Windows 11 Components: 158 Checks

Checks whether API sampling data collected during system runtime is prevented from being sent to Microsoft.

This rule fails when disableAPISamping is not true.

Rationale: Runtime API sampling data may contain sensitive information that should not be shared with a third party without explicit consent.

Impact: API sampling data will no longer be transmitted to Microsoft.

Checks whether Application Footprint registry and file activity sampling is prevented from being sent to Microsoft.

This rule fails when disableApplicationFootprint is not true.

Rationale: Sampled registry and file activity may contain sensitive information that should not be shared with a third party without explicit consent.

Impact: Application Footprint data will no longer be transmitted to Microsoft.

Checks whether application-install tracing data is prevented from being sent to Microsoft.

This rule fails when disableInstallTracing is not true.

Rationale: Install tracing data may contain sensitive information that should not be shared with a third party without explicit consent.

Impact: Install Tracing data will no longer be transmitted to Microsoft.

Checks whether non-administrator users are blocked from installing Windows app packages.

This rule fails when blockNonAdminUserInstall is not true.

Rationale: Application installs should be managed centrally by IT staff, not initiated freely by end users.

Impact: Non-administrators cannot install Store app packages unless explicitly permitted by other policy.

Checks whether standard users are blocked from installing unsigned Windows App packages by default.

This rule fails when disablePerUserUnsignedPackagesByDefault is not true.

Rationale: Application installs should be managed centrally by IT staff, not initiated freely by end users.

Impact: Standard users cannot install unsigned packaged Store apps unless explicitly permitted.

Checks whether a Windows app can share data between users through the shared SharedLocal folder.

This rule fails when allowSharedLocalAppData is not false.

Rationale: Users of the same system could accidentally share sensitive data with one another through the shared app data folder.

Impact: None - this is the default behavior; apps cannot share data with other instances via SharedLocal.

Checks whether apps and Cortana can be activated by voice while the system is locked.

This rule fails when letAppsActivateWithVoiceAboveLock is not FORCE_DENY.

Rationale: No computer resource should be accessible via voice while the device is locked.

Impact: Users cannot activate apps by voice while the computer is locked.

Checks whether Store apps with direct Windows Runtime API access from web content are blocked from launching.

This rule fails when blockHostedAppAccessWinRT is not true.

Rationale: Blocking web apps with direct access to the Windows API prevents malicious apps from running on a system.

Impact: Universal Windows apps declaring Windows Runtime API access in their manifest cannot be launched.

Checks whether Microsoft accounts are optional for Windows Store apps that require an account.

This rule fails when msaOptional is not true.

Rationale: Microsoft accounts cannot be centrally managed, so enterprise credential-security policies cannot be applied to them, putting any data accessed with them at risk.

Impact: Store apps that normally require a Microsoft account will allow sign-in with an enterprise account.

Checks whether AutoPlay is disallowed for MTP devices such as cameras and phones.

This rule fails when noAutoplayfornonVolume is not true.

Rationale: A threat actor could use AutoPlay on an attached device to launch a program that damages the computer or its data.

Impact: AutoPlay will not be allowed for MTP devices like cameras or phones.

Checks whether Autoplay, which starts reading media as soon as it is inserted, is turned off for all drives.

This rule fails when noDriveTypeAutoRun is not ALL_DRIVES.

Rationale: A threat actor could use Autoplay to launch a program that damages the computer or its data.

Impact: Autoplay is disabled; users must manually launch setup or installation programs from media.

Checks the default behavior for autorun commands (typically stored in autorun.inf files).

This rule fails when noAutorun is not XP.

Rationale: Automatically executing autorun commands when media is inserted allows code to run without the user's knowledge.

Impact: AutoRun commands will be completely disabled.

Checks whether enhanced anti-spoofing is required for Windows Hello facial authentication on capable devices.

This rule fails when enhancedAntiSpoofing is not true.

Rationale: Strengthening biometric facial authentication helps protect against spoofing and unauthorized access.

Impact: All users on capable devices will be required to use anti-spoofing for facial recognition.

Checks whether users may generate a 256-bit recovery key for BitLocker fixed data drives.

This rule fails when fdvRecoveryKey is not one of ALLOW, REQUIRE.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: A 256-bit recovery key will be permitted for fixed drives.

Checks whether users may generate a 48-digit recovery password for BitLocker fixed data drives.

This rule fails when fdvRecoveryPassword is not one of ALLOW, REQUIRE.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: A 48-digit recovery password will be permitted for fixed drives.

Checks whether a Data Recovery Agent may be used to recover BitLocker-protected fixed data drives.

This rule fails when fdvManageDRA is not ALLOW.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: None - this is the default behavior; a DRA is allowed for fixed drives.

REG_SZ

This rule fails when fdvDiscoveryVolumeType is not false.

Rationale: Checks whether FAT-formatted BitLocker fixed data drives can be unlocked on legacy Windows via the BitLocker To Go Reader.

Impact: The BitLocker To Go Reader placed on the unencrypted portion of the drive is, like any app, subject to spoofing and could propagate malware.

Checks whether BitLocker uses hardware-based encryption for fixed data drives.

This rule fails when fdvHardwareEncryption is not false.

Rationale: Hardware-based encryption on some self-encrypting drives has firmware vulnerabilities; software encryption avoids that risk.

Impact: None - this is the default behavior; BitLocker uses software-based encryption for fixed drives.

Checks whether a password may be used to unlock BitLocker-protected fixed data drives.

This rule fails when fdvPassphrase is not false.

Rationale: BitLocker passwords lack TPM anti-hammering protection, so there is no throttle against rapid brute-force guessing.

Impact: The password option will not be available when configuring BitLocker for fixed drives.

Checks whether recovery options for BitLocker-protected fixed data drives are governed by policy.

This rule fails when fdvRecovery is not true.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: A Data Recovery Agent must be configured for fixed drives; recovery requires controlled access to its private key.

Checks whether users are prevented from choosing recovery options during BitLocker setup of fixed data drives.

This rule fails when fdvHideRecoveryPage is not HIDE.

Rationale: Recovery options should be dictated by policy rather than left to users, ensuring a controlled recovery path.

