Chapter 8 — Windows security settings | Technical Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Windows security settings

Lesson map

Lesson 08 published. Map, example, EX029.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Key settings"]
  N2["8.2 Applying"]
  N3["8.3 Checking"]
  N4["8.4 Exceptions"]
  N5["Explaining settings to staff"]
  N6["Local admin passwords and reviewing settings"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX029"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Key settings"]
  N2["8.2 Applying"]
  N3["8.3 Checking"]
  N4["8.4 Exceptions"]
  N5["Explaining settings to staff"]
  N6["Local admin passwords and reviewing settings"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX029"]

[Learning outcomes]
    |
    v
[8.1 Key settings]
    |
    v
[8.2 Applying]
    |
    v
[8.3 Checking]
    |
    v
[8.4 Exceptions]
    |
    v
[Explaining settings to staff]
    |
    v
[Local admin passwords and reviewing settings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX029]

Learning outcomes

You will (1) apply key settings; (2) check them; (3) record exceptions.

8.1 Key settings

Nadia and the supplier choose ten settings from the CIS Benchmark and Microsoft security baseline: firewall on, screen lock after ten minutes, guest account off, autorun off, SMBv1 off, Defender PUA blocking, macros from the internet blocked, LAPS, remote desktop off and PowerShell logging. Ten settings are enough to make a real difference without overwhelming a small office. Each one closes a common gap: autorun stops programs starting from USB sticks, macro blocking stops a common route for malware in documents, and LAPS gives each PC its own local admin password. Nadia records the reason for each choice and the reference it came from.

8.2 Applying

The supplier applies them through its management tool to a pilot group of three PCs for a week. One accountant's old tax tool needs a macro from an internet-downloaded template; the template is saved to a trusted location instead. The pilot finds problems before they reach every PC. A trusted location keeps the macro protection on for everything else while letting the old tax tool work. Nadia records the change with its reason, so the next person who sees the trusted location knows why it exists.

8.3 Checking

The management tool reports compliance. Nadia spot-checks two PCs by opening the settings directly. Spot checks confirm that the management tool's report matches the PCs. If a setting appears compliant in the tool but not on the PC, the report cannot be trusted. Nadia records which settings she checked and what she found. Both PCs matched, so the report is used for the monthly compliance figure. She repeats the spot check each quarter on different PCs. The monthly compliance figure and the spot-check notes are filed together, so a later reader can see that the report was checked by hand.

8.4 Exceptions

Any PC that cannot take a setting gets a recorded exception with a reason and review date. After rollout, 29 of 30 PCs comply; the remaining one has an exception for remote desktop, used by a partner working from home through the VPN. The exception records the reason, the compensating control that remote desktop works only through the VPN, and a review date. Nadia keeps the exceptions in a short list with the baseline, and Lena approves each one. At each review date Lena either renews the exception with a fresh reason or closes it once the PC can take the setting.

Explaining settings to staff

Nadia writes a one-page note for staff describing what will change and why: the screen locks after ten minutes, USB sticks do not run anything automatically, and macros in documents from the internet are blocked. Each line has a short reason.

She also explains what to do if something stops working: raise a ticket rather than looking for a way around it. Two tickets arrive in the first week, both resolved within a day.

The note is kept on the shared drive and linked from the knowledge base, so new starters read the same explanation.

Local admin passwords and reviewing settings

Every Windows PC has a built-in local administrator account. If all thirty share one password, a single leaked password opens every PC. Microsoft's Local Administrator Password Solution, LAPS, gives each PC a unique random password stored in the directory, readable only by the supplier for repairs, and changes it regularly. The ten-setting list itself is also reviewed each year against the latest CIS Benchmark and Microsoft security baseline, because recommendations change as Windows changes. The review is short: compare the list, note any new recommendations that matter for the firm, pilot them and update the one-page staff note.

Synthetic case. Figures are synthetic.

Errors and limits

Turning off remote desktop everywhere without asking would have stopped one partner working.

Exercises

EX029 — Setting choice. Name four of the ten settings. Rubric: 3 = four correct;; 2 = three;; 1 = fewer;; 0 = none.
EX030 — Macro conflict. How was the macro conflict solved without weakening the setting? Rubric: 3 = trusted location;; 2 = solved;; 1 = vague;; 0 = none.
EX031 — Exception record. What does an exception record contain? Rubric: 3 = PC, setting, reason, review date;; 2 = three;; 1 = fewer;; 0 = none.
EX032 — Spot checks. Why spot-check settings directly? Rubric: 3 = confirm tool reports;; 2 = check;; 1 = vague;; 0 = none.

Synthesis

A short list of important settings, piloted and checked, makes PCs consistently safer.

Continue studying — chapter 08 of 18

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →