[{"data":1,"prerenderedAt":278},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben":3},{"seite":4,"start":25,"leiste":26,"bereich":224,"zurueck":276,"weiter":277},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","referenz-richtlinien-netzwerk-freigaben","Network and file sharing","Every setting of the “Network and file sharing” package with its effect, value and recommending sources.","since 0.9.8.11",true,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cp>This page lists every setting of the “Network and file sharing” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.\u003C\u002Fp>\n\u003Cp>45 settings.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"e-c6eaeb1f39\">Windows Firewall: Private: Outbound connections\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value specifies the default action taken by Windows Firewall for outbound connections while the private firewall profile applies.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\DefaultOutboundAction = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-c6eaeb1f398d-defaultoutboundaction\">Windows Firewall: Private: Outbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fgovernance\u002Fpolicy\u002Fsamples\u002Fguest-configuration-baseline-windows\">Microsoft Learn: Reference – Azure Policy guest configuration baseline for Windows\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-8977b55614\">Windows Firewall: Public: Outbound connections\u003C\u002Fh3>\n\u003Cp>This DWORD value defines the default action that Windows Firewall takes for outbound connections while the public firewall profile is active. A value of \u003Ccode>0\u003C\u002Fcode> allows an outbound connection when the traffic does not match an outbound firewall rule.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\DefaultOutboundAction = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-8977b556144f-defaultoutboundaction\">Windows Firewall: Public: Outbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fgovernance\u002Fpolicy\u002Fsamples\u002Fguest-configuration-baseline-windows\">Microsoft Learn: Windows security baseline – Windows Firewall: Public: Outbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-7e7c7ee59c\">Windows Firewall: Private: Inbound connections\u003C\u002Fh3>\n\u003Cp>This registry value defines the default action that Windows Firewall takes on inbound traffic while the private firewall profile is active. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value; \u003Ccode>1\u003C\u002Fcode> blocks inbound traffic by default when no applicable firewall rule explicitly allows it. A value of \u003Ccode>0\u003C\u002Fcode> would allow such traffic by default.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\DefaultInboundAction = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-7e7c7ee59c97-defaultinboundaction\">Windows Firewall: Private: Inbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Ffirewall-csp#mdmstoreprivateprofiledefaultinboundaction\">Microsoft Learn: Firewall CSP – DefaultInboundAction for the private profile\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-5d7156faa6\">Windows Firewall: Public: Inbound connections\u003C\u002Fh3>\n\u003Cp>The DWORD value \u003Ccode>1\u003C\u002Fcode> selects Block as the default action for inbound connections under the public firewall profile. Windows Firewall applies this fallback after evaluating the effective firewall rules, blocking inbound traffic that is not permitted by a matching rule.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\DefaultInboundAction = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-5d7156faa6a7-defaultinboundaction\">Windows Firewall: Public: Inbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fgovernance\u002Fpolicy\u002Fsamples\u002Fguest-configuration-baseline-windows\">Microsoft Learn: Windows security baseline – Windows Firewall: Public: Inbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-7fa4b4ea51\">Enable remote mailslots\u003C\u002Fh3>\n\u003Cp>This DWORD value controls whether the SMB client processes remote mailslots through MUP. The value \u003Ccode>0\u003C\u002Fcode>, as set by Setup Foundry, disables this functionality. Remote mailslot requests are therefore no longer passed through the SMB client redirector.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\NetworkProvider\\EnableMailslots = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-7fa4b4ea51f7-enablemailslots\">Enable remote mailslots\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lanmanworkstation#enablemailslots\">Microsoft Learn: Policy CSP – LanmanWorkstation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-62ea6105f8\">Windows Firewall: Private: Firewall state\u003C\u002Fh3>\n\u003Cp>The DWORD value \u003Ccode>1\u003C\u002Fcode> enables Windows Firewall and advanced security enforcement for the private network profile. Windows filters traffic for this profile according to the effective firewall rules, connection security rules, and configured default actions for inbound and outbound connections.