Impact: Users cannot manually select recovery options for fixed drives in the BitLocker setup wizard.

Checks whether smart cards may be used to authenticate access to BitLocker fixed data drives.

This rule fails when fdvAllowUserCert is not true.

Rationale: A drive protected only by a guessable secret or an auto-unlock can be compromised if lost or stolen; smart cards raise the bar.

Impact: None - this is the default behavior; users may use smart cards to unlock fixed data drives.

Checks whether a smart card is required to authenticate access to BitLocker fixed data drives.

This rule fails when fdvEnforceUserCert is not REQUIRED.

Rationale: Requiring a smart card removes weaker unlock options and ties drive access to PKI-backed credentials.

Impact: Smart cards are required to unlock fixed data drives; users must authenticate with the card each restart.

Checks whether a 256-bit recovery key may be generated for BitLocker-protected OS drives.

This rule fails when osRecoveryKey is not DISALLOW.

Rationale: Standardizing OS-drive recovery on the 48-digit password avoids reliance on key files that are easily lost or copied.

Impact: A 256-bit recovery key is not permitted for the OS drive; users must be domain-connected to turn on BitLocker.

Checks whether a 48-digit recovery password is required for BitLocker-protected OS drives.

This rule fails when osRecoveryPassword is not REQUIRE.

Rationale: A required recovery password ensures a reliable way back into the encrypted OS volume if the primary unlock method fails.

Impact: A 48-digit recovery password is required for the OS drive; users must be domain-connected to turn on BitLocker.

Checks whether a Data Recovery Agent may be used to recover BitLocker-protected OS drives.

This rule fails when osManageDRA is not DISALLOW.

Rationale: Recovery of the OS volume should rely on a backed-up recovery password rather than a DRA private key that could itself be abused.

Impact: A Data Recovery Agent is not permitted for the OS drive; users must be domain-connected to turn on BitLocker.

Checks whether enhanced startup PINs (letters, symbols, numbers, spaces) are allowed for BitLocker.

This rule fails when useEnhancedPin is not true.

Rationale: A numeric-only PIN provides far less entropy, making brute-force attacks against startup authentication more feasible.

Impact: All newly set BitLocker startup PINs will be enhanced PINs.

Checks whether BitLocker uses hardware-based encryption for the operating system drive.

This rule fails when osHardwareEncryption is not false.

Rationale: Hardware-based encryption on some self-encrypting drives has firmware vulnerabilities; software encryption avoids that risk.

Impact: None - this is the default behavior; BitLocker uses software-based encryption for the OS drive.

Checks whether recovery options for BitLocker-protected OS drives are governed by policy.

This rule fails when osRecovery is not true.

Rationale: If the OS volume fails integrity checks or the key is lost and recovery info was not backed up, the user may be permanently denied access to the encrypted data.

Impact: Users must be domain-connected to turn on BitLocker; this configuration is not FIPS compliant.

Checks whether users are prevented from choosing recovery options during BitLocker setup of OS drives.

This rule fails when osHideRecoveryPage is not HIDE.

Rationale: Recovery options should be dictated by policy rather than left to users, ensuring a controlled recovery path.

Impact: Users cannot manually select recovery options for the OS drive in the BitLocker setup wizard.

Checks whether Secure Boot may serve as the platform integrity provider for BitLocker OS drives.

This rule fails when osAllowSecureBootForIntegrity is not true.

Rationale: Secure Boot loads only firmware signed by authorized publishers during startup, reducing the risk of rootkits and boot-time malware.

Impact: None - this is the default behavior; BitLocker uses Secure Boot for integrity when capable.

Checks whether a 256-bit recovery key may be generated for BitLocker removable data drives.

This rule fails when rdvRecoveryKey is not DISALLOW.

Rationale: Restricting user-chosen recovery secrets on portable media reduces the chance of weak, lost, or copied recovery material accompanying a stolen drive.

Impact: A 256-bit recovery key will not be permitted for removable drives.

Checks whether a 48-digit recovery password may be generated for BitLocker removable data drives.

This rule fails when rdvRecoveryPassword is not DISALLOW.

Rationale: Restricting user-chosen recovery secrets on portable media reduces the chance of weak, lost, or copied recovery material accompanying a stolen drive.

Impact: A 48-digit recovery password will not be permitted for removable drives.

Checks whether a Data Recovery Agent may be used to recover BitLocker-protected removable data drives.

This rule fails when rdvManageDRA is not ALLOW.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: None - this is the default behavior; a DRA is allowed for removable drives.

REG_SZ

This rule fails when rdvDiscoveryVolumeType is not false.

Rationale: Checks whether FAT-formatted BitLocker removable data drives can be unlocked on legacy Windows via the BitLocker To Go Reader.

Impact: The BitLocker To Go Reader placed on the unencrypted portion of the drive is, like any app, subject to spoofing and could propagate malware.

Checks whether the computer may write to BitLocker removable drives that were configured in another organization.

This rule fails when rdvDenyCrossOrg is not false.

Rationale: Denying cross-organization write access can hinder legitimate encrypted data sharing between business partners.

Impact: None - this is the default behavior; write access to cross-organization BitLocker removable drives is permitted.

Checks whether BitLocker uses hardware-based encryption for removable data drives.

This rule fails when rdvHardwareEncryption is not false.

Rationale: Hardware-based encryption on some self-encrypting drives has firmware vulnerabilities; software encryption avoids that risk.

Impact: None - this is the default behavior; BitLocker uses software-based encryption for removable drives.

Checks whether a password may be used to unlock BitLocker-protected removable data drives.

This rule fails when rdvPassphrase is not false.

Rationale: BitLocker passwords lack TPM anti-hammering protection, so there is no throttle against rapid brute-force guessing.

Impact: The password option will not be available when configuring BitLocker for removable drives.

Checks whether recovery options for BitLocker-protected removable data drives are governed by policy.

This rule fails when rdvRecovery is not true.

Rationale: Administrators must always have a secure, controlled way to recover encrypted data when users cannot access it.

Impact: A Data Recovery Agent must be configured for removable drives; recovery requires controlled access to its private key.

Checks whether users are prevented from choosing recovery options during BitLocker setup of removable data drives.

This rule fails when rdvHideRecoveryPage is not HIDE.

