Removed the configuration setting for "Recovery console: Allow automatic administrative logon." This setting has been obsolete since Windows XP and its removal just got missed until now. Configuration settings in the upcoming version of EMET will be in a different format from that of the existing EMET 5.5 beta. Removed all EMET settings from the baseline Removed the screen saver timeout from User configuration, as the computer-wide "Interactive logon: Machine inactivity limit" setting removes that need. (The DISA STIG has also removed this restriction.)
Cached logon verifiers are difficult to break, particularly on Windows Vista and newer. Removed the restrictions on the number of cached logons. The threat it is supposed to protect against is miniscule. Removed configuration of "Allow unicast response" from all three Windows Firewall profiles, as disallowing unicast response regularly causes DHCP address acquisition to fail. These are the updates we have made since the draft release in November, following continuing discussions with security experts in Microsoft, the Center for Internet Security, and customers:Įnabled "Turn off Microsoft consumer experiences," which is a new setting as of version 1511. For that content, see the attachment on this blog post.) (Note that we will not be providing updated SCM. CAB files for this Windows 10 baseline shortly, and will announce their availability on the Security Guidance blog. Release of the security configuration baseline settings for Windows 10 version 1511, also known as "November Update," "Build 10586," "Threshold 2," or "TH2." The downloadable attachment to this blog post includes importable GPOs, tools for applying the GPOs to local GPO, custom ADMX files for Group Policy settings, and all the settings in spreadsheet form.
First published on TechNet on Jan 22, 2016
0 kommentar(er)