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\EnableFirewall = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-62ea6105f892-enablefirewall\">Windows Firewall: Private: Firewall state\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fgovernance\u002Fpolicy\u002Fsamples\u002Fguest-configuration-baseline-windows\">Microsoft Learn: Windows security baseline – Windows Firewall: Private: Firewall state\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fbook\u002Foperating-system-security-network-security\">Microsoft Learn\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-86599f4636\">Turn on Windows Firewall for public networks\u003C\u002Fh3>\n\u003Cp>This value enables Windows Firewall for network connections that Windows has assigned to the public network profile. \u003Ccode>EnableFirewall\u003C\u002Fcode> is a \u003Ccode>DWORD\u003C\u002Fcode> value; a value of \u003Ccode>1\u003C\u002Fcode> turns on firewall and advanced security enforcement for that profile.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\EnableFirewall = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-86599f46366e-enablefirewall\">Turn on Windows Firewall for public networks\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-configuration\u002Fendpoint-security\u002Fref-firewall-settings\">Microsoft Learn: Turn on Windows Firewall for public networks\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fbook\u002Foperating-system-security-network-security\">Microsoft Learn\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-d08c5d0b1b\">MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\u003C\u002Fh3>\n\u003Cp>This value controls whether NetBIOS over TCP\u002FIP (NetBT) responds to requests to release a registered NetBIOS name. With \u003Ccode>REG_DWORD\u003C\u002Fcode> data set to \u003Ccode>1\u003C\u002Fcode>, the computer retains its name when it receives such a request.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters\\NoNameReleaseOnDemand = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-d08c5d0b1b6a-nonamereleaseondemand\">MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fosconfig\u002Fserver2025machineconfigdoc\">Microsoft Learn: Windows security baseline for Windows Server 2025\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-c0bf73d6b9\">Remote host allows delegation of non-exportable credentials\u003C\u002Fh3>\n\u003Cp>This computer policy setting determines whether a remote host supports Restricted Admin mode and Remote Credential Guard for Remote Desktop connections. Both modes avoid sending reusable user credentials to the remote host.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CredentialsDelegation\\AllowProtectedCreds = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-credentialsssp-allowprotectedcreds\">Remote host allows delegation of non-exportable credentials\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-credentialsdelegation\">Microsoft Learn: Policy CSP – CredentialsDelegation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-420e542fb6\">Set client connection encryption level\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value belongs to the computer-scoped Group Policy setting for Remote Desktop Session Host. It specifies the minimum encryption level for communications between RDP clients and the session host:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\MinEncryptionLevel = 3 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-terminalserver-ts-encryption-policy\">Set client connection encryption level\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotedesktopservices#clientconnectionencryptionlevel\">Microsoft Learn: RemoteDesktopServices Policy CSP – ClientConnectionEncryptionLevel\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-97ef38d0d2\">MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>EnableICMPRedirect\u003C\u002Fcode> registry value controls whether the IPv4 stack changes its routing information in response to received ICMP redirect messages. These messages inform a host that it should use a different next-hop router for a particular destination.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\EnableICMPRedirect = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-97ef38d0d2d5-enableicmpredirect\">MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fosconfig\u002Fserver2025machineconfigdoc\">Microsoft Learn: Reference — Azure Policy guest configuration baseline for Windows Server 2025\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-4357989e14\">MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\u003C\u002Fh3>\n\u003Cp>This machine-wide \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls how the Windows TCP\u002FIP stack handles source-routed IPv4 packets. A value of \u003Ccode>2\u003C\u002Fcode> causes Windows to drop all incoming IPv4 packets whose IP options specify a route selected by the sender. IP source routing is therefore completely disabled.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\DisableIPSourceRouting = 2 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-4357989e1498-disableipsourcerouting\">MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fgovernance\u002Fpolicy\u002Fsamples\u002Fguest-configuration-baseline-windows\">Microsoft Learn: Azure Policy guest configuration baseline for Windows reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-3390a8c46b\">MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\u003C\u002Fh3>\n\u003Cp>A \u003Ccode>DWORD\u003C\u002Fcode> value of \u003Ccode>2\u003C\u002Fcode> selects the highest IPv6 source-routing protection level. Windows drops incoming IPv6 packets that use source routing, preventing them from being processed locally or forwarded to another system.