Rationale: Recovery options should be dictated by policy rather than left to users, ensuring a controlled recovery path.

Impact: Users cannot manually select recovery options for removable drives in the BitLocker setup wizard.

Checks whether smart cards may be used to authenticate access to BitLocker removable data drives.

This rule fails when rdvAllowUserCert is not true.

Rationale: A drive protected only by a guessable secret or an auto-unlock can be compromised if lost or stolen; smart cards raise the bar.

Impact: None - this is the default behavior; users may use smart cards to unlock removable data drives.

Checks whether a smart card is required to authenticate access to BitLocker removable data drives.

This rule fails when rdvEnforceUserCert is not REQUIRED.

Rationale: Requiring a smart card removes weaker unlock options and ties drive access to PKI-backed credentials.

Impact: Smart cards are required to unlock removable data drives; users must authenticate with the card each restart.

Checks whether removable data drives must be BitLocker-protected before the computer can write to them.

This rule fails when rdvDenyWriteAccess is not true.

Rationale: Without this control, users may save sensitive data to removable media that was never encrypted.

Impact: Removable drives not protected by BitLocker are mounted read-only; protected drives get read/write access.

Checks whether camera devices on the machine are permitted for use.

This rule fails when allowCamera is not false.

Rationale: In high-security environments a camera poses privacy and data-exfiltration risks and should be disabled.

Impact: Users will not be able to use the camera on the system.

Checks whether cloud consumer account state content is allowed across Windows experiences.

This rule fails when disableConsumerAccountStateContent is not true.

Rationale: Using consumer accounts in an enterprise-managed environment can lead to data leakage.

Impact: Windows experiences present default fallback content instead of consumer-account content.

Checks whether cloud-optimized content is turned off across Windows experiences.

This rule fails when disableCloudOptimizedContent is not true.

Rationale: Data should not be shared with third parties without explicit consent, as it may contain sensitive information.

Impact: Windows experiences present default fallback content instead of cloud-optimized content.

Checks whether consumer experiences such as suggested apps and Microsoft-account notifications are turned off.

This rule fails when disableWindowsConsumerFeatures is not true.

Rationale: Silent app installs in an enterprise environment, especially ones that send data to third parties, are poor security practice.

Impact: Users no longer see personalized Microsoft recommendations or Microsoft-account notifications.

Checks whether a PIN is required when pairing to a wireless display device.

This rule fails when requirePinForPairing is not one of FIRST_TIME, ALWAYS.

Rationale: Without a required pairing PIN, wireless display devices can be paired without authorization, increasing risk of misuse.

Impact: The pairing ceremony for new wireless display devices will require a PIN.

Checks whether administrator accounts are listed when a user attempts to elevate an application.

This rule fails when enumerateAdministrators is not false.

Rationale: Displaying the administrator account list makes it slightly easier for a local attacker to target and crack those accounts.

Impact: None - this is the default behavior; users must always type a username and password to elevate.

Checks whether security questions can be used to reset local account passwords.

This rule fails when noLocalPasswordResetQuestions is not true.

Rationale: Security questions are often easily guessed or researched via social media, letting an attacker reset a local password and take over the account.

Impact: Local accounts cannot set up or use security questions to reset their passwords.

Checks whether the password reveal button is shown in password entry experiences.

This rule fails when disablePasswordReveal is not true.

Rationale: The reveal button can display a typed password on screen, where a nearby observer could read it.

Impact: The password reveal button will not appear after a user types a password.

Checks whether the Connected User Experience and Telemetry service is blocked from automatically using an authenticated proxy.

This rule fails when disableEnterpriseAuthProxy is not true.

Rationale: Data should not be shared with third parties without explicit consent, as it may contain sensitive information.

Impact: The telemetry service is blocked from automatically using an authenticated proxy to send data to Microsoft.

Checks the amount of diagnostic and usage data the device reports to Microsoft.

This rule fails when allowTelemetry is not one of SECURITY, BASIC.

Rationale: Sending optional or full diagnostic data may transmit sensitive information to a third party without explicit consent.

Impact: The device sends at most the required diagnostic data (or none), limiting data shared with Microsoft.

Checks whether the collection of additional diagnostic logs for troubleshooting is limited.

This rule fails when limitDiagnosticLogCollection is not true.

Rationale: Data should not be shared with third parties without explicit consent, as it may contain sensitive information.

Impact: Diagnostic logs and crash dumps will not be collected for transmission to Microsoft.

Checks whether the type of memory dumps collected for troubleshooting is limited.

This rule fails when limitDumpCollection is not true.

Rationale: Data should not be shared with third parties without explicit consent, as memory dumps may contain sensitive information.

Impact: Error reporting is limited to kernel mini and user-mode triage dumps, reducing sensitive data sent to Microsoft.

Checks whether devices are prevented from showing Microsoft feedback questions.

This rule fails when doNotShowFeedbackNotifications is not true.

Rationale: Data should not be shared with third parties without explicit consent, as it may contain sensitive information.

Impact: Users no longer see feedback notifications through the Windows Feedback app.

Checks whether Windows records attempts to connect with the OneSettings service to the Event Log.

This rule fails when enableOneSettingsAuditing is not true.

Rationale: Without these records it may be difficult to determine the root cause of problems or to detect unauthorized activity.

Impact: Windows records OneSettings connection attempts to the Privacy-Auditing operational log channel.

Checks the Delivery Optimization download method used for Windows Updates, apps, and app updates.

This rule fails when doDownloadMode is INTERNET (or is not set).

Rationale: Updates should come only from Microsoft or a trusted internal peer, not from arbitrary peers across the public Internet.

Impact: Machines will not download updates from peers on the Internet.

Checks whether users can enable experimental features in the Windows Package Manager.

This rule fails when enableExperimentalFeatures is not false.

Rationale: Users should not have access to unfinished, experimental package-manager features.

Impact: Users cannot enable experimental winget features.

Checks whether users can override SHA256 security validation in the Windows Package Manager.

This rule fails when enableHashOverride is not false.

Rationale: Users should not be able to bypass package integrity (SHA256) validation.

Impact: Users cannot override the SHA256 security validation.

Checks whether malware scans can be overridden when installing a local archive file via winget.

