Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available
IT-PO-SEC-C-Server Hardening
Data collected on: 2-9-2025 09:32:29
General
Details
Domainemea.tpg.ads
OwnerS-1-5-21-513466819-3096973226-347852806-255910
Created3-10-2019 14:15:18
Modified17-10-2024 13:15:36
User Revisions0 (AD), 0 (SYSVOL)
Computer Revisions156 (AD), 156 (SYSVOL)
Unique ID{c116ec47-a7e4-4e80-9bf3-b4c3a404543e}
GPO StatusEnabled
Links
LocationEnforcedLink StatusPath
ServersNoEnabledemea.tpg.ads/IT/Systems/Servers

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:
Name
NT AUTHORITY\Authenticated Users
Delegation
These groups and users have the specified permission for this GPO
NameAllowed PermissionsInherited
EMEA\Domain AdminsEdit settings, delete, modify securityNo
EMEA\IT-G-ORG-OU AdminsEdit settings, delete, modify securityNo
EMEA\IT-L-SEC-Delegation Full AccessEdit settings, delete, modify securityNo
NT AUTHORITY\Authenticated UsersRead (from Security Filtering)No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSReadNo
NT AUTHORITY\SYSTEMEdit settings, delete, modify securityNo
ROOT\Enterprise AdminsEdit settings, delete, modify securityNo
S-1-5-21-513466819-3096973226-347852806-255910Edit settings, delete, modify securityNo
Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/User Rights Assignment
PolicySetting
Access this computer from the networkEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, NT AUTHORITY\Authenticated Users, BUILTIN\Administrators
Adjust memory quotas for a processNT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE, EMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Allow log on locallyEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Backup Operators, BUILTIN\Administrators
Change the system timeNT AUTHORITY\LOCAL SERVICE, EMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Create a pagefileEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Force shutdown from a remote systemEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Generate security auditsNT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE
Increase scheduling priorityEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Load and unload device driversEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Lock pages in memory
Manage auditing and security logEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Modify firmware environment valuesEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Perform volume maintenance tasksEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Profile single processEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Profile system performanceWdiServiceHost, NT Service, EMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Remove computer from docking stationEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Restore files and directoriesEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Backup Operators, BUILTIN\Administrators
Shut down the systemEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Take ownership of files or other objectsEMEA\IT-L-SEC-Delegation Local Administration Rights Tier1, BUILTIN\Administrators
Local Policies/Security Options
Accounts
PolicySetting
Accounts: Limit local account use of blank passwords to console logon onlyEnabled
Devices
PolicySetting
Devices: Allowed to format and eject removable mediaAdministrators
Devices: Prevent users from installing printer driversEnabled
Domain Controller
PolicySetting
Domain controller: LDAP server signing requirementsRequire signing
Domain Member
PolicySetting
Domain member: Digitally encrypt or sign secure channel data (always)Enabled
Domain member: Digitally encrypt secure channel data (when possible)Enabled
Domain member: Digitally sign secure channel data (when possible)Enabled
Domain member: Disable machine account password changesDisabled
Domain member: Require strong (Windows 2000 or later) session keyEnabled
Interactive Logon
PolicySetting
Interactive logon: Do not require CTRL+ALT+DELDisabled
Interactive logon: Don't display last signed-inEnabled
Interactive logon: Number of previous logons to cache (in case domain controller is not available)0 logons
Interactive logon: Require Domain Controller authentication to unlock workstationEnabled
Microsoft Network Client
PolicySetting
Microsoft network client: Digitally sign communications (always)Enabled
Microsoft network client: Digitally sign communications (if server agrees)Enabled
Microsoft Network Server
PolicySetting
Microsoft network server: Digitally sign communications (always)Enabled
Microsoft network server: Digitally sign communications (if client agrees)Enabled
Network Access
PolicySetting
Network access: Allow anonymous SID/Name translationDisabled
Network access: Do not allow anonymous enumeration of SAM accountsEnabled
Network access: Do not allow anonymous enumeration of SAM accounts and sharesEnabled
Network access: Do not allow storage of passwords and credentials for network authenticationEnabled
Network access: Let Everyone permissions apply to anonymous usersDisabled
Network Security
PolicySetting
Network security: Do not store LAN Manager hash value on next password changeEnabled
Network security: LAN Manager authentication levelSend NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirementsRequire signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) serversEnabled
Require NTLMv2 session securityEnabled
Require 128-bit encryptionEnabled
System Cryptography
PolicySetting
System cryptography: Force strong key protection for user keys stored on the computerUser is prompted when the key is first used
System Services
Print Spooler (Startup Mode: Disabled)
Permissions
TypeNamePermission
AllowBUILTIN\AdministratorsFull Control
AllowNT AUTHORITY\SYSTEMFull Control
AllowNT AUTHORITY\INTERACTIVERead
Auditing
TypeNameAccess
FailureEveryoneFull Control
Administrative Templates
Policy definitions (ADMX files) retrieved from the central store.
Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security
PolicySettingComment
Require use of specific security layer for remote (RDP) connectionsEnabled
Security LayerSSL
Choose the security layer from the drop-down list.
PolicySettingComment
Server authentication certificate templateEnabled
Certificate Template NameTPEMEA-RDPAE2years
Windows Components/Remote Desktop Services/Remote Desktop Session Host/Session Time Limits
PolicySettingComment
Set time limit for active but idle Remote Desktop Services sessionsEnabled
Idle session limit:15 minutes
User Configuration (Enabled)
No settings defined.