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\DisableIPSourceRouting = 2 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-3390a8c46b7f-disableipsourcerouting\">MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-msslegacy#ipv6sourceroutingprotectionlevel\">Microsoft Learn: Policy CSP – MSSLegacy – IPv6SourceRoutingProtectionLevel\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-6e59069159\">Turn off multicast name resolution\u003C\u002Fh3>\n\u003Cp>This machine-scoped policy setting controls Link-Local Multicast Name Resolution (LLMNR) for the Windows DNS client. The registry value uses the \u003Ccode>REG_DWORD\u003C\u002Fcode> type. A value of \u003Ccode>0\u003C\u002Fcode> disables LLMNR on all available network adapters.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-dnsclient-turn-off-multicast\">Turn off multicast name resolution\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-dnsclient#turn_off_multicast\">Microsoft Learn: ADMX_DnsClient Policy CSP — Turn_Off_Multicast\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-b2137f0661\">Apply local connection security rules\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls whether connection security rules from the local policy store are merged into the effective IPsec policy for the public firewall profile.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\AllowLocalIPsecPolicyMerge = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-b2137f0661e5-allowlocalipsecpolicymerge\">Apply local connection security rules\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-gpfas\u002F8df03d27-ae4e-46d5-b7b9-2fc3056ba8fd\">Microsoft Learn: Allow Local IPsec Policy Merge registry value\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-367bc26668\">Mandate the maximum version of SMB\u003C\u002Fh3>\n\u003Cp>This registry value limits the highest SMB 2 or SMB 3 dialect that the Windows SMB client may negotiate for outbound connections. The \u003Ccode>DWORD\u003C\u002Fcode> value data \u003Ccode>785\u003C\u002Fcode> represents SMB 3.1.1 (\u003Ccode>0x00000311\u003C\u002Fcode>).\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\MaxSmb2Dialect = 785 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-367bc266686f-maxsmb2dialect\">Mandate the maximum version of SMB\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lanmanworkstation#maxsmb2dialect\">Microsoft Learn: LanmanWorkstation Policy CSP\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-373a1948cd\">Intranet Sites: Include all network paths (UNCs)\u003C\u002Fh3>\n\u003Cp>This ADMX-backed Group Policy setting determines whether URLs representing UNC network paths are automatically mapped to the \u003Cstrong>Local intranet\u003C\u002Fstrong> security zone.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-internetexplorer-iz-uncasintranet\">Intranet Sites: Include all network paths (UNCs)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-internetexplorer#includeallnetworkpaths\">Microsoft Learn: InternetExplorer Policy CSP — IncludeAllNetworkPaths\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-609969002e\">Encryption Oracle Remediation\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value selects the protection and compatibility level for applications and services that use the Credential Security Support Provider protocol (CredSSP), such as Remote Desktop Connection. It determines whether updated CredSSP clients may fall back to insecure protocol versions and whether CredSSP services accept unpatched clients.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters\\AllowEncryptionOracle = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-credentialsssp-allowencryptionoracle\">Encryption Oracle Remediation\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-credssp\">Microsoft Learn: ADMX_CredSsp Policy CSP\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-bc6a04f556\">Restrict Unauthenticated RPC clients\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value determines whether the RPC server runtime performs additional authentication checks on incoming remote calls across the system. The check also applies to RPC interfaces that have not registered their own security callback.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc\\RestrictRemoteClients = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-remoteprocedurecalls-rpcrestrictremoteclients\">Restrict Unauthenticated RPC clients\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Frpc-interface-restrict\">Microsoft Learn: RPC Interface Restriction\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-efea1ce0d2\">Enable authentication rate limiter\u003C\u002Fh3>\n\u003Cp>A DWORD value of \u003Ccode>1\u003C\u002Fcode> enables the Windows SMB server authentication rate limiter. The limiter introduces a delay after failed NTLM- and PKU2U-based authentication attempts, reducing the number of passwords that can be tried through SMB within a given period.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanServer\\EnableAuthRateLimiter = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-efea1ce0d284-enableauthratelimiter\">Enable authentication rate limiter\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lanmanserver#enableauthratelimiter\">Microsoft Learn: LanmanServer Policy CSP – EnableAuthRateLimiter\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-bd1b79c9c4\">Mandate the maximum version of SMB\u003C\u002Fh3>\n\u003Cp>This registry value defines the highest SMB dialect that the SMB server may negotiate for inbound connections. It is a \u003Ccode>DWORD\u003C\u002Fcode> value, and value data \u003Ccode>785\u003C\u002Fcode> represents SMB 3.1.1.