This rule fails when enableLocalArchiveMalwareScanOverride is not false.

Rationale: Users should not be able to bypass malware scanning when installing archived packages.

Impact: Users cannot override malware scans when installing an archived file.

Checks whether winget certificate-pinning validation of the Microsoft Store source can be bypassed.

This rule fails when enableBypassCertificatePinningForMicrosoftStore is not false.

Rationale: The Microsoft Store source must be validated so that a spoofed source cannot be substituted.

Impact: Source certificate validation cannot be bypassed when winget connects to the Microsoft Store.

Checks whether standard users have access to the Windows Package Manager (winget).

This rule fails when enableAppInstaller is not false.

Rationale: The winget command-line tool can discover, install, and distribute software; standard users should not have access to such development tools.

Impact: Users cannot use winget to discover, install, upgrade, remove, configure, or distribute apps.

Checks whether users can install packages from a website via the ms-appinstaller protocol link.

This rule fails when enableMSAppInstallerProtocol is not false.

Rationale: Clicking an unknown or malicious ms-appinstaller link on a website could install malware on the system.

Impact: Users cannot use the ms-appinstaller protocol to install apps by clicking a website link.

Checks whether users can drive the Windows Package Manager through a CLI (Windows CLI or PowerShell).

This rule fails when enableWindowsPackageManagerCommandLineInterfaces is not false.

Rationale: The winget command-line tool can discover, install, and distribute software; standard users should not have access to such development tools.

Impact: Users cannot use the Windows Package Manager through Windows CLI or PowerShell.

Checks the maximum size (KB) configured for the Application event log.

This rule fails when eventLogApplicationMaxSize is less than 32768.

Rationale: Too small a log lets an attacker overwrite evidence of an attack by generating many extraneous events; a larger log retains more forensic history.

Impact: A larger maximum log size retains more events before the oldest entries are overwritten.

REG_SZ

This rule fails when eventLogApplicationRetention is not false.

Rationale: Checks Event Log behavior when the Application log reaches its maximum size; Disabled lets new events overwrite the oldest events rather than halting logging.

Impact: If new events stop being recorded it may be difficult or impossible to determine the root cause of problems or to detect an attacker's activity.

Checks the maximum size (KB) configured for the Security event log.

This rule fails when eventLogSecurityMaxSize is less than 196608.

Rationale: Too small a log lets an attacker overwrite evidence of an attack by generating many extraneous events; a larger log retains more forensic history.

Impact: A larger maximum log size retains more events before the oldest entries are overwritten.

REG_SZ

This rule fails when eventLogSecurityRetention is not false.

Rationale: Checks Event Log behavior when the Security log reaches its maximum size; Disabled lets new events overwrite the oldest events rather than halting logging.

Impact: If new events stop being recorded it may be difficult or impossible to determine the root cause of problems or to detect an attacker's activity.

Checks the maximum size (KB) configured for the Setup event log.

This rule fails when eventLogSetupMaxSize is less than 32768.

Rationale: Too small a log lets an attacker overwrite evidence of an attack by generating many extraneous events; a larger log retains more forensic history.

Impact: A larger maximum log size retains more events before the oldest entries are overwritten.

REG_SZ

This rule fails when eventLogSetupRetention is not false.

Rationale: Checks Event Log behavior when the Setup log reaches its maximum size; Disabled lets new events overwrite the oldest events rather than halting logging.

Impact: If new events stop being recorded it may be difficult or impossible to determine the root cause of problems or to detect an attacker's activity.

Checks the maximum size (KB) configured for the System event log.

This rule fails when eventLogSystemMaxSize is less than 32768.

Rationale: Too small a log lets an attacker overwrite evidence of an attack by generating many extraneous events; a larger log retains more forensic history.

Impact: A larger maximum log size retains more events before the oldest entries are overwritten.

REG_SZ

This rule fails when eventLogSystemRetention is not false.

Rationale: Checks Event Log behavior when the System log reaches its maximum size; Disabled lets new events overwrite the oldest events rather than halting logging.

Impact: If new events stop being recorded it may be difficult or impossible to determine the root cause of problems or to detect an attacker's activity.

Checks whether File Explorer may request cloud file metadata for its homepage and Quick access views.

This rule fails when disableGraphRecentItems is not true.

Rationale: Data should not be shared with third parties without explicit consent, as it may contain sensitive information.

Impact: Account-activity-based insights and files will not appear in Recent, Recommended, or Favorites views.

Checks whether Data Execution Prevention (DEP) for Windows Explorer is left enabled.

This rule fails when noDataExecutionPreventionForExplorer is not false.

Rationale: DEP is an important protection that limits the impact of certain malware against Explorer.

Impact: None - this is the default behavior; DEP continues to protect Explorer.

Checks whether heap termination on corruption is left active for File Explorer.

This rule fails when noHeapTerminationOnCorruption is not false.

Rationale: Allowing an application to keep running after its session is corrupt increases the system's risk posture.

Impact: None - this is the default behavior; heap termination on corruption remains enabled.

Checks whether the shell protocol runs in protected mode, limiting applications to a restricted set of folders.

This rule fails when preXPSP2ShellProtocolBehavior is not false.

Rationale: Limiting which files and folders can be opened reduces the attack surface of the system.

Impact: None - this is the default behavior; the shell protocol stays in protected mode.

Checks whether files sourced from insecure locations are tagged with Mark of the Web (MOTW).

This rule fails when disableMotWOnInsecurePathCopy is not false.

Rationale: MOTW ensures files from insecure locations are treated with extra caution; untagged files expose users to security risks.

Impact: None - this is the default behavior; files copied from insecure sources are tagged with MOTW.

Checks whether the Windows location feature is turned off for the computer.

This rule fails when disableLocation is not true.

Rationale: Revealing device location to software is undesirable in high-security environments.

Impact: The location feature is off, and all programs are prevented from using location information.

Checks whether cellular text messages may be backed up to and restored from Microsoft's cloud.

This rule fails when allowMessageSync is not false.

Rationale: Data should not be shared with third parties without explicit consent, as messages may contain sensitive information.

Impact: Cellular text messages will not be backed up to or restored from Microsoft's cloud services.

