Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

Servers Enhanced Auditing Policy
Data collected on: 7/27/2017 8:05:34 AM |

General
Details

Domain | windomain.local
Owner | WINDOMAIN\vagrant
Created | 7/26/2017 8:25:20 PM
Modified | 7/26/2017 8:25:22 PM
User Revisions | 1 (AD), 1 (SYSVOL)
Computer Revisions | 1 (AD), 1 (SYSVOL)
Unique ID | {FEFE7A78-C5E6-4A09-A4E3-24590785DFFA}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
Servers | Yes | Enabled | windomain.local/Servers

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
WINDOMAIN\Domain Admins | Edit settings, delete, modify security | No
WINDOMAIN\Enterprise Admins | Edit settings, delete, modify security | No
WINDOMAIN\vagrant | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/Security Options
Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled

Restricted Groups

Group | Members | Member of
--- | --- | ---
BUILTIN\Event Log Readers | NT AUTHORITY\NETWORK SERVICE |

System Services
Windows Remote Management (WS-Management) (Startup Mode: Automatic)
Permissions
No permissions specified
Auditing
No auditing specified
Windows Firewall with Advanced Security
Global Settings

Policy | Setting
--- | ---
Policy version | 2.22
Disable stateful FTP | Not Configured
Disable stateful PPTP | Not Configured
IPsec exempt | Not Configured
IPsec through NAT | Not Configured
Preshared key encoding | Not Configured
SA idle time | Not Configured
Strong CRL check | Not Configured

Inbound Rules

Name | Description
--- | ---
Windows Remote Management (HTTP-In) | Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
This rule might contain some elements that cannot be interpreted by the current version of GPMC reporting module |
Enabled | True
Program | System
Action | Allow
Security | Require authentication
Authorized computers |
Authorized users |
Protocol | 6
Local port | 5985
Remote port | Any
ICMP settings | Any
Local scope | Any
Remote scope | Any
Profile | Domain
Network interface type | All
Service | All programs and services
Allow edge traversal | False
Group | Windows Remote Management (Compatibility)

Connection Security Settings
Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Success, Failure
Audit Other Account Logon Events | Success, Failure

Account Management

Policy | Setting
--- | ---
Audit Security Group Management | Success, Failure
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit DPAPI Activity | Success, Failure
Audit PNP Activity | Success, Failure
Audit Process Creation | Success, Failure
Audit Process Termination | Success, Failure

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Success, Failure
Audit User / Device Claims | Success, Failure
Audit Group Membership | Success, Failure
Audit Logoff | Success, Failure
Audit Logon | Success, Failure
Audit Other Logon/Logoff Events | Success, Failure
Audit Special Logon | Success, Failure

Object Access

Policy | Setting
--- | ---
Audit Detailed File Share | Success, Failure
Audit File Share | Success, Failure
Audit File System | Success, Failure
Audit Filtering Platform Connection | Failure
Audit Other Object Access Events | Success, Failure
Audit Registry | Success, Failure
Audit Removable Storage | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success, Failure
Audit Authentication Policy Change | Success, Failure
Audit MPSSVC Rule-Level Policy Change | Success, Failure
Audit Other Policy Change Events | Success, Failure

Privilege Use

Policy | Setting
--- | ---
Audit Non Sensitive Privilege Use | Failure
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit Other System Events | Success, Failure
Audit Security State Change | Success, Failure
Audit Security System Extension | Success, Failure
Audit System Integrity | Success, Failure

Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
System/Audit Process Creation

Policy | Setting | Comment
--- | --- | ---
Include command line in process creation events | Enabled |

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Back up log automatically when full | Disabled |
Control Event Log behavior when the log file reaches its maximum size | Disabled |
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 1048576

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Back up log automatically when full | Disabled |
Control Event Log behavior when the log file reaches its maximum size | Disabled |
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 1048576

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Back up log automatically when full | Disabled |
Control Event Log behavior when the log file reaches its maximum size | Disabled |
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 1048576

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on Script Execution | Enabled |
Execution Policy | Allow local scripts and remote signed scripts

Windows Components/Windows Remote Shell

Policy | Setting | Comment
--- | --- | ---
Allow Remote Shell Access | Enabled |

Preferences
Windows Settings
Registry
RestrictRemoteSamEventThrottlingWindow (Order: 1)
General

Action | Update

Properties

Hive | HKEY_LOCAL_MACHINE
Key path | SYSTEM\CurrentControlSet\Control\Lsa
Value name | RestrictRemoteSamEventThrottlingWindow
Value type | REG_DWORD
Value data | 0x0 (0)

Common
Options

Stop processing items on this extension if an error occurs on this item | No
Remove this item when it is no longer applied | No
Apply once and do not reapply | No

User Configuration (Disabled)
No settings defined.