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanServer\\MaxSmb2Dialect = 785 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-bd1b79c9c4a5-maxsmb2dialect\">Mandate the maximum version of SMB\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lanmanserver#maxsmb2dialect\">Microsoft Learn: Policy CSP – LanmanServer – MaxSmb2Dialect\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-76c52fcbc2\">Require Encryption\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls whether the SMB client requires encryption for all outbound SMB connections. A value of \u003Ccode>0\u003C\u002Fcode> disables that client-wide requirement. A destination server therefore does not have to support SMB encryption solely because of this setting.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\RequireEncryption = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-76c52fcbc2f7-requireencryption\">Require Encryption\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Fconfigure-smb-client-require-encryption\">Microsoft Learn: Configure the SMB client to require encryption in Windows\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-0158ba8b5a\">Enable remote mailslots\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>DWORD\u003C\u002Fcode> value controls server-side support for remote mailslots through the Computer Browser service. A value of \u003Ccode>0\u003C\u002Fcode> disables this functionality.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Bowser\\EnableMailslots = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-0158ba8b5a80-enablemailslots\">Enable remote mailslots\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lanmanserver#enablemailslots\">Microsoft Learn: LanmanServer Policy CSP – EnableMailslots\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-6efdd58fbc\">Enable insecure guest logons\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls whether the Windows SMB client accepts unauthenticated guest logons offered by an SMB server. A value of \u003Ccode>1\u003C\u002Fcode> permits these logons; a value of \u003Ccode>0\u003C\u002Fcode> rejects them.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\AllowInsecureGuestAuth = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-lanmanworkstation-pol-enableinsecureguestlogons\">Enable insecure guest logons\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Fenable-insecure-guest-logons-smb2-and-smb3\">Microsoft Learn: Enable insecure guest logons in SMB2 and SMB3\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-72733aa581\">Require secure RPC communication\u003C\u002Fh3>\n\u003Cp>This registry value backs the computer-scoped ADMX policy for the RPC interface of a Remote Desktop Session Host server. That interface is used to administer and configure Remote Desktop Services.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fEncryptRPCTraffic = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-terminalserver-ts-rpc-encryption\">Require secure RPC communication\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotedesktopservices#requiresecurerpccommunication\">Microsoft Learn: RemoteDesktopServices Policy CSP – RequireSecureRPCCommunication\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-c8a6e42e9f\">Configure RPC packet level privacy setting for incoming connections\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>RpcAuthnLevelPrivacyEnabled\u003C\u002Fcode> registry value controls server-side RPC protection for incoming connections to the print service's \u003Ccode>IRemoteWinspool\u003C\u002Fcode> interface. Its type is \u003Ccode>REG_DWORD\u003C\u002Fcode>. A value of \u003Ccode>1\u003C\u002Fcode> enables Enforcement mode: the print service accepts clients on this interface only when they use the increased RPC authentication level with packet-level privacy.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Print\\RpcAuthnLevelPrivacyEnabled = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-c8a6e42e9f3d-rpcauthnlevelprivacyenabled\">Configure RPC packet level privacy setting for incoming connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-printers#configurerpcauthnlevelprivacyenabled\">Microsoft Learn: Policy CSP – Printers\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-1d4abef918\">Set authentication rate limiter delay (milliseconds)\u003C\u002Fh3>\n\u003Cp>This value specifies the delay that the Windows SMB server applies after a failed NTLM- or PKU2U-based authentication attempt. It is a \u003Ccode>DWORD\u003C\u002Fcode> value expressed in milliseconds.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LanmanServer\\InvalidAuthenticationDelayTimeInMs = 2000 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-1d4abef9189f-invalidauthenticationdelaytimeinms\">Set authentication rate limiter delay (milliseconds)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Fconfigure-smb-authentication-rate-limiter\">Microsoft Learn: Configure SMB authentication rate limiter for Windows\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-f7920a9a0a\">Network access: Do not allow anonymous enumeration of SAM accounts and shares\u003C\u002Fh3>\n\u003Cp>This registry value corresponds to the Windows security option that controls anonymous enumeration of Security Accounts Manager (SAM) accounts and network shares. Its type is \u003Ccode>DWORD\u003C\u002Fcode>. A value of \u003Ccode>1\u003C\u002Fcode> enables the restriction: unauthenticated network connections cannot enumerate the affected account names and share names.