Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Network and file sharing

Every setting of the “Network and file sharing” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Network and file sharing” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

45 settings.

Notes

Windows Firewall: Private: Outbound connections

This DWORD value specifies the default action taken by Windows Firewall for outbound connections while the private firewall profile applies.

Windows Firewall: Public: Outbound connections

This DWORD value defines the default action that Windows Firewall takes for outbound connections while the public firewall profile is active. A value of 0 allows an outbound connection when the traffic does not match an outbound firewall rule.

Windows Firewall: Private: Inbound connections

This registry value defines the default action that Windows Firewall takes on inbound traffic while the private firewall profile is active. It is a REG_DWORD value; 1 blocks inbound traffic by default when no applicable firewall rule explicitly allows it. A value of 0 would allow such traffic by default.

Windows Firewall: Public: Inbound connections

The DWORD value 1 selects Block as the default action for inbound connections under the public firewall profile. Windows Firewall applies this fallback after evaluating the effective firewall rules, blocking inbound traffic that is not permitted by a matching rule.

Enable remote mailslots

This DWORD value controls whether the SMB client processes remote mailslots through MUP. The value 0, as set by Setup Foundry, disables this functionality. Remote mailslot requests are therefore no longer passed through the SMB client redirector.

Windows Firewall: Private: Firewall state

The DWORD value 1 enables Windows Firewall and advanced security enforcement for the private network profile. Windows filters traffic for this profile according to the effective firewall rules, connection security rules, and configured default actions for inbound and outbound connections.

Turn on Windows Firewall for public networks

This value enables Windows Firewall for network connections that Windows has assigned to the public network profile. EnableFirewall is a DWORD value; a value of 1 turns on firewall and advanced security enforcement for that profile.

MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers

This value controls whether NetBIOS over TCP/IP (NetBT) responds to requests to release a registered NetBIOS name. With REG_DWORD data set to 1, the computer retains its name when it receives such a request.

Remote host allows delegation of non-exportable credentials

This computer policy setting determines whether a remote host supports Restricted Admin mode and Remote Credential Guard for Remote Desktop connections. Both modes avoid sending reusable user credentials to the remote host.

Set client connection encryption level

This REG_DWORD value belongs to the computer-scoped Group Policy setting for Remote Desktop Session Host. It specifies the minimum encryption level for communications between RDP clients and the session host:

MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes

The EnableICMPRedirect registry value controls whether the IPv4 stack changes its routing information in response to received ICMP redirect messages. These messages inform a host that it should use a different next-hop router for a particular destination.

MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)

This machine-wide REG_DWORD value controls how the Windows TCP/IP stack handles source-routed IPv4 packets. A value of 2 causes Windows to drop all incoming IPv4 packets whose IP options specify a route selected by the sender. IP source routing is therefore completely disabled.

MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)

A DWORD value of 2 selects the highest IPv6 source-routing protection level. Windows drops incoming IPv6 packets that use source routing, preventing them from being processed locally or forwarded to another system.

Turn off multicast name resolution

This machine-scoped policy setting controls Link-Local Multicast Name Resolution (LLMNR) for the Windows DNS client. The registry value uses the REG_DWORD type. A value of 0 disables LLMNR on all available network adapters.

Apply local connection security rules

This REG_DWORD value controls whether connection security rules from the local policy store are merged into the effective IPsec policy for the public firewall profile.

Mandate the maximum version of SMB

This registry value limits the highest SMB 2 or SMB 3 dialect that the Windows SMB client may negotiate for outbound connections. The DWORD value data 785 represents SMB 3.1.1 (0x00000311).

Intranet Sites: Include all network paths (UNCs)

This ADMX-backed Group Policy setting determines whether URLs representing UNC network paths are automatically mapped to the Local intranet security zone.

Encryption Oracle Remediation

This REG_DWORD value selects the protection and compatibility level for applications and services that use the Credential Security Support Provider protocol (CredSSP), such as Remote Desktop Connection. It determines whether updated CredSSP clients may fall back to insecure protocol versions and whether CredSSP services accept unpatched clients.

Restrict Unauthenticated RPC clients

This REG_DWORD value determines whether the RPC server runtime performs additional authentication checks on incoming remote calls across the system. The check also applies to RPC interfaces that have not registered their own security callback.

Enable authentication rate limiter

A DWORD value of 1 enables the Windows SMB server authentication rate limiter. The limiter introduces a delay after failed NTLM- and PKU2U-based authentication attempts, reducing the number of passwords that can be tried through SMB within a given period.

Mandate the maximum version of SMB

This registry value defines the highest SMB dialect that the SMB server may negotiate for inbound connections. It is a DWORD value, and value data 785 represents SMB 3.1.1.

Require Encryption

This DWORD value controls whether the SMB client requires encryption for all outbound SMB connections. A value of 0 disables that client-wide requirement. A destination server therefore does not have to support SMB encryption solely because of this setting.

Enable remote mailslots

This DWORD value controls server-side support for remote mailslots through the Computer Browser service. A value of 0 disables this functionality.

