Kebijakan Keamanan Pengaturan Komputer

Windows 10
Versi 1.0

PT xxxxxxxx
Halaman Sejarah Dokumen

Versio Tanggal keterangan

n
V 1.0 Xxxxx Pembuatan dokumen Kebijakan Keamanan Pengaturan Komputer Windows
10

Disusun oleh

Xxxxxx

Xxxxxxxxx

Disetujui Oleh

Xxxxxx

xxxxxxxxx
1.2.1) Password Policy: How To > Computer Configuration\Windows Settings\Security Settings\Account
Policies\Password Policy
9 passwords
Enforce password history
remembered
Maximum password age 90 days
Minimum password age 1 day
Minimum password length 10 characters
Password must meet complexity requirements Enabled
Store passwords using reversible encryption Disabled

1.2.2) Account Lockout Policy: How To > Computer Configuration\Windows

Settings\Security Settings\Account Policies\Account Lockout Policy
30 minutes (Account is locked out until
Account lockout duration
administrator unlocks it)

Account lockout threshold 5 invalid logon attempts

Reset account lockout counter after 30

Reset lockout counter after
minutes

1.2.3) List group dan membernya

Satu local administrator yang aktif

Administrators Built-in administrator dinonaktifkan
(password exipired)
Local user
Users
(password expired)

1.3) System Operations and Administration

1.3.1) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Account Logon

Audit Credential Validation Success, Failure

1.3.2) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Account Management

Audit Other Account Management Events Success, Failure

Audit Security Group Management Success, Failure
Audit User Account Management Success, Failure
1.3.3) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Detailed Tracking
Audit PNP Activity Success
Audit Process Creation Success
1.3.4) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff
Audit Account Lockout Success, Failure
Audit Group Membership Success
Audit Logoff Success
Audit Logon Success, Failure
Audit Special Logon Success
1.3.5) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Object Access
Audit Removable Storage Success, Failure
Audit File Share Success, Failure
Audit Other Object Access Events Success, Failure
1.3.6) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Policy Change

Audit Audit Policy Change Success, Failure

Audit Authentication Policy Change Success
Audit Authorization Policy Change Success
1.3.7) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\Privilege Use
Audit Sensitive Privilege Use Success, Failure
1.3.8) Audit Policy: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit
Policy\Advanced Audit Policy Configuration\System Audit Policies\System
Audit IPSec Driver Success, Failure
Audit Other System Events Success, Failure
Audit Security State Change Success
Audit Security System Extension Success, Failure
Audit System Integrity Success, Failure

1.4) Logging : Event Logs file size : How To > Computer

Configuration\Administrative Templates\Windows Components\Event Log Service\
{Application}{Security}{System}{Setup}
Maximum log size: 32768 KB
Application Log When maximum log size is reached:
Overwrite events as needed
Maximum log size: 196608 KB
Security Log When maximum log size is reached:
Overwrite events as needed
Maximum log size: 32768 KB
System Log When maximum log size is reached:
Overwrite events as needed

1.5) Security Options : How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Accounts: Administrator account status Disabled
Accounts: Block Microsoft accounts Users can’t add Microsoft accounts
Accounts: Guest account status Disabled
Accounts: Limit local account use of blank passwords to console logon only Enabled
Accounts: Rename administrator account dbsadmin
Accounts: Rename guest