This article is for network administrators and others who manage their own network. If you're trying to join a Wi-Fi network, one of these articles should help:
Configure Security Settings Overview. The Configure Security Settings page is a one-stop menu for configuring most of the security-related settings on the product. The settings on this page along with the settings in the HP Jetdirect Security Configuration Wizard can help you improve the level of security on your product.
- Mac: Connect to Wi-Fi and resolve Wi-Fi issues.
- iPhone, iPad, iPod touch: Connect to Wi-Fi and resolve Wi-Fi issues.
- The default and most secure setting is ”Disallow booting from external media.” When this setting is selected, your Mac can't be made to start up from any external media. Attempting to do so will cause your Mac to display a message that your security settings do not allow this Mac to use an external startup disk.
- The modification of security settings in Active Directory and the registry and other databases; The modification of permissions on objects in AD, the file system, the Windows registry; Note that the security settings can be defined on the local, a remote computer, an interoperability mismatch between the local and a remote computer.
- Secure Settings is a Locale/Tasker compatible plug-in for Android 2.2+. ATTENTION: This app uses the Device Administrator permission. If given the ability, Secure Settings can lock your device's screen, as well as set/unset your device's password. In order to make these changes, Device Administrator permissions are required.
Before changing the settings on your router
- Back up your router's settings, in case you need to restore the settings.
- Update the software on your devices. This is critical to ensure that your devices have the latest security updates and work best with each other.
- First install the latest firmware updates for your router.
- Then update the software on your other devices, such as on your Mac and on your iPhone or iPad.
- On each device that previously joined the network, you might need to forget the network to ensure that the device uses the router's new settings when rejoining the network.
Router settings
To ensure that your devices can reconnect reliably to your network, apply these settings consistently to each Wi-Fi router and access point, and to each band of a dual-band, tri-band, or other multiband router.
Network name (SSID)
A single, unique name (case-sensitive)
The Wi-Fi network name, or SSID (service set identifier), is the name your network uses to advertise its presence to other devices. It's also the name that nearby users see on their device's list of available networks.
Use a name that's unique to your network, and make sure that all routers on your network use the same name for every band they support. For example, don't use common names or default names such as linksys, netgear, dlink, wireless, or 2wire, and don't give your 2.4GHz and 5GHz bands different names.
If you don't follow this guidance, devices might not connect reliably to your network, to all routers on your network, or to all available bands of your routers. And devices that join your network are more likely to encounter other networks that have the same name, and then automatically try to connect to them.
Hidden network
Disabled
A router can be configured to hide its network name (SSID). Your router might incorrectly use ”closed” to mean hidden, and ”broadcast” to mean not hidden.
Hiding the network name doesn't conceal the network from detection or secure it against unauthorized access. And because of the way that devices search for and connect to Wi-Fi networks, using a hidden network might expose information that can be used to identify you and the hidden networks you use, such as your home network. When connected to a hidden network, your device might show a privacy warning because of this privacy risk.
To secure access to your network, use the appropriate security setting instead.
Security
WPA3 Personal for better security, or WPA2/WPA3 Transitional for compatibility with older devices
The security setting defines the type of authentication and encryption used by your router, and the level of privacy protection for data transmitted over its network. Whichever level of security you choose, always set a strong password for joining the network.
- WPA3 Personal is the newest, most secure protocol currently available for Wi-Fi devices. It works with all devices that support Wi-Fi 6 (802.11ax), and some older devices.
- WPA2/WPA3 Transitional is a mixed mode that uses WPA3 Personal with devices that support that protocol, while allowing older devices to use WPA2 Personal (AES) instead.
- WPA2 Personal (AES) is appropriate when you can't use one of the more secure modes. In that case, also choose AES as the encryption or cipher type, if available.
Settings that turn off security, such as None, Open, or Unsecured, are strongly discouraged. Turning off security disables authentication and encryption and allows anyone to join your network, access its shared resources (including printers, computers, and smart devices), use your internet connection, and monitor data transmitted over your network or internet connection (including the websites you visit). This is a risk even if security is turned off temporarily or for a guest network.
Don't create or join networks that use older, deprecated security protocols like WPA/WPA2 Mixed Mode, WPA Personal, TKIP, Dynamic WEP (WEP with 802.1X), WEP Transitional Security Network, WEP Open, or WEP Shared. These are no longer secure, and they reduce network reliability and performance. Apple devices show a security warning when joining such networks.
