Five security settings that Windows needs to monitor most

In this article, we will examine 5 of the more important security settings in Windows systems. Listening to these settings ensures that your system is at the highest level of security.

The security of the Windows System environment is constantly changing, and whether your computer is newly assembled or has been running for years, it is likely that it does not meet the security standards that your organization requires. You need to monitor your computer for internal or external monitoring to find the incorrect security settings. If time is tight, you can primarily monitor several security settings that are most critical to Windows Active directory servers. The 5 more important security settings are described in detail in the following article.

Security for the Windows Active Directory directory service

I can say a few reasons to choose these security settings. First, these security settings are set correctly, which can help windows resist some of the usual attacks on the system. Second, some of the default security settings in the Windows system core are historically unsafe. If you don't set them up from the start or check them regularly, you may have been working on one or another computer with these unsafe defaults. Finally, according to my experience, these settings are usually ignored by the user and are not configured correctly. Even the so-called safe, sophisticated networks are the same.

1 Password Policy

The initial password policy for an Active directory domain is configured in the Default Domain Policy Group Policy object (GPO). There are several settings under this column, which should be set at least at the standard security level. You need to determine which values to set against your server security policy. If you do not have these values in your own security policy, you can refer to the recommended values in the following table:

　　

Table 1

By default, these settings are stored in the Default Domain Policy GPO, but should not be monitored from there, you should analyze tools such as DUMPSEC or the local security policy of a domain controller (running gpedit.msc on a domain controller). DumpSec will not collect complex requirements for passwords, and it collects that information in other ways. The local security policy provides all the information that listens to these settings.