Checks whether apps and services may authenticate with consumer Microsoft accounts via the Windows OnlineID and WebAccountManager APIs.

This rule fails when disableUserAuth is not true.

Rationale: Blocking consumer Microsoft accounts lets an organization keep firm control of which identities are used and helps meet compliance requirements.

Impact: Apps and services cannot start new authentications with consumer Microsoft accounts via those APIs; direct browser/OAuth sign-ins are unaffected.

Checks whether auditing events can be collected from Microsoft Defender Application Guard.

This rule fails when auditApplicationGuard is not true.

Rationale: Application Guard audit events can be valuable when investigating a security incident.

Impact: Application Guard audits system events; collected logs are reviewable through Microsoft Edge.

Checks whether apps inside the Application Guard container can access the device camera and microphone.

This rule fails when allowCameraMicrophoneRedirection is not false.

Rationale: Untrusted sites in the Application Guard container should not reach the camera or microphone, preventing capture of sensitive information.

Impact: Applications inside Application Guard cannot access the device camera or microphone.

Checks whether data persists across sessions in the Microsoft Defender Application Guard container.

This rule fails when allowPersistence is not false.

Rationale: Persistence undermines the sandbox: malicious content could remain active in the container between sessions.

Impact: None - this is the default behavior; Application Guard deletes container user data between sessions.

Checks whether downloaded files may be saved from the Application Guard container to the host OS.

This rule fails when saveFilesToHost is not false.

Rationale: Potentially malicious files should not be copied from the sandbox to the host, which could put the host at risk.

Impact: None - this is the default behavior; users cannot save downloaded files from the container to the host.

Checks how the clipboard behaves between the Application Guard container and the host.

This rule fails when appHVSIClipboardSettings is not HOST_TO_GUARD.

Rationale: Exposing the host clipboard to the container could leak sensitive information to a compromised session; limiting to container-to-host reduces that risk.

Impact: Application Guard sessions cannot read the host clipboard, but the host can read the container clipboard.

Checks whether application isolation through Microsoft Defender Application Guard is enabled for Microsoft Edge.

This rule fails when allowAppHVSIProviderSet is not ENABLED_EDGE.

Rationale: Application Guard uses virtualization-based isolation so that improper interactions and app vulnerabilities cannot compromise the kernel or other apps.

Impact: Application Guard will be turned on for Microsoft Edge.

Checks whether the news and interests feature is allowed on the taskbar.

This rule fails when enableFeeds is not false.

Rationale: News and interests may share data with third parties and can display inappropriate content, and should be treated as a security risk.

Impact: The news and interests feature on the taskbar will not be available on the device.

Checks whether apps and features are prevented from working with OneDrive via the Next Generation Sync Client.

This rule fails when disableFileSyncNGSC is not true.

Rationale: Preventing OneDrive use stops users from accidentally or intentionally uploading confidential corporate information to the cloud service.

Impact: Users cannot access OneDrive from the app or file picker, and files are not synced with the cloud.

Checks whether the Push To Install service, which lets remotely initiated Store installs push apps to the device, is turned off.

This rule fails when disablePushToInstall is not true.

Rationale: The Push To Install service can be used to silently place applications on a device from a linked account, expanding what unattended software can appear.

Impact: Users can no longer remotely queue Store app installs to this device from another device.

Checks whether cloud clipboard content is prevented from flowing from a Remote Desktop server back to the client.

This rule fails when disableCloudClipboardIntegration is not true.

Rationale: Cloud clipboard flow from an untrusted remote host to the client can leak sensitive data onto the local device.

Impact: Clipboard data synchronised through the cloud will not transfer from the server to the client.

Checks whether the Remote Desktop Connection client is prevented from saving connection passwords.

This rule fails when disablePasswordSaving is not true.

Rationale: Saved RDP passwords stored on the client can be recovered by an attacker and reused against remote hosts.

Impact: The Remote Desktop client no longer offers to save passwords; users must enter them each time.

Checks whether inbound Remote Desktop Services connections to this computer are denied (the policy that allows remote connections is disabled).

This rule fails when fDenyTSConnections is not true.

Rationale: An exposed Remote Desktop listener is a frequent target for credential attacks and lateral movement.

Impact: Users cannot connect to this computer using Remote Desktop until the policy is re-enabled.

Checks whether UI Automation redirection between a Remote Desktop session and the local device is disabled.

This rule fails when enableUiaRedirection is not false.

Rationale: UI Automation redirection lets accessibility automation cross the session boundary, which can be abused to drive or observe the remote or local desktop.

Impact: UI Automation clients cannot interact across the Remote Desktop session boundary.

Checks whether mapping of local drives into a Remote Desktop session is prevented.

This rule fails when fDisableCdm is not true.

Rationale: Drive redirection lets files move freely between the session host and the client, a path for data theft and malware transfer.

Impact: Local drives are no longer mapped into Remote Desktop sessions.

Checks whether device location information is prevented from being redirected into a Remote Desktop session.

This rule fails when fDisableLocationRedir is not true.

Rationale: Redirected location data exposes the physical whereabouts of the client to the remote host.

Impact: Location information is no longer redirected into Remote Desktop sessions.

Checks whether redirection of local LPT (parallel) ports into a Remote Desktop session is prevented.

This rule fails when fDisableLPT is not true.

Rationale: LPT port redirection widens the session's device surface with no legitimate need in most environments.

Impact: Local LPT ports are no longer available inside Remote Desktop sessions.

Checks whether redirection of supported Plug and Play devices into a Remote Desktop session is prevented.

This rule fails when fDisablePNPRedir is not true.

Rationale: PnP device redirection can bridge removable media and other peripherals into the session, enabling data movement and malware transfer.

Impact: Supported Plug and Play devices are no longer redirected into Remote Desktop sessions.

Checks whether WebAuthn (FIDO) authenticator redirection into a Remote Desktop session is prevented.

This rule fails when fDisableWebAuthn is not true.

Rationale: Redirecting WebAuthn authenticators lets the remote host use the client's security keys, weakening the trust boundary around strong authentication.

Impact: Local WebAuthn authenticators are no longer available to Remote Desktop sessions.

Checks whether clipboard content is blocked from being copied from a Remote Desktop session server to the connecting client.