MAC address filtering, authentication, access control
Disabled
When this feature is enabled, your router can be set up to allow only devices that have specified MAC (media access control) addresses to join the network. You shouldn't rely on this feature to prevent unauthorized access to your network, for these reasons:
- It doesn't prevent network observers from monitoring or intercepting traffic on the network.
- MAC addresses can easily be copied, spoofed (impersonated), or changed.
- To help protect user privacy, some Apple devices use a different MAC address for each Wi-Fi network.
To secure access to your network, use the appropriate security setting instead.
Automatic firmware updates
Enabled
If possible, set your router to automatically install software and firmware updates as they become available. Firmware updates can affect the security settings available to you, and they deliver other important improvements to the stability, performance, and security of your router.
Radio mode
All (preferred),or Wi-Fi 2 through Wi-Fi 6 (802.11a/g/n/ac/ax)
These settings, available separately for the 2.4GHz and 5GHz bands, control which versions of the Wi-Fi standard the router uses for wireless communication. Newer versions offer better performance and support more devices concurrently.
Secure Settings Pro Apk
It's usually best to enable every mode offered by your router, rather then a subset of those modes. All devices, including older devices, can then connect using the fastest radio mode they support. This also helps reduce interference from nearby legacy networks and devices.
Bands
Enable all bands supported by your router
A Wi-Fi band is like a street over which data can flow. More bands provide more data capacity and performance for your network.
Channel
Auto
Each band of your router is divided into multiple, independent communication channels, like lanes in a street. When channel selection is set to automatic, your router selects the best Wi-Fi channel for you.
If your router doesn't support automatic channel selection, choose whichever channel performs best in your network environment. That varies depending on the Wi-Fi interference in your network environment, which can include interference from any other routers and devices that are using the same channel. If you have multiple routers, configure each to use a different channel, especially if they are close to each other.
Channel width
20MHz for the 2.4GHz band
Auto orall widths (20MHz, 40MHz, 80MHz) for the 5GHz band
Channel width specifies how large of a ”pipe” is available to transfer data. Wider channels are faster but more susceptible to interference and more likely to interfere with other devices.
- 20MHz for the 2.4GHz band helps to avoid performance and reliability issues, especially near other Wi-Fi networks and 2.4GHz devices, including Bluetooth devices.
- Auto or all channel widths for the 5GHz band ensures the best performance and compatibility with all devices. Wireless interference is less of a concern in the 5GHz band.
DHCP
Enabled, if your router is the only DHCP server on the network
DHCP (dynamic host configuration protocol) assigns IP addresses to devices on your network. Each IP address identifies a device on the network and enables it to communicate with other devices on the network and internet. A network device needs an IP address much like a phone needs a phone number.
Your network should have only one DHCP server. If DHCP is enabled on more than one device (such as on both your cable modem and router), address conflicts might prevent some devices from connecting to the internet or using network resources.
DHCP lease time
8 hours for home or office networks; 1 hour for hotspots or guest networks
DHCP lease time is the length of time that an IP address assigned to a device is reserved for that device.
Wi-Fi routers usually have a limited number of IP addresses that they can assign to devices on the network. If that number is depleted, the router can't assign IP addresses to new devices, and those devices can't communicate with other devices on the network and internet. Reducing DHCP lease time allows the router to more quickly reclaim and reassign old IP addresses that are no longer being used.
NAT
Enabled, if your router is the only device providing NAT on the network
NAT (network address translation) translates between addresses on the internet and addresses on your network. NAT can be understood by imagining a company's mail department, where deliveries to employees at the company's street address are routed to employee offices within the building.
Generally, enable NAT only on your router. If NAT is enabled on more than one device (such as on both your cable modem and router), the resulting ”double NAT” might cause devices to lose access to certain resources on the network or internet.
WMM
Enabled
WMM (Wi-Fi multimedia) prioritizes network traffic to improve the performance of a variety of network applications, such as video and voice. All routers that support Wi-Fi 4 (802.11n) or later should have WMM enabled by default. Disabling WMM can affect the performance and reliability of devices on the network.
Device features that can affect Wi-Fi connections
These features might affect how you set up your router or the devices that connect to it.
Private Wi-Fi Address
If you're connecting to a Wi-Fi network from an iPhone, iPad, iPod touch, or Apple Watch, learn about using private Wi-Fi addresses in iOS 14, iPadOS 14, and watchOS 7.
