: Protection from malware?

In Windows 10 group policy editor you can restrict and allow only certain programs to run. I'm wondering if that protects against malware? I can think of following cases: 1) If you start a program ...
0
votes
1answer
27 views

'Continue experiences on this device' group policy

In an enterprise or office setting, should I set 'Continue experiences on this device' under the group policy to be disabled? Why should I set it to be disabled, or why shouldn't I set it to be ...
1
vote
1answer
32 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
0
votes
1answer
35 views

confirm? group policy is not a reliable way to make a program run on a user's computer

I know very little about Windows domains and Group Policy. However, if you use Group Policy to set a requirement that PCs joining your domain have to download and run a program, then by default that ...
1
vote
0answers
38 views

Accessing SNTP MD5 Authorized Time Sync Server through GPO

I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
3
votes
0answers
53 views

What options exist for logging off users after x time of inactivity? [closed]

I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in. Things I've thought about trying: ...
6
votes
3answers
1k views

Group Policy - Best Practice for Default Security Settings

I am currently working on hardening our Windows OS systems. I'm reviewing guidance from CIS and Microsoft Security Compliance Manager. What I have found is that many of the security settings are ...
9
votes
1answer
286 views

Will enforcing this restriction on Domain Admins “break the network”?

Let's say we secure all servers in the domain.. Domain controllers allow RDP access only from jump servers Domain admins can't connect to non-dc servers And so forth This is all swell and should be ...
2
votes
2answers
3k views

Missing Powershell Logging Options in Group Policy Editor

I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
0
votes
3answers
555 views

Why is task manager often disabled on managed computers?

Many managed(e.g. school, government) computers disable windows task manager. In the case of school computers, the computer often allows arbitrary programs to be run, can allow batch files, and ...
1
vote
1answer
78 views

Is this a “standard” security policy?

For our development we work primarily on AWS. We have data on S3 with varying levels of security, prod, integration, development, etc. When working with data, we often have to run ad-hoc analysis. ...
1
vote
0answers
53 views

Cannot disable read access the Windows 7 security log

So we have some Windows 7 systems with some security requirements. I am trying to disable read access the security log. The command “wevtutil gl security” shows a result of the following: ...
6
votes
1answer
4k views

Should the “Users” group be removed from Windows Servers “Allow log on locally” Security GPO setting?

I know by default RDP does not allow any non-admin user to RDP into a machine unless we specify it. But a non-admin user can logon to the machine at the console. I was looking at the "Allow log on ...
3
votes
1answer
183 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
3
votes
2answers
1k views

Python security hardening

I’m working for a large organization which is using some Windows products that require python to work. Python is used to execute built in utility scripts and the user never recognizes that python is ...
2
votes
2answers
2k views

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
2
votes
2answers
5k views

Safe user/group for rsyslog to read application log?

I have an application which writes a logfile in /var/app/applog.log. This application has to be launched as root, but runs as app:app and can also be demoted to nobody:nobody What exactly is nobody:...
11
votes
2answers
50k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...