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-f7920a9a0a7c-restrictanonymous\">Network access: Do not allow anonymous enumeration of SAM accounts and shares\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-localpoliciessecurityoptions#networkaccess_donotallowanonymousenumerationofsamaccountsandshares\">Microsoft Learn: Policy CSP – LocalPoliciesSecurityOptions: NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-8f1e9a5ac8\">Network access: Let Everyone permissions apply to anonymous users\u003C\u002Fh3>\n\u003Cp>A DWORD value of \u003Ccode>0\u003C\u002Fcode> causes Windows to exclude the Everyone SID (\u003Ccode>S-1-1-0\u003C\u002Fcode>) from access tokens created for anonymous connections. Permissions granted to Everyone therefore do not automatically authorize anonymous users.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\EveryoneIncludesAnonymous = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-8f1e9a5ac820-everyoneincludesanonymous\">Network access: Let Everyone permissions apply to anonymous users\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprevious-versions\u002Fwindows\u002Fit-pro\u002Fwindows-10\u002Fsecurity\u002Fthreat-protection\u002Fsecurity-policy-settings\u002Fnetwork-access-let-everyone-permissions-apply-to-anonymous-users\">Microsoft Learn: Network access: Let Everyone permissions apply to anonymous users\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-d70a8a4de6\">Network access: Restrict anonymous access to Named Pipes and Shares\u003C\u002Fh3>\n\u003Cp>A DWORD value of \u003Ccode>1\u003C\u002Fcode> instructs the Windows Server service to restrict access by unauthenticated clients using null sessions. Anonymous access remains possible only for named pipes and network shares listed in \u003Ccode>NullSessionPipes\u003C\u002Fcode> and \u003Ccode>NullSessionShares\u003C\u002Fcode>, respectively.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RestrictNullSessAccess = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-d70a8a4de680-restrictnullsessaccess\">Network access: Restrict anonymous access to Named Pipes and Shares\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprevious-versions\u002Fwindows\u002Fit-pro\u002Fwindows-10\u002Fsecurity\u002Fthreat-protection\u002Fsecurity-policy-settings\u002Fnetwork-access-restrict-anonymous-access-to-named-pipes-and-shares\">Microsoft Learn: Network access: Restrict anonymous access to Named Pipes and Shares\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.cyber.gov.au\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-09\u002Fhardening_microsoft_windows_11_workstations_september_2025.pdf\">ACSC\u002FASD: Hardening Microsoft Windows 11 workstations\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-4624411cb2\">Allow Basic authentication\u003C\u002Fh3>\n\u003Cp>This policy value controls whether the Windows Remote Management (WinRM) client is permitted to use Basic authentication. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value: \u003Ccode>1\u003C\u002Fcode> allows Basic authentication, while \u003Ccode>0\u003C\u002Fcode> prevents its use.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Client\\AllowBasic = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsremotemanagement-allowbasic-2\">Allow Basic authentication\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotemanagement#allowbasicauthentication_client\">Microsoft Learn: Policy CSP – RemoteManagement – AllowBasicAuthentication_Client\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-795617a56a\">Network access: Restrict clients allowed to make remote calls to SAM\u003C\u002Fh3>\n\u003Cp>This string value (\u003Ccode>REG_SZ\u003C\u002Fcode>) contains a security descriptor expressed in Security Descriptor Definition Language (SDDL). Windows uses its access control list to perform an additional authorization check on incoming calls through the SAMRPC protocol. The check determines which security principals may remotely access the local Security Accounts Manager (SAM) database or, on a domain controller, Active Directory.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RestrictRemoteSAM = O:BAG:BAD:(A;;RC;;;BA) (REG_SZ)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-795617a56a3f-restrictremotesam\">Network access: Restrict clients allowed to make remote calls to SAM\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprevious-versions\u002Fwindows\u002Fit-pro\u002Fwindows-10\u002Fsecurity\u002Fthreat-protection\u002Fsecurity-policy-settings\u002Fnetwork-access-restrict-clients-allowed-to-make-remote-sam-calls\">Microsoft Learn: Network access—Restrict clients allowed to make remote calls to SAM\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-01710dc610\">Prevent clients from querying the index remotely\u003C\u002Fh3>\n\u003Cp>This value controls whether other computers can remotely query the Windows Search index maintained on this computer.