Group Policy
Collected Group Policy objects and the domain password & lockout policy measured against your baseline.
Password & lockout baseline
Domain policy snapshot 2026-10-22 16:18:00 UTC · targets from Settings
Minimum password length
Domain policy requires 12 characters
Target: At least 12 characters
Password complexity
Complexity requirement is enabled
Target: Enabled
Maximum password age
Passwords expire after 90 days
Target: 1–90 days
Account lockout threshold
Accounts lock after 5 failed attempts
Target: 1–5 attempts
Lockout duration
Locked accounts stay locked 15 minutes
Target: At least 30 minutes
Group Policy objects 12 in latest snapshot
Audit Collection
Linked to example.com · modified 2026-08-26
All settings
- Advanced audit: Logon
- Success, Failure
- Advanced audit: User account management
- Success, Failure
- Advanced audit: Security group management
- Success
- Advanced audit: Audit policy change
- Success
- Event forwarding subscription
- https://collector.example.com:5986
Browser Security
Linked to example.com/Workstations · modified 2026-08-08
All settings
- SmartScreen
- Enabled
- Block third-party cookies
- Enabled
- Extension install allow-list
- Managed list only
- Password manager
- Disabled
Default Domain Controllers Policy
Linked to example.com/Domain Controllers · modified 2026-09-13
All settings
- Audit account logon events
- Success, Failure
- Audit directory service changes
- Success
- Audit policy change
- Success, Failure
- Allow log on locally
- Administrators, Backup Operators, EXAMPLE\[excluded]
- LDAP server signing requirements
- Require signing
- Security log maximum size
- 4194240 KB
Default Domain Policy
Linked to example.com · modified 2026-09-22
All settings
- Minimum password length
- 12
- Password must meet complexity requirements
- Enabled
- Maximum password age
- 90 days
- Minimum password age
- 1 day
- Enforce password history
- 24 passwords
- Account lockout threshold
- 5 invalid attempts
- Account lockout duration
- 15 minutes
- Reset lockout counter after
- 15 minutes
- Kerberos max ticket lifetime
- 10 hours
Drive Encryption
Linked to example.com/Workstations · modified 2026-07-12
All settings
- BitLocker OS drive
- Required, XTS-AES 256
- BitLocker fixed drives
- Required
- Recovery key escrow
- Active Directory
- Removable drives
- Deny write unless encrypted
Endpoint Protection
Linked to example.com/Workstations · modified 2026-07-30
All settings
- Real-time protection
- Enabled
- Cloud-delivered protection
- Enabled
- Attack surface reduction rules
- Block mode
- Tamper protection
- Enabled
Legal Workstations
Linked to example.com/Workstations/Legal · modified 2026-07-03
All settings
- Document Access mapped drive
- L:
- Printer deployment
- LEX-PRN-01 Legal
- Office macro policy
- Signed macros only
Remote Access
Linked to example.com/Workstations · modified 2026-08-17
All settings
- Always On VPN profile
- Deployed
- Require NLA for RDP
- Enabled
- RDP session idle limit
- 30 minutes
- Allowed VPN group
- VPN Users
Screen Lock
Linked to example.com/Workstations · modified 2026-07-21
All settings
- Machine inactivity limit
- 900 seconds
- Screen saver password protected
- Enabled
- Interactive logon message
- Authorised use only
Server Baseline
Linked to example.com/Servers · modified 2026-06-24
All settings
- Remote Desktop access
- Server Operators
- Windows Update deadline
- 3 days
- PowerShell script block logging
- Enabled
- Credential Guard
- Enabled with UEFI lock
Software Updates
Linked to example.com/Workstations · modified 2026-06-15
All settings
- Quality update deferral
- 3 days
- Feature update deferral
- 60 days
- Active hours
- 07:00–19:00
- Restart deadline
- 2 days
Workstation Hardening
Linked to example.com/Workstations · modified 2026-10-19
All settings
- Windows Defender Firewall: domain profile
- On
- Turn off Autoplay
- All drives
- SMBv1 client driver
- Disabled
- LAN Manager authentication level
- NTLMv2 only, refuse LM & NTLM
- Rename administrator account
- Enabled