Secure Settings Pro Apk
Location Services
Make sure that your device has Location Services turned on for Wi-Fi networking, because regulations in each country or region define the Wi-Fi channels and wireless signal strength allowed there. Location Services helps to ensure that your device can reliably see and connect to nearby devices, and that it performs well when using Wi-Fi or features that rely on Wi-Fi, such as AirPlay or AirDrop.
On your Mac:
- Choose Apple menu > System Preferences, then click Security & Privacy.
- Click the lock in the corner of the window, then enter your administrator password.
- In the Privacy tab, select Location Services, then select Enable Location Services.
- Scroll to the bottom of the list of apps and services, then click the Details button next to System Services.
- Select Wi-Fi Networking, then click Done.
On your iPhone, iPad, or iPod touch:
- Go to Settings > Privacy > Location Services.
- Turn on Location Services.
- Scroll to the bottom of the list, then tap System Services.
- Turn on Networking & Wireless (or Wi-Fi Networking).
Auto-Join when used with wireless carrier Wi-Fi networks
Wireless carrier Wi-Fi networks are public networks set up by your wireless carrier and their partners. Your iPhone or other Apple cellular device treats them as known networks and automatically connects to them.
If you see ”Privacy Warning” under the name of your carrier's network in Wi-Fi settings, your cellular identity could be exposed if your device were to join a malicious hotspot impersonating your carrier's Wi-Fi network. To avoid this possibility, you can prevent your iPhone or iPad from automatically rejoining your carrier’s Wi-Fi network:
- Go to Settings > Wi-Fi.
- Tap next to the wireless carrier's network.
- Turn off Auto-Join.
Secure Settings Pro License Key
Applies to
- Windows 10
Provides an introduction to the Security Options settings for local security policies and links to more information.
The Security Options contain the following groupings of security policy settings that allow you to configure the behavior of the local computer. Some of these policies can be included in a Group Policy Object and distributed over your organization.
When you edit policy settings locally on a device, you only affect the settings on only that device. If you configure the settings in a Group Policy Object (GPO), the settings apply to all devices that are subject to that GPO.
For info about setting security policies, see Configure security policy settings.
In this section
| Article | Description |
|---|---|
| Accounts: Administrator account status | Describes the best practices, location, values, and security considerations for the Accounts: Administrator account status security policy setting. |
| Accounts: Block Microsoft accounts | Describes the best practices, location, values, management, and security considerations for the Accounts: Block Microsoft accounts security policy setting. |
| Accounts: Guest account status | Describes the best practices, location, values, and security considerations for the Accounts: Guest account status security policy setting. |
| Accounts: Limit local account use of blank passwords to console logon only | Describes the best practices, location, values, and security considerations for the Accounts: Limit local account use of blank passwords to console logon only security policy setting. |
| Accounts: Rename administrator account | This security policy article for the IT professional describes the best practices, location, values, and security considerations for this policy setting. |
| Accounts: Rename guest account | Describes the best practices, location, values, and security considerations for the Accounts: Rename guest account security policy setting. |
| Audit: Audit the access of global system objects | Describes the best practices, location, values, and security considerations for the Audit: Audit the access of global system objects security policy setting. |
| Audit: Audit the use of Backup and Restore privilege | Describes the best practices, location, values, and security considerations for the Audit: Audit the use of Backup and Restore privilege security policy setting. |
| Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Describes the best practices, location, values, and security considerations for the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings security policy setting. |
| Audit: Shut down system immediately if unable to log security audits | Describes the best practices, location, values, management practices, and security considerations for the Audit: Shut down system immediately if unable to log security audits security policy setting. |
| DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax | Describes the best practices, location, values, and security considerations for the DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting. |
| DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax | Describes the best practices, location, values, and security considerations for the DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting. |
| Devices: Allow undock without having to log on | Describes the best practices, location, values, and security considerations for the Devices: Allow undock without having to log on security policy setting. |
| Devices: Allowed to format and eject removable media | Describes the best practices, location, values, and security considerations for the Devices: Allowed to format and eject removable media security policy setting. |
| Devices: Prevent users from installing printer drivers | Describes the best practices, location, values, and security considerations for the Devices: Prevent users from installing printer drivers security policy setting. |
| Devices: Restrict CD-ROM access to locally logged-on user only | Describes the best practices, location, values, and security considerations for the Devices: Restrict CD-ROM access to locally logged-on user only security policy setting. |
| Devices: Restrict floppy access to locally logged-on user only | Describes the best practices, location, values, and security considerations for the Devices: Restrict floppy access to locally logged-on user only security policy setting. |
| Domain controller: Allow server operators to schedule tasks | Describes the best practices, location, values, and security considerations for the Domain controller: Allow server operators to schedule tasks security policy setting. |