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\PreventRemoteQueries = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-fullarmor-policies-3b9ea2b5-a1d1-4cd5-9ede-75b22990bc21-preventremotequeries\">Prevent clients from querying the index remotely\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-search#preventremotequeries\">Microsoft Learn: Search Policy CSP – PreventRemoteQueries\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-1977d87e4b\">Always prompt for password upon connection\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls whether the Remote Desktop Session Host prompts users for their password again when they establish a Remote Desktop connection.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fPromptForPassword = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-terminalserver-ts-password\">Always prompt for password upon connection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotedesktopservices#promptforpassworduponconnection\">Microsoft Learn: RemoteDesktopServices Policy CSP – PromptForPasswordUponConnection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-3a472e176c\">Disable SMBv1 on the SMB client\u003C\u002Fh3>\n\u003Cp>Setting this DWORD value to \u003Ccode>4\u003C\u002Fcode> assigns the Disabled startup type to the \u003Ccode>MRxSMB10\u003C\u002Fcode> driver. After the computer is restarted, the driver is no longer loaded and the computer cannot establish SMBv1 connections as an SMB client.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\mrxsmb10\\Start = 4 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-3a472e176c3e-start\">Disable SMBv1 on the SMB client\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fdetect-enable-and-disable-smbv1-v2-v3\">Microsoft Learn: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-6845184c4e\">Allow Print Spooler to accept client connections\u003C\u002Fh3>\n\u003Cp>This registry value belongs to the computer-scoped Windows policy that controls whether the Print Spooler accepts incoming client connections.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Printers\\RegisterSpoolerRemoteRpcEndPoint = 2 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-printing-2-registerspoolerremoterpcendpoint\">Allow Print Spooler to accept client connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-admx-printing2#registerspoolerremoterpcendpoint\">Microsoft Learn: ADMX_Printing2 Policy CSP – RegisterSpoolerRemoteRpcEndPoint\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-4ac2644d48\">Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\u003C\u002Fh3>\n\u003Cp>This \u003Ccode>REG_DWORD\u003C\u002Fcode> value controls the Windows automatic-connection features associated with Wi-Fi Sense. These features include:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\wcmsvc\\wifinetworkmanager\\config\\AutoConnectAllowedOEM = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-wlansvc-wifisense\">Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-wifi#allowautoconnecttowifisensehotspots\">Microsoft Learn: Policy CSP – Wifi – AllowAutoConnectToWiFiSenseHotspots\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-9811aedfb1\">Do not allow passwords to be saved\u003C\u002Fh3>\n\u003Cp>This machine-wide registry value controls whether users can save passwords with the Windows Remote Desktop Connection client. It is a \u003Ccode>REG_DWORD\u003C\u002Fcode> value; a value of \u003Ccode>1\u003C\u002Fcode> prevents password saving and disables the corresponding option in the client.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\DisablePasswordSaving = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-terminalserver-ts-client-disable-password-saving-2\">Do not allow passwords to be saved\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotedesktopservices#donotallowpasswordsaving\">Microsoft Learn: RemoteDesktopServices Policy CSP – DoNotAllowPasswordSaving\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-cf0c1903c9\">Do not allow drive redirection\u003C\u002Fh3>\n\u003Cp>This computer policy controls whether drives from a client device are made available in Remote Desktop Services sessions hosted by the computer. The \u003Ccode>fDisableCdm\u003C\u002Fcode> registry value is a \u003Ccode>REG_DWORD\u003C\u002Fcode>; a value of \u003Ccode>1\u003C\u002Fcode> prevents client drive redirection.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fDisableCdm = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-terminalserver-ts-client-drive-m\">Do not allow drive redirection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remotedesktopservices#donotallowdriveredirection\">Microsoft Learn: RemoteDesktopServices Policy CSP – DoNotAllowDriveRedirection\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-1e1c296bfb\">Disable SMBv1 on an SMB server\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>SMB1\u003C\u002Fcode> value is a \u003Ccode>REG_DWORD\u003C\u002Fcode> that controls the computer's SMBv1 server component. A value of \u003Ccode>0\u003C\u002Fcode> disables that component. Consequently, the computer no longer accepts inbound file-sharing connections that rely exclusively on the legacy SMBv1 protocol.