Enable insecure guest logons

This REG_DWORD value controls whether the Windows SMB client accepts unauthenticated guest logons offered by an SMB server. A value of 1 permits these logons; a value of 0 rejects them.

Require secure RPC communication

This registry value backs the computer-scoped ADMX policy for the RPC interface of a Remote Desktop Session Host server. That interface is used to administer and configure Remote Desktop Services.

Configure RPC packet level privacy setting for incoming connections

The RpcAuthnLevelPrivacyEnabled registry value controls server-side RPC protection for incoming connections to the print service's IRemoteWinspool interface. Its type is REG_DWORD. A value of 1 enables Enforcement mode: the print service accepts clients on this interface only when they use the increased RPC authentication level with packet-level privacy.

Set authentication rate limiter delay (milliseconds)

This value specifies the delay that the Windows SMB server applies after a failed NTLM- or PKU2U-based authentication attempt. It is a DWORD value expressed in milliseconds.

Network access: Do not allow anonymous enumeration of SAM accounts and shares

This registry value corresponds to the Windows security option that controls anonymous enumeration of Security Accounts Manager (SAM) accounts and network shares. Its type is DWORD. A value of 1 enables the restriction: unauthenticated network connections cannot enumerate the affected account names and share names.

Network access: Let Everyone permissions apply to anonymous users

A DWORD value of 0 causes Windows to exclude the Everyone SID (S-1-1-0) from access tokens created for anonymous connections. Permissions granted to Everyone therefore do not automatically authorize anonymous users.

Network access: Restrict anonymous access to Named Pipes and Shares

A DWORD value of 1 instructs the Windows Server service to restrict access by unauthenticated clients using null sessions. Anonymous access remains possible only for named pipes and network shares listed in NullSessionPipes and NullSessionShares, respectively.

Allow Basic authentication

This policy value controls whether the Windows Remote Management (WinRM) client is permitted to use Basic authentication. It is a REG_DWORD value: 1 allows Basic authentication, while 0 prevents its use.

Network access: Restrict clients allowed to make remote calls to SAM

This string value (REG_SZ) contains a security descriptor expressed in Security Descriptor Definition Language (SDDL). Windows uses its access control list to perform an additional authorization check on incoming calls through the SAMRPC protocol. The check determines which security principals may remotely access the local Security Accounts Manager (SAM) database or, on a domain controller, Active Directory.

Prevent clients from querying the index remotely

This value controls whether other computers can remotely query the Windows Search index maintained on this computer.

Always prompt for password upon connection

This REG_DWORD value controls whether the Remote Desktop Session Host prompts users for their password again when they establish a Remote Desktop connection.

Disable SMBv1 on the SMB client

Setting this DWORD value to 4 assigns the Disabled startup type to the MRxSMB10 driver. After the computer is restarted, the driver is no longer loaded and the computer cannot establish SMBv1 connections as an SMB client.

Allow Print Spooler to accept client connections

This registry value belongs to the computer-scoped Windows policy that controls whether the Print Spooler accepts incoming client connections.

Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services

This REG_DWORD value controls the Windows automatic-connection features associated with Wi-Fi Sense. These features include:

Do not allow passwords to be saved

This machine-wide registry value controls whether users can save passwords with the Windows Remote Desktop Connection client. It is a REG_DWORD value; a value of 1 prevents password saving and disables the corresponding option in the client.

Do not allow drive redirection

This computer policy controls whether drives from a client device are made available in Remote Desktop Services sessions hosted by the computer. The fDisableCdm registry value is a REG_DWORD; a value of 1 prevents client drive redirection.

Disable SMBv1 on an SMB server

The SMB1 value is a REG_DWORD that controls the computer's SMBv1 server component. A value of 0 disables that component. Consequently, the computer no longer accepts inbound file-sharing connections that rely exclusively on the legacy SMBv1 protocol.

TLS renegotiation strict server mode

The AllowInsecureRenegoClients DWORD value determines whether Schannel, when acting in the local server role, accepts TLS clients that do not support secure renegotiation as defined by RFC 5746.

Disable insecure TLS renegotiation with servers

Setting this DWORD value to 0 places Schannel in strict client mode for outbound TLS connections. The local computer can establish or renegotiate TLS sessions only with servers that support secure renegotiation.

Configure Solicited Remote Assistance

This computer-scoped Group Policy setting controls Solicited Windows Remote Assistance. When fAllowToGetHelp=1, users can invite another person to help them. Windows supports invitations sent by email or file transfer and connections initiated through compatible instant messaging programs. Setting fAllowToGetHelp=0 prevents users from requesting assistance through these methods.

Windows Defender Firewall: Protect all network connections

This registry value controls whether Windows Defender Firewall is active for the domain profile. The domain profile applies to network connections on an Active Directory domain-joined device when Windows detects a domain controller for that domain.

Windows Firewall: Domain: Inbound connections

This DWORD value defines the default Windows Firewall action for inbound connections under the domain profile. A value of 1 means Block: the firewall blocks inbound traffic for which no applicable inbound firewall rule allows the connection. This default action is considered after the firewall has evaluated its rules.

See also