| Domain controller: LDAP server signing requirements | Describes the best practices, location, values, and security considerations for the Domain controller: LDAP server signing requirements security policy setting. |
| Domain controller: Refuse machine account password changes | Describes the best practices, location, values, and security considerations for the Domain controller: Refuse machine account password changes security policy setting. |
| Domain member: Digitally encrypt or sign secure channel data (always) | Describes the best practices, location, values, and security considerations for the Domain member: Digitally encrypt or sign secure channel data (always) security policy setting. |
| Domain member: Digitally encrypt secure channel data (when possible) | Describes the best practices, location, values, and security considerations for the Domain member: Digitally encrypt secure channel data (when possible) security policy setting. |
| Domain member: Digitally sign secure channel data (when possible) | Describes the best practices, location, values, and security considerations for the Domain member: Digitally sign secure channel data (when possible) security policy setting. |
| Domain member: Disable machine account password changes | Describes the best practices, location, values, and security considerations for the Domain member: Disable machine account password changes security policy setting. |
| Domain member: Maximum machine account password age | Describes the best practices, location, values, and security considerations for the Domain member: Maximum machine account password age security policy setting. |
| Domain member: Require strong (Windows 2000 or later) session key | Describes the best practices, location, values, and security considerations for the Domain member: Require strong (Windows 2000 or later) session key security policy setting. |
| Interactive logon: Display user information when the session is locked | Describes the best practices, location, values, and security considerations for the Interactive logon: Display user information when the session is locked security policy setting. |
| Interactive logon: Don't display last signed-in | Describes the best practices, location, values, and security considerations for the Interactive logon: Don't display last signed-in security policy setting. |
| Interactive logon: Don't display username at sign-in | Describes the best practices, location, values, and security considerations for the Interactive logon: Do not display username at sign-in security policy setting. |
| Interactive logon: Do not require CTRL+ALT+DEL | Describes the best practices, location, values, and security considerations for the Interactive logon: Do not require CTRL+ALT+DEL security policy setting. |
| Interactive logon: Machine account lockout threshold | Describes the best practices, location, values, management, and security considerations for the Interactive logon: Machine account lockout threshold security policy setting. |
| Interactive logon: Machine inactivity limit | Describes the best practices, location, values, management, and security considerations for the Interactive logon: Machine inactivity limit security policy setting. |
| Interactive logon: Message text for users attempting to log on | Describes the best practices, location, values, management, and security considerations for the Interactive logon: Message text for users attempting to log on security policy setting. |
| Interactive logon: Message title for users attempting to log on | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Message title for users attempting to log on security policy setting. |
| Interactive logon: Number of previous logons to cache (in case domain controller is not available) | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Number of previous logons to cache (in case domain controller is not available) security policy setting. |
| Interactive logon: Prompt user to change password before expiration | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Prompt user to change password before expiration security policy setting. |
| Interactive logon: Require Domain Controller authentication to unlock workstation | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Require Domain Controller authentication to unlock workstation security policy setting. |
| Interactive logon: Require smart card | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Require smart card security policy setting. |
| Interactive logon: Smart card removal behavior | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Smart card removal behavior security policy setting. |
| Microsoft network client: Digitally sign communications (always) | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network client: Digitally sign communications (always) security policy setting for SMBv3 and SMBv2. |
| SMBv1 Microsoft network client: Digitally sign communications (always) | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network client: Digitally sign communications (always) security policy setting for SMBv1 only. |
| SMBv1 Microsoft network client: Digitally sign communications (if server agrees) | Describes the best practices, location, values, and security considerations for the Microsoft network client: Digitally sign communications (if server agrees) security policy setting for SMBv1 only. |
| Microsoft network client: Send unencrypted password to third-party SMB servers | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network client: Send unencrypted password to third-party SMB servers security policy setting. |
| Microsoft network server: Amount of idle time required before suspending session | Describes the best practices, location, values, and security considerations for the Microsoft network server: Amount of idle time required before suspending session security policy setting. |
| Microsoft network server: Attempt S4U2Self to obtain claim information | Describes the best practices, location, values, management, and security considerations for the Microsoft network server: Attempt S4U2Self to obtain claim information security policy setting. |
| Microsoft network server: Digitally sign communications (always) | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network server: Digitally sign communications (always) security policy setting for SMBv3 and SMBv2. |