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1 = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-1e1c296bfbb1-smb1\">Disable SMBv1 on an SMB server\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fdetect-enable-and-disable-smbv1-v2-v3\">Microsoft Learn: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-57df401414\">TLS renegotiation strict server mode\u003C\u002Fh3>\n\u003Cp>The \u003Ccode>AllowInsecureRenegoClients\u003C\u002Fcode> DWORD value determines whether Schannel, when acting in the local server role, accepts TLS clients that do not support secure renegotiation as defined by RFC 5746.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\AllowInsecureRenegoClients = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-57df40141465-allowinsecurerenegoclients\">TLS renegotiation strict server mode\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Ftls\u002Ftls-ssl-schannel-ssp-overview\">Microsoft Learn: TLS\u002FSSL overview (Schannel SSP)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-d3a75100b2\">Disable insecure TLS renegotiation with servers\u003C\u002Fh3>\n\u003Cp>Setting this DWORD value to \u003Ccode>0\u003C\u002Fcode> places Schannel in strict client mode for outbound TLS connections. The local computer can establish or renegotiate TLS sessions only with servers that support secure renegotiation.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Registry value: \u003Ccode>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\AllowInsecureRenegoServers = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-d3a75100b258-allowinsecurerenegoservers\">Disable insecure TLS renegotiation with servers\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Ftls\u002Ftls-registry-settings\">Microsoft Learn: Transport Layer Security (TLS) registry settings\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: Setup Foundry\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-acb15b183b\">Configure Solicited Remote Assistance\u003C\u002Fh3>\n\u003Cp>This computer-scoped Group Policy setting controls Solicited Windows Remote Assistance. When \u003Ccode>fAllowToGetHelp=1\u003C\u002Fcode>, users can invite another person to help them. Windows supports invitations sent by email or file transfer and connections initiated through compatible instant messaging programs. Setting \u003Ccode>fAllowToGetHelp=0\u003C\u002Fcode> prevents users from requesting assistance through these methods.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fAllowToGetHelp = 0 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-remoteassistance-ra-solicit\">Configure Solicited Remote Assistance\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-remoteassistance#solicitedremoteassistance\">Microsoft Learn: RemoteAssistance Policy CSP — SolicitedRemoteAssistance\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fwww.bsi.bund.de\u002FSharedDocs\u002FDownloads\u002FDE\u002FBSI\u002FGrundschutz\u002FIT-GS-Kompendium_Einzel_PDFs_2023\u002F07_SYS_IT_Systeme\u002FSYS_2_2_3_Clients_unter_Windows_Edition_2023.pdf?__blob=publicationFile&v=5\">BSI IT-Grundschutz-Baustein SYS.2.2.3 Clients unter Windows, Anforderung A18\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-549732b553\">Windows Defender Firewall: Protect all network connections\u003C\u002Fh3>\n\u003Cp>This registry value controls whether Windows Defender Firewall is active for the domain profile. The domain profile applies to network connections on an Active Directory domain-joined device when Windows detects a domain controller for that domain.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-windowsfirewall-wf-enablefirewall-name-1\">Windows Defender Firewall: Protect all network connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Foperating-system-security\u002Fnetwork-security\u002Fwindows-firewall\u002F\">Microsoft Learn: Windows Firewall overview\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fbook\u002Foperating-system-security-network-security\">Microsoft Learn\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3 id=\"e-130dd0a226\">Windows Firewall: Domain: Inbound connections\u003C\u002Fh3>\n\u003Cp>This DWORD value defines the default Windows Firewall action for inbound connections under the domain profile. A value of \u003Ccode>1\u003C\u002Fcode> means Block: the firewall blocks inbound traffic for which no applicable inbound firewall rule allows the connection. This default action is considered after the firewall has evaluated its rules.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Technical:\n\u003Cul>\n\u003Cli>Policy: \u003Ccode>HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\DefaultInboundAction = 1 (REG_DWORD)\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Switch in the app: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien#netzwerk-freigaben\">Policies › Network and file sharing\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>In detail: \u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-130dd0a22627-defaultinboundaction\">Windows Firewall: Domain: Inbound connections\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Source: \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Ffirewall-csp#mdmstoredomainprofiledefaultinboundaction\">Microsoft Learn: Firewall CSP – DefaultInboundAction for the domain profile\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Recommended by: \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fdownload\u002Fdetails.aspx?id=55319\">Windows 11 v25H2 Security Baseline\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien\">Policy reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen\">Virus