4 votes
Accepted

Preventing Users from Using QR Code Password and Scanner for Authentication

This is not really a technical problem but a usability problem. If you have a password policy which requires unique and unguessable passwords and maybe regular changes then users need to find a way to ...
Steffen Ullrich's user avatar
3 votes
Accepted

'Continue experiences on this device' group policy

This policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences). If you enable this policy setting, the Windows device is ...
vidarlo's user avatar
  • 16.1k
3 votes
Accepted

Missing Powershell Logging Options in Group Policy Editor

You'll need to update your Group Policy administrative templates (the best way to maintain this is to have a centralized ADMX template store on your DCs). Download the most up to date templates from ...
claidheamh's user avatar
2 votes

Why is task manager often disabled on managed computers?

In order to understand why they are doing this, it is best to go into the manager's shoes. I would disable everything except for the programs and utilities that the students etc. need, no more, no ...
dGRAMOP's user avatar
  • 280
2 votes

Group Policy - Best Practice for Default Security Settings

From the Microsoft perspective, I can tell you that this is something that the team responsible for publishing the security configuration baselines has changed position on over the years. In the past, ...
Xander's user avatar
  • 35.8k
2 votes

Will enforcing this restriction on Domain Admins "break the network"?

The ESAE (Red) Forest is now the goto recommendation for securing Active Directory. https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/securing-privileged-...
Andrew Alaniz's user avatar
2 votes

Multi-business data sharing and trust issues

That's pretty classical public-key infrastructure. All businesses have a secret private key, and a public key that matches that. You can encrypt a dataset with the public key of a single business, ...
Marcus Müller's user avatar
2 votes
Accepted

How to prevent USB Block Policy to be circumvented?

This is one of those "I want to install a lock that will keep out all burglars" type of questions. The short answer is that you can install policies that will keep most of your honest users honest, ...
spuck's user avatar
  • 144
2 votes
Accepted

Win10 Group Policy - Allow specific programs to run: Protection from malware?

Generally, using an application whitelist will not only restrict what apps the user can directly launch, but also what apps the whitelisted apps can launch (after all, explorer.exe - the Windows ...
CBHacking's user avatar
  • 48.4k
2 votes
Accepted

Why did Microsoft publish the CPassword AES key ca. 2012?

Given the Group Policy implementation stores the password using encryption (instead of hashes), any code applying the Policy must have the key to decrypt the password. Once someone has realised this, ...
billc.cn's user avatar
  • 3,926
1 vote

Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access

Changing how a USB device identifies itself is easy, at least with microcontroller-based devices (you may have noticed that phones often have multiple options, such as charge only, mass storage, MTP, ...
CBHacking's user avatar
  • 48.4k
1 vote

Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access

is there a way to alter how a device declares itself to the operating system (and how)? Yes, the storage device may say it's a printer, and Windows will talk to it as if it is a printer. This usually ...
ThoriumBR's user avatar
  • 54.1k
1 vote

Risk around "Allow log on locally" for Domain Service Accounts

It is difficult to give specifics of attack paths with the limited information you have provided, however The documentation you cite states: Vulnerability Any account with the Allow log on locally ...
meowcat's user avatar
  • 1,359
1 vote
Accepted

Block AzureRM PowerShell Module

To my knowledge, Azure Resource Manager PowerShell scripts use the same permissions as the Azure portal, so no, you cannot prevent a user from running a PowerShell commandlet and still let them ...
Dan Landberg's user avatar
  • 3,322
1 vote

confirm? group policy is not a reliable way to make a program run on a user's computer

For cases where the user is local admin, you are correct. There are numerous ways that the user could prevent execution in that case, even without blocking group policy stuff from taking effect ...
CBHacking's user avatar
  • 48.4k
1 vote

Missing Powershell Logging Options in Group Policy Editor

Here are some introductions to the PowerShell Script Block Logging and the PowerShell Transcription capabilities in WMF5 for Windows 7 (and later) -- https://adsecurity.org/?p=2277 You'll notice that ...
atdre's user avatar
  • 19.1k
1 vote

Why is task manager often disabled on managed computers?

Back in the 90s on my school's Netware network, you could use the task manager to avoid system policy restrictions. The exact details are fuzzy, but it went something like C+A+D at the Netware login ...
fwaggle's user avatar
  • 11
1 vote

Is this a "standard" security policy?

Whether or not this is standard is going to depend on your specific industry. Not knowing anything about yours or the nature of your projects, I can say this is a standard practice for data under ...
Ivan's user avatar
  • 6,328

Only top scored, non community-wiki answers of a minimum length are eligible