| SMBv1 Microsoft network server: Digitally sign communications (always) | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network server: Digitally sign communications (always) security policy setting for SMBv1 only. |
| SMBv1 Microsoft network server: Digitally sign communications (if client agrees) | Describes the best practices, location, values, policy management, and security considerations for the Microsoft network server: Digitally sign communications (if client agrees) security policy setting for SMBv1 only. |
| Microsoft network server: Disconnect clients when logon hours expire | Describes the best practices, location, values, and security considerations for the Microsoft network server: Disconnect clients when logon hours expire security policy setting. |
| Microsoft network server: Server SPN target name validation level | Describes the best practices, location, and values, policy management, and security considerations for the Microsoft network server: Server SPN target name validation level security policy setting. |
| Network access: Allow anonymous SID/Name translation | Describes the best practices, location, values, policy management, and security considerations for the Network access: Allow anonymous SID/Name translation security policy setting. |
| Network access: Do not allow anonymous enumeration of SAM accounts | Describes the best practices, location, values, and security considerations for the Network access: Do not allow anonymous enumeration of SAM accounts security policy setting. |
| Network access: Do not allow anonymous enumeration of SAM accounts and shares | Describes the best practices, location, values, and security considerations for the Network access: Do not allow anonymous enumeration of SAM accounts and shares security policy setting. |
| Network access: Do not allow storage of passwords and credentials for network authentication | Describes the best practices, location, values, policy management, and security considerations for the Network access: Do not allow storage of passwords and credentials for network authentication security policy setting. |
| Network access: Let Everyone permissions apply to anonymous users | Describes the best practices, location, values, policy management, and security considerations for the Network access: Let Everyone permissions apply to anonymous users security policy setting. |
| Network access: Named Pipes that can be accessed anonymously | Describes the best practices, location, values, policy management, and security considerations for the Network access: Named Pipes that can be accessed anonymously security policy setting. |
| Network access: Remotely accessible registry paths | Describes the best practices, location, values, policy management, and security considerations for the Network access: Remotely accessible registry paths security policy setting. |
| Network access: Remotely accessible registry paths and subpaths | Describes the best practices, location, values, and security considerations for the Network access: Remotely accessible registry paths and subpaths security policy setting. |
| Network access: Restrict anonymous access to Named Pipes and Shares | Describes the best practices, location, values, policy management, and security considerations for the Network access: Restrict anonymous access to Named Pipes and Shares security policy setting. |
| Network access: Restrict clients allowed to make remote calls to SAM | Describes the best practices, location, values, policy management, and security considerations for the Network access: Restrict clients allowed to make remote calls to SAM security policy setting. |
| Network access: Shares that can be accessed anonymously | Describes the best practices, location, values, policy management, and security considerations for the Network access: Shares that can be accessed anonymously security policy setting. |
| Network access: Sharing and security model for local accounts | Describes the best practices, location, values, policy management, and security considerations for the Network access: Sharing and security model for local accounts security policy setting. |
| Network security: Allow Local System to use computer identity for NTLM | Describes the location, values, policy management, and security considerations for the Network security: Allow Local System to use computer identity for NTLM security policy setting. |
| Network security: Allow LocalSystem NULL session fallback | Describes the best practices, location, values, and security considerations for the Network security: Allow LocalSystem NULL session fallback security policy setting. |
| Network security: Allow PKU2U authentication requests to this computer to use online identities | Describes the best practices, location, and values for the Network Security: Allow PKU2U authentication requests to this computer to use online identities security policy setting. |
| Network security: Configure encryption types allowed for Kerberos Win7 only | Describes the best practices, location, values, and security considerations for the Network security: Configure encryption types allowed for Kerberos Win7 only security policy setting. |
| Network security: Do not store LAN Manager hash value on next password change | Describes the best practices, location, values, policy management, and security considerations for the Network security: Do not store LAN Manager hash value on next password change security policy setting. |
| Network security: Force logoff when logon hours expire | Describes the best practices, location, values, policy management, and security considerations for the Network security: Force logoff when logon hours expire security policy setting. |
| Network security: LAN Manager authentication level | Describes the best practices, location, values, policy management, and security considerations for the Network security: LAN Manager authentication level security policy setting. |
| Network security: LDAP client signing requirements | This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for this policy setting. This information applies to computers running at least the Windows Server 2008 operating system. |
| Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Describes the best practices, location, values, policy management, and security considerations for the Network security: Minimum session security for NTLM SSP based (including secure RPC) clients security policy setting. |
| Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Describes the best practices, location, values, policy management, and security considerations for the Network security: Minimum session security for NTLM SSP based (including secure RPC) servers security policy setting. |
| Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication | Describes the best practices, location, values, management aspects, and security considerations for the Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication security policy setting. |
| Network security: Restrict NTLM: Add server exceptions in this domain | Describes the best practices, location, values, management aspects, and security considerations for the Network security: Restrict NTLM: Add server exceptions in this domain security policy setting. |
| Network security: Restrict NTLM: Audit incoming NTLM traffic | Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Audit incoming NTLM traffic security policy setting. |
| Network security: Restrict NTLM: Audit NTLM authentication in this domain | Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Audit NTLM authentication in this domain security policy setting. |
| Network security: Restrict NTLM: Incoming NTLM traffic | Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Incoming NTLM traffic security policy setting. |
| Network security: Restrict NTLM: NTLM authentication in this domain | Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: NTLM authentication in this domain security policy setting. |
| Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers | Describes the best practices, location, values, management aspects, and security considerations for the Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers security policy setting. |
| Recovery console: Allow automatic administrative logon | Describes the best practices, location, values, policy management, and security considerations for the Recovery console: Allow automatic administrative logon security policy setting. |
| Recovery console: Allow floppy copy and access to all drives and folders | Describes the best practices, location, values, policy management, and security considerations for the Recovery console: Allow floppy copy and access to all drives and folders security policy setting. |
| Shutdown: Allow system to be shut down without having to lg on | Describes the best practices, location, values, policy management, and security considerations for the Shutdown: Allow system to be shut down without having to log on security policy setting. |
| Shutdown: Clear virtual memory pagefile | Describes the best practices, location, values, policy management, and security considerations for the Shutdown: Clear virtual memory pagefile security policy setting. |
| System cryptography: Force strong key protection for user keys stored on the computer | Describes the best practices, location, values, policy management, and security considerations for the System cryptography: Force strong key protection for user keys stored on the computer security policy setting. |
| System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing | This security policy reference topic for the IT professional describes the best practices, location, values, policy management, and security considerations for this policy setting. |
| System objects: Require case insensitivity for non-Windows subsystems | Describes the best practices, location, values, policy management, and security considerations for the System objects: Require case insensitivity for non-Windows subsystems security policy setting. |
| System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Describes the best practices, location, values, policy management, and security considerations for the System objects: Strengthen default permissions of internal system objects (for example, Symbolic Links) security policy setting. |
| System settings: Optional subsystems | Describes the best practices, location, values, policy management, and security considerations for the System settings: Optional subsystems security policy setting. |
| System settings: Use certificate rules on Windows executables for Software Restriction Policies | Describes the best practices, location, values, policy management, and security considerations for the System settings: Use certificate rules on Windows executables for Software Restriction Policies security policy setting. |
| User Account Control: Admin Approval Mode for the Built-in Administrator account | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Admin Approval Mode for the Built-in Administrator account security policy setting. |
| User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop | Describes the best practices, location, values, and security considerations for the User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop security policy setting. |
| User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. |
| User Account Control: Behavior of the elevation prompt for standard users | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Behavior of the elevation prompt for standard users security policy setting. |
| User Account Control: Detect application installations and prompt for elevation | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Detect application installations and prompt for elevation security policy setting. |
| User Account Control: Only elevate executables that are signed and validated | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Only elevate executables that are signed and validated security policy setting. |
| User Account Control: Only elevate UIAccess applications that are installed in secure locations | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Only elevate UIAccess applications that are installed in secure locations security policy setting. |
| User Account Control: Run all administrators in Admin Approval Mode | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Run all administrators in Admin Approval Mode security policy setting. |
| User Account Control: Switch to the secure desktop when prompting for elevation | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Switch to the secure desktop when prompting for elevation security policy setting. |
| User Account Control: Virtualize file and registry write failures to per-user locations | Describes the best practices, location, values, policy management, and security considerations for the User Account Control: Virtualize file and registry write failures to per-user locations security policy setting. |