This rule fails when scClipLevel is not DISABLED.

Rationale: Allowing the server to push clipboard data to the client can exfiltrate data from an untrusted remote host onto the local device.

Impact: Clipboard content originating on the Remote Desktop server can no longer be pasted on the client.

Checks whether Remote Desktop always requires the user to enter a password when connecting.

This rule fails when fPromptForPassword is not true.

Rationale: If the client can supply a cached password automatically, an attacker at the client can connect without re-authenticating.

Impact: Users are always prompted for their password when establishing a Remote Desktop connection.

Checks whether the Remote Desktop server requires authenticated and encrypted RPC requests.

This rule fails when fEncryptRPCTraffic is not true.

Rationale: Without secure RPC, unauthenticated or unencrypted management requests to the RD service are accepted, exposing it to interception and abuse.

Impact: Only RPC clients that support secure, encrypted requests can communicate with the Remote Desktop service.

Checks whether Remote Desktop connections require the SSL (TLS) security layer for server authentication and session encryption.

This rule fails when securityLayer is not SSL_TLS.

Rationale: Native RDP encryption does not authenticate the server, leaving connections open to man-in-the-middle attacks; SSL/TLS provides server authentication.

Impact: Clients that cannot negotiate SSL/TLS will be unable to connect to the Remote Desktop host.

Checks whether Remote Desktop requires Network Level Authentication before a session is established.

This rule fails when userAuthentication is not true.

Rationale: NLA forces the user to authenticate before a full session is created, protecting the host from pre-authentication attacks and resource exhaustion.

Impact: Only clients that support Network Level Authentication can connect to the Remote Desktop host.

Checks whether Remote Desktop connections encrypt all traffic in both directions using 128-bit keys.

This rule fails when minEncryptionLevel is not HIGH.

Rationale: Weaker encryption levels leave part of the session traffic recoverable by an attacker on the network.

Impact: Clients that cannot support 128-bit encryption will be unable to connect to the Remote Desktop host.

Checks the maximum time an active but idle Remote Desktop session may remain before it is disconnected.

This rule fails when maxIdleTime is 0 (Never) or greater than 900000000000 ns (15 minutes).

Rationale: An idle session left open indefinitely can be hijacked by anyone with access to the client, and consumes host resources.

Impact: Idle Remote Desktop sessions are disconnected after the configured time limit.

Checks whether per-session temporary folders are deleted when a Remote Desktop session ends.

This rule fails when deleteTempDirsOnExit is not true.

Rationale: Retained per-session temp folders can leave sensitive working data on disk for later recovery.

Impact: Per-session temporary folders are cleared when each Remote Desktop session ends.

Checks whether the automatic download of RSS/Atom feed enclosures (attachments) is prevented.

This rule fails when disableEnclosureDownload is not true.

Rationale: Feed enclosures can silently pull attacker-supplied files onto the device without user interaction.

Impact: Enclosures attached to RSS feeds are no longer downloaded automatically.

Checks whether Windows Search is prevented from sending queries and content to cloud services.

This rule fails when allowCloudSearch is present and not DISABLED.

Rationale: Cloud Search transmits local search queries and content to Microsoft cloud services, a privacy and data-exposure concern in sensitive environments.

Impact: Windows Search returns only local results and does not query cloud content.

Checks whether Cortana can be used from the lock screen without signing in.

This rule fails when allowCortanaAboveLock is not false.

Rationale: An assistant available above the lock screen lets an unauthenticated person interact with the device and potentially disclose information.

Impact: Cortana is unavailable on the lock screen until the user signs in.

Checks whether the Cortana voice assistant is disabled.

This rule fails when allowCortana is not false.

Rationale: Cortana sends queries and contextual data to cloud services and expands the input surface of the device.

Impact: Cortana is turned off; users cannot use its assistant features.

Checks whether the search indexer is prevented from indexing encrypted files and stores.

This rule fails when allowIndexingEncryptedStoresOrItems is not false.

Rationale: Indexing encrypted content copies plaintext-derived index data outside the protected store, undermining the encryption.

Impact: Encrypted files are excluded from the search index and will not appear in indexed search results.

Checks whether Search and Cortana are prevented from accessing the device's location.

This rule fails when allowSearchToUseLocation is not false.

Rationale: Location access by search components leaks the device's physical whereabouts to local and cloud features.

Impact: Search and Cortana no longer use the device location for results.

Checks whether dynamic search highlights, which fetch content into the search box from the internet, are disabled.

This rule fails when enableDynamicContentInWSB is not false.

Rationale: Search highlights pull remote content and telemetry into the search experience, adding an untrusted content channel.

Impact: The search box no longer displays dynamic highlight content.

Checks whether the KMS client is prevented from contacting Microsoft's Activation and Validation Service online.

This rule fails when noGenTicket is not true.

Rationale: Blocking the online validation call removes an outbound connection to Microsoft that is unnecessary for KMS-activated enterprise hosts.

Impact: The KMS client no longer performs the online AVS validation call.

Checks whether the Microsoft Store app-restriction policy is applied so that unmanaged Store apps are constrained.

This rule fails when disableStoreApps is not true.

Rationale: Unrestricted Store apps let users install software outside of IT control, broadening the software attack surface.

Impact: Microsoft Store apps are constrained according to the configured Store policy.

Checks whether automatic download and installation of Microsoft Store app updates is turned off.

This rule fails when autoDownload is not NEVER.

Rationale: Uncontrolled automatic Store updates can introduce unvetted changes to installed apps.

Impact: Microsoft Store app updates are not downloaded or installed automatically; updates must be initiated manually.

Checks whether the Microsoft Store is prevented from offering an in-place upgrade to the latest Windows version.

This rule fails when disableOSUpgrade is not true.

Rationale: An unmanaged Store-driven OS upgrade can move a device to an unvalidated Windows release outside change control.

Impact: Users are no longer offered a Windows version upgrade through the Microsoft Store.

Checks whether access to the Microsoft Store application is removed.

This rule fails when removeWindowsStore is not true.

Rationale: The Store lets users acquire and run applications outside IT control, expanding the software attack surface.

Impact: The Microsoft Store application is inaccessible to users on the device.

