Local Security Policy Recommended Changes?

[animal]

Hi there!

What would you recommend changing (for security reasons) from the original default settings in secpol.msc.

I'm connecting directly to a modem with a single PC that's not used for file sharing or remote use etc.


Thanks for any help.

Regards,
animal

[atari]

Hello,

I would recommend the following policies:

Code:

[b]Interactive logon: Do not require CTRL+ALT+DEL (disabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
DisableCAD = 0

[b]Always use classic logon (enabled)[/b]
Local Computer Policy\Computer Configuration\Administrative Templates\System\Logon
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
LogonType = 0

[b]Interactive logon: Do not display last user name (enabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
DontDisplayLastUserName = 1

[b]Hide entry points for Fast User Switching (enabled)[/b]
Local Computer Policy\Computer Configuration\Administrative Templates\System\Logon
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HideFastUserSwitching = 1

[b]Store passwords using reversible encryption (disabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

[b]Screen Saver (enabled)[/b]
User Configuration\Administrative Templates\Control Panel\Display
HKEY_USERS\.DEFAULT\Control Panel\Desktop\ScreenSaveActive = 1

[b]Screen Saver timeout (enabled, 900 sec.)[/b]
User Configuration\Administrative Templates\Control Panel\Display
HKEY_USERS\.DEFAULT\Control Panel\Desktop\ScreenSaveTimeOut = 900

[b]Password protect the screen saver (enabled)[/b]
User Configuration\Administrative Templates\Control Panel\Display
HKEY_USERS\.DEFAULT\Control Panel\Desktop\ScreenSaverIsSecure = 1

[b]Configure Automatic Updates (enabled; 4 – Auto download and schedule)[/b]
Local Computer Policy\Computer Configuration\Adinistrative Templates\Windows Components\Windows Update
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate= 0
AUOptions = 4

[b]Automatic Updates detection frequency (enabled; 16 hours)[/b]
Local Computer Policy\Computer Configuration\Adinistrative Templates\Windows Components\Windows Update
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
DetectionFrequency = 16
DetectionFrequencyEnabled = 1

[b]Allow Automatic Updates immediate installation (enabled)[/b]
Local Computer Policy\Computer Configuration\Adinistrative Templates\Windows Components\Windows Update
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
AutoInstallMinorUpdates = 1

[b]Shutdown: Clear virtual memory pagefile (disabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
ClearPageFileAtShutdown = 1

[b]User Account Control: Run all administrators in Admin Approval Mode (enabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

[b]User Account Control: Detect application installations and prompt for elevation (enabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

[b]User Account Control: Switch to the secure desktop when prompting for elevation (enabled)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

[b]User Account Control: Behavior of the elevation prompt for administrators in Admin Aproval Mode (Prompt for consent)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

[b]User Account Control: Behavior of the elevation prompt for standard users (Automatically deny elevation requests)[/b]
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\

Cheers.

[animal]

that's excellent.

thank you for taking the time to reply.

[atari]

You are welcome.