Security baseline for Windows 10 "Creators Update" (v1703) – DRAFT

  • Article

Microsoft is pleased to announce the beta release of the recommended security configuration baseline settings for Windows 10 “Creators Update,” also known as version 1703, “Redstone 2,” or RS2. Please evaluate this proposed baseline and send us your feedback via blog comments below.

(Note: the final version of this baseline was published here.)

Microsoft is also announcing changes to the tool sets and URLs for managing Windows security configuration baselines. Those changes are described here.

The downloadable attachment to this blog post includes importable GPOs, scripts for applying the GPOs to local policy, custom ADMX files for Group Policy settings, and all the recommended settings in spreadsheet form. New in this release, the spreadsheet also includes the corresponding settings for configuring through Windows’ Mobile Device Management (MDM).

The most significant differences between this baseline and that for Windows 10 v1607 (a.k.a., “Anniversary Update,” “Redstone 1”, RS1) are:

  • Disabling the Server Message Block version 1 (SMBv1) protocol, using a custom “MS Security Guide” ADMX file so that the settings can be exposed through the Group Policy editor. Please read the caveats in the explanation text carefully. We have posted a separate blog article on that subject here.
  • Removing the “Untrusted Font Blocking” setting. We discuss the reasons for this change here.
  • Disabling VBScript in Internet Explorer when browsing sites in the Internet or Restricted Sites security zones.
  • Removing the “Network access: Do not allow storage of passwords and credentials for network authentication” setting. Configuring this setting makes it impossible to configure a scheduled task that needs authenticated network access with a username and password.
  • Disabling TLS 1.0 support for HTTPS sites in Internet Explorer, allowing only TLS 1.1 and TLS 1.2.
  • Disabling default HomeGroup and Xbox services that are not needed on managed enterprise computers, conforming to the Server guidance we recently published.
  • Exposing two more settings through the custom “MS Security Guide” ADMX to enforce protections for 32-bit processes and to “Turn on Windows Defender protection against Potentially Unwanted Applications.”

The Documentation subfolder in the downloadable zip-file attachment includes a spreadsheet showing the full set of differences between the RS1 and RS2 baselines. The spreadsheet was produced using Policy Analyzer.

As mentioned above, we invite and appreciate your feedback on this draft baseline. We will try to publish the final baseline within two weeks.

Comments

  • Anonymous
    June 15, 2017
    Thank you.I hope this security baseline document Japanese edition.and I hope to support the Security And Audit solution - Security Baseline Assessment of Microsoft Operations Management Suite.for share this our customers/partners.
  • Anonymous
    June 21, 2017
    •Disabling TLS 1.0 support for HTTPS sites in Internet Explorer, allowing only TLS 1.1 and TLS 1.2.This is giving us a lot of issues, as many sites still seems to use TLS 1.0, so we will not be able to implement this at the moment.The rest seems fine for now.
  • Anonymous
    June 28, 2017
    Does this require Windows 10 in order to be able to see the custom settings? Can previous versions of Windows be used to modify these settings.[Aaron Margosis] No - just copy the SecGuide.admx into your %windir%\PolicyDefinitions or central store, and the SecGuide.adml into its en-us subdirectory.
  • Anonymous
    July 12, 2017
    Thanks for your work!Hopefully, we get this also for Windows Server - include the Default setting and comparison to the last OS Version.[Aaron Margosis] RS2 won't include a major server release so we aren't updating the Windows Server baseline at this time.I meant to mention that we aren't including the "Default" column in the spreadsheet anymore, for a few reasons:* The default for GPOs is always "Not Configured;"* The default behavior in the absence of a configured setting might not map to one of the GPO options;* The default behavior in the absence of a configured setting can change between OS releases, and we can't review every single feature/setting for every single release, so by not including the Default column, we avoid providing potentially inaccurate documentation.Oh, and for comparing to earlier baselines, check out Policy Analyzer.
  • Anonymous
    August 14, 2017
    Final baseline ?[Aaron Margosis] https://blogs.technet.microsoft.com/secguide/2017/08/30/security-baseline-for-windows-10-creators-update-v1703-final/
  • Anonymous
    August 22, 2017
    Any idea on when the 1703 Security Baseline will be finalized?[Aaron Margosis] This week. Apologies for the delays.