Checks whether the Widgets board (news and interests feed) is disabled.

This rule fails when allowNewsAndInterests is not false.

Rationale: The Widgets feed pulls remote content and telemetry into the desktop, adding an untrusted content channel.

Impact: The Widgets board is turned off and its taskbar entry is removed.

Checks whether the Windows Recall feature, which periodically snapshots the screen, is prevented from being enabled.

This rule fails when allowRecallEnablement is not false.

Rationale: Recall stores a searchable history of on-screen content, creating a rich local trove of sensitive data that an attacker could harvest.

Impact: Users cannot enable the Windows Recall feature on the device.

Checks whether Enhanced Phishing Protection collects additional context from suspicious sites or apps for security analysis.

This rule fails when captureThreatWindow is not true.

Rationale: Automatic data collection improves detection of phishing and unsafe credential entry across the device.

Impact: Enhanced Phishing Protection captures additional threat context when a suspicious event is detected.

Checks whether users are warned when they enter their password on a known malicious site or app.

This rule fails when notifyMalicious is not true.

Rationale: Warning on malicious credential entry is a key defence against phishing and credential theft.

Impact: Users receive a warning when they attempt to use their password on a site or app flagged as malicious.

Checks whether users are warned when they reuse their work or school password on other sites or apps.

This rule fails when notifyPasswordReuse is not true.

Rationale: Password reuse spreads the impact of a single compromised credential; warning users curbs the practice.

Impact: Users are warned when they reuse their protected password elsewhere.

Checks whether users are warned when they type their password into an application considered unsafe.

This rule fails when notifyUnsafeApp is not true.

Rationale: Entering a password into an untrusted app is a common credential-theft vector; the warning intercepts it.

Impact: Users receive a warning when they enter their password into an app flagged as unsafe.

Checks whether the Enhanced Phishing Protection service is turned on.

This rule fails when serviceEnabled is not true.

Rationale: The service underpins all phishing and password-protection warnings; if it is off, none of them apply.

Impact: The Enhanced Phishing Protection service runs and enforces the configured phishing protections.

Checks whether Windows Defender SmartScreen is turned on for File Explorer and configured to block, rather than merely warn about, unrecognized applications.

This rule fails when enableSmartScreen is not WARN_PREVENT_BYPASS or shellSmartScreenLevel is not BLOCK.

Rationale: SmartScreen in warn-only mode lets users click through the warning and run malicious downloads; preventing bypass stops execution of unrecognized apps.

Impact: Users cannot override the SmartScreen warning to run unrecognized applications.

Checks whether the Game DVR recording and broadcasting feature is disabled.

This rule fails when allowGameDVR is not false.

Rationale: Game DVR can capture on-screen content and stream it, an unnecessary capability that could record sensitive information.

Impact: Game recording and broadcasting features are turned off.

Checks whether Enhanced Sign-in Security uses hardware-isolated biometric processing on supported peripherals.

This rule fails when enableESSwithSupportedPeripherals is not ENABLED.

Rationale: Enhanced Sign-in Security isolates biometric operations from the rest of the OS, hardening Windows Hello against tampering of biometric input.

Impact: Biometric sign-in uses hardware-isolated processing when supported peripheral hardware is present.

Checks whether app suggestions in the Windows Ink Workspace are disabled.

This rule fails when allowSuggestedAppsInWindowsInkWorkspace is not false.

Rationale: App suggestions surface and advertise store content in the workspace, an unnecessary remote content channel.

Impact: The Windows Ink Workspace no longer shows suggested apps.

Checks whether the Windows Ink Workspace is either disabled or, if enabled, made inaccessible from the lock screen.

This rule fails when allowWindowsInkWorkspace is not DISABLED and not ON_NO_INK_BELOW_LOCK (i.e. it is fully ON).

Rationale: Ink features available above the lock screen let an unauthenticated person interact with the device before signing in.

Impact: If enabled, the Ink Workspace is available only after sign-in; it cannot be reached from the lock screen.

Checks whether users are prevented from changing installation options that are normally reserved for administrators.

This rule fails when enableUserControl is not false.

Rationale: Allowing user control over installs lets non-administrators alter protected install settings, potentially installing software insecurely.

Impact: Users cannot override administrator-controlled Windows Installer options.

Checks whether Windows Installer is prevented from installing packages with full system privileges for standard users.

This rule fails when alwaysInstallElevated is not false.

Rationale: This setting lets any user run installer packages as SYSTEM, a well-known local privilege-escalation path.

Impact: Windows Installer packages run with the invoking user's privileges rather than elevated system rights.

Checks whether scripted (web-hosted) Windows Installer installs still trigger the security prompt rather than running silently.

This rule fails when safeForScripting is not false.

Rationale: Suppressing the prompt lets web pages silently launch installer packages, enabling drive-by software installation.

Impact: Scripted Windows Installer installs continue to raise the standard security prompt.

Checks whether automatic sign-in and lock of the last interactive user after an update-driven restart is disabled.

This rule fails when disableAutomaticRestartSignOn is not true.

Rationale: Automatic restart sign-on caches the user's credentials to re-establish the session, exposing them if the device is captured during the reboot window.

Impact: After an update restart the device returns to the sign-in screen instead of auto-signing-in the last user.

Checks whether winlogon is prevented from including the user's plaintext password in the MPR notifications it sends to network providers.

This rule fails when enableMPRNotifications is not false.

Rationale: Including the password in MPR notifications exposes the credential to any registered network provider, including malicious ones.

Impact: Winlogon no longer includes the user's password in MPR notifications; providers relying on it lose that data.

Checks whether PowerShell records the content of executed script blocks to the event log.

This rule fails when enableScriptBlockLogging is not true.

Rationale: Script block logging captures obfuscated and in-memory PowerShell attacker activity that would otherwise leave no trace, aiding detection and investigation.

Impact: The content of executed PowerShell script blocks is written to the operational event log.

Checks whether PowerShell writes a transcript of input and output for each session to a log file.

This rule fails when enableTranscripting is not true.

Rationale: Session transcripts provide a durable record of interactive and scripted PowerShell activity for incident response.

Impact: PowerShell sessions produce transcript files capturing commands and their output.