protection and attack surface\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie\">Privacy and telemetry\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":16,"id":23,"text":24},"see-also","See also","\u002Fen\u002Fdocumentation",[27,47,59,67,115,135,151,167,191,207,223],{"titel":28,"pfad":29,"seiten":30},"Getting started","erste-schritte",[31,35,39,43],{"rel":32,"titel":33,"zu":34},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":36,"titel":37,"zu":38},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":40,"titel":41,"zu":42},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":44,"titel":45,"zu":46},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":48,"pfad":49,"seiten":50},"Setup","wizard",[51,55],{"rel":52,"titel":53,"zu":54},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":56,"titel":57,"zu":58},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":60,"pfad":61,"seiten":62},"Setup in detail","einrichtung-detail",[63],{"rel":64,"titel":65,"zu":66},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":68,"pfad":69,"seiten":70},"Foundry","konfiguration",[71,75,79,83,87,91,95,99,103,107,111],{"rel":72,"titel":73,"zu":74},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":76,"titel":77,"zu":78},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":80,"titel":81,"zu":82},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":84,"titel":85,"zu":86},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":88,"titel":89,"zu":90},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":92,"titel":93,"zu":94},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":96,"titel":97,"zu":98},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":100,"titel":101,"zu":102},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":104,"titel":105,"zu":106},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":108,"titel":109,"zu":110},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":112,"titel":113,"zu":114},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":116,"pfad":117,"seiten":118},"Installation","installationsmedien",[119,123,127,131],{"rel":120,"titel":121,"zu":122},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":124,"titel":125,"zu":126},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":128,"titel":129,"zu":130},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":132,"titel":133,"zu":134},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":136,"pfad":137,"seiten":138},"Machines","pruefmaschine",[139,143,147],{"rel":140,"titel":141,"zu":142},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":144,"titel":145,"zu":146},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":148,"titel":149,"zu":150},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":152,"pfad":153,"seiten":154},"Editions","editionen",[155,159,163],{"rel":156,"titel":157,"zu":158},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":160,"titel":161,"zu":162},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":164,"titel":165,"zu":166},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":168,"pfad":169,"seiten":170},"Troubleshooting","fehler",[171,175,179,183,187],{"rel":172,"titel":173,"zu":174},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":176,"titel":177,"zu":178},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":180,"titel":181,"zu":182},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":184,"titel":185,"zu":186},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":188,"titel":189,"zu":190},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":192,"pfad":193,"seiten":194},"Reference","referenz",[195,199,203],{"rel":196,"titel":197,"zu":198},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":200,"titel":201,"zu":202},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":204,"titel":205,"zu":206},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":208,"pfad":209,"seiten":210},"Windows appendix","windows-anhang",[211,215,219],{"rel":212,"titel":213,"zu":214},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":216,"titel":217,"zu":218},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":220,"titel":221,"zu":222},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":224,"pfad":225,"seiten":226},"Policy appendix","richtlinien-anhang",[227,231,235,239,243,244,248,252,256,260,264,268,272],{"rel":228,"titel":229,"zu":230},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":232,"titel":233,"zu":234},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":236,"titel":237,"zu":238},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":240,"titel":241,"zu":242},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":6,"titel":9,"zu":7},{"rel":245,"titel":246,"zu":247},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":249,"titel":250,"zu":251},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":253,"titel":254,"zu":255},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":257,"titel":258,"zu":259},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":261,"titel":262,"zu":263},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":265,"titel":266,"zu":267},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":269,"titel":270,"zu":271},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":273,"titel":274,"zu":275},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",{"titel":241,"zu":242},{"titel":246,"zu":247},1793199133749]