| FSM-PO-SEC-C-ZTA_Servers | |
| Data collected on: 2-9-2025 12:29:21 | |
| Domain | emea.tpg.ads |
| Owner | EMEA\poincon.7-adm |
| Created | 9-1-2025 11:16:44 |
| Modified | 3-4-2025 11:04:50 |
| User Revisions | 1 (AD), 1 (SYSVOL) |
| Computer Revisions | 63 (AD), 63 (SYSVOL) |
| Unique ID | {928579d6-1360-4fd0-a486-722ee158a85a} |
| GPO Status | User settings disabled |
| Location | Enforced | Link Status | Path |
|---|---|---|---|
| Servers | No | Enabled | emea.tpg.ads/FR/Systems/Servers |
| Name |
|---|
| EMEA\FSM-L-SEC-GPO-ZTA_Servers |
| Name | Allowed Permissions | Inherited |
|---|---|---|
| EMEA\Domain Admins | Edit settings, delete, modify security | No |
| EMEA\FR-G-ORG-OU Admins | Edit settings, delete, modify security | No |
| EMEA\FSM-L-SEC-GPO-ZTA_Servers | Read (from Security Filtering) | No |
| EMEA\poincon.7-adm | Edit settings, delete, modify security | No |
| NT AUTHORITY\Authenticated Users | Read | No |
| NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No |
| NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No |
| ROOT\Enterprise Admins | Edit settings, delete, modify security | No |
| Policy | Setting | Comment | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Turn On Virtualization Based Security | Enabled | CO : Kernel Mode Code Integrity: Enabled Credential Guard: Enabled Hypervisor Code Integrity: Enabled Virtual Secure Mode: Enabled System Management Mode Protections: Enable | ||||||||||||
| ||||||||||||||
| Policy | Setting | Comment | ||
|---|---|---|---|---|
| Enumeration policy for external devices incompatible with Kernel DMA Protection | Enabled | Enable Memory Access Protection | ||
| ||||
| Policy | Setting | Comment |
|---|---|---|
| Manage preview builds | Not Configured | Disabled Windows Insider Program - CO |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SOFTWARE\Microsoft\Windows Security Health\State |
| Value name | Hardware_HVCI_Off |
| Value type | REG_DWORD |
| Value data | 0x0 (0) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Kernel Mode Code Integrity - CO |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | Software\Policies\Microsoft\FVE |
| Value name | MorBehavior |
| Value type | REG_DWORD |
| Value data | 0x0 (0) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Memory Overwrite Request Control - CO |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard |
| Value name | EnableVirtualizationBasedSecurity |
| Value type | REG_DWORD |
| Value data | 0x1 (1) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard |
| Value name | RequirePlatformSecurityFeatures |
| Value type | REG_DWORD |
| Value data | 0x3 (3) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard |
| Value name | Locked |
| Value type | REG_DWORD |
| Value data | 0x1 (1) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity |
| Value name | Enabled |
| Value type | REG_DWORD |
| Value data | 0x1 (1) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity |
| Value name | Locked |
| Value type | REG_DWORD |
| Value data | 0x1 (1) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity |
| Value name | WasEnabledBy |
| Value type | REG_DWORD |
| Value data | 0x2 (2) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Avaiable Mode-based execution control - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization |
| Value name | MinVmVersionForCpuBasedMitigations |
| Value type | REG_SZ |
| Value data | 1.0 |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Branch Target Injection Mitigation: not disabled in the registry - CO Notas: https://support.microsoft.com/en-au/topic/kb4072698-windows-server-and-azure-stack-hci-guidance-to-protect-against-silicon-based-microarchitectural-and-speculative-execution-side-channel-vulnerabilities-2f965763-00e2-8f98-b632-0d96f30c8c8e |
| Action | Create |
| Hive | HKEY_LOCAL_MACHINE |
| Key path | SYSTEM\CurrentControlSet\Control\DeviceGuard |
| Value name | HypervisorEnforcedCodeIntegrity |
| Value type | REG_DWORD |
| Value data | 0x1 (1) |
| Stop processing items on this extension if an error occurs on this item | No |
| Remove this item when it is no longer applied | No |
| Apply once and do not reapply | No |
| Enable Hypervisor Code Integrity (Strict Mode) - CO Notas: https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity#enable-memory-integrity-using-group-policy |