Checks whether the WinRM client is prevented from using Basic authentication.

This rule fails when winRMClientAllowBasic is not false.

Rationale: Basic authentication sends credentials with trivial encoding; over WinRM it exposes them to interception.

Impact: The WinRM client can no longer authenticate to remote hosts using Basic authentication.

Checks whether the WinRM client is prevented from sending unencrypted management traffic.

This rule fails when winRMClientAllowUnencryptedTraffic is not false.

Rationale: Unencrypted WinRM traffic exposes commands and credentials to network eavesdropping and tampering.

Impact: The WinRM client only communicates over encrypted channels.

Checks whether the WinRM client is prevented from using Digest authentication.

This rule fails when winRMClientAllowDigest is not false.

Rationale: Digest authentication over WinRM is weak and can expose credentials to relay and interception attacks.

Impact: The WinRM client can no longer use Digest authentication.

Checks whether the WinRM service is prevented from automatically listening for and accepting remote management requests.

This rule fails when winRMServiceAllowAutoConfig is not false.

Rationale: An always-listening WinRM service is a remote entry point that can be leveraged for lateral movement.

Impact: The WinRM service does not automatically configure a listener for remote management.

Checks whether the WinRM service is prevented from storing RunAs credentials for plug-ins.

This rule fails when winRMServiceDisableRunAs is not true.

Rationale: Stored RunAs credentials can be extracted from the host and reused, enabling credential theft.

Impact: WinRM plug-ins can no longer store RunAs credentials on the host.

Checks whether the WinRM service is prevented from accepting Basic authentication.

This rule fails when winRMServiceAllowBasic is not false.

Rationale: Accepting Basic authentication lets remote clients present credentials with trivial encoding, exposing them to interception.

Impact: The WinRM service rejects Basic authentication from remote clients.

Checks whether the WinRM service is prevented from accepting unencrypted management traffic.

This rule fails when winRMServiceAllowUnencryptedTraffic is not false.

Rationale: Unencrypted WinRM traffic exposes commands and credentials to network eavesdropping and tampering.

Impact: The WinRM service only accepts management traffic over encrypted channels.

Checks whether remote shell (WinRS) access to the computer is disabled.

This rule fails when allowRemoteShellAccess is not false.

Rationale: Remote shell access provides an interactive command channel to the host that can be abused for lateral movement and command execution.

Impact: Remote WinRS shell connections to the computer are refused.

Checks whether clipboard sharing between the host and Windows Sandbox is disabled.

This rule fails when allowClipboardRedirection is not false.

Rationale: A shared clipboard bridges data between the untrusted sandbox and the host, undermining the isolation the sandbox provides.

Impact: The clipboard is not shared between the host and Windows Sandbox.

Checks whether host folders can be mapped into Windows Sandbox with write access.

This rule fails when allowWriteToMappedFolders is not false.

Rationale: Mapped folders let files move between the untrusted sandbox and the host filesystem, undermining the sandbox isolation.

Impact: Host folders can no longer be mapped with write access into Windows Sandbox.

Checks whether network access from within Windows Sandbox is disabled.

This rule fails when allowNetworking is not false.

Rationale: Network access lets untrusted code in the sandbox reach the internal network and external command channels.

Impact: Windows Sandbox instances run without network connectivity.

Checks whether standard users are prevented from changing Exploit Protection settings in the Windows Security app.

This rule fails when disallowExploitProtectionOverride is not true.

Rationale: If users can weaken Exploit Protection, malware or an unwitting user can disable key exploit mitigations.

Impact: Users can no longer modify Exploit Protection settings; only administrators via policy can change them.

Checks whether scheduled automatic-update installations are allowed to restart the computer rather than waiting indefinitely for a logged-on user.

This rule fails when noAutoRebootWithLoggedOnUsers is not false.

Rationale: Suppressing the restart leaves update installations incomplete, so critical security fixes are not applied until the user chooses to reboot.

Impact: Scheduled automatic-update installations restart the computer to complete, after warning logged-on users.

Checks whether Automatic Updates are enabled so the device downloads and installs updates on a schedule.

This rule fails when noAutoUpdate is not false.

Rationale: Disabled automatic updates leave known vulnerabilities unpatched, exposing the device to exploitation.

Impact: The device automatically downloads and installs Windows updates on the configured schedule.

Checks whether scheduled automatic-update installation is set to occur every day rather than on a single weekday.

This rule fails when scheduledInstallDay is not EVERY_DAY.

Rationale: Installing updates every day minimises the window in which a released fix is available but not yet applied.

Impact: Scheduled automatic-update installations run every day rather than only on one weekday.

Checks whether features that ship turned-off within monthly quality updates are prevented from being enabled automatically.

This rule fails when allowTemporaryEnterpriseFeatureControl is not false.

Rationale: Allowing off-by-default serviced features to turn on introduces unvalidated functionality outside of planned feature updates.

Impact: New features delivered off-by-default in quality updates remain off until explicitly enabled.

Checks whether the user-facing option to pause Windows updates is removed.

This rule fails when setDisablePauseUXAccess is not true.

Rationale: If users can pause updates, they can delay critical security fixes indefinitely, leaving the device exposed.

Impact: The Pause updates option is removed from the Windows Update settings UI.

Checks whether the device is prevented from receiving optional updates, including Controlled Feature Rollouts.

This rule fails when setAllowOptionalContent is not false.

Rationale: Optional updates and gradual feature rollouts deliver unvalidated changes outside the planned update cycle.

Impact: The device does not receive optional updates or Controlled Feature Rollouts.

Checks whether installation of Windows Insider preview builds is blocked.

This rule fails when managePreviewBuilds is not DISABLE.

Rationale: Preview builds are pre-release and unsupported for production, carrying stability and security risk.

Impact: Windows Insider preview builds cannot be installed on the device.

Checks whether the quality-update deferral policy is configured with a deferral period of zero days, so security fixes are received without delay.

This rule fails when deferQualityUpdates is not true or deferQualityUpdatesPeriodInDays is not 0.

Rationale: Deferring quality updates delays the delivery of security fixes, leaving known vulnerabilities unpatched for the deferral period.

Impact: Quality updates are received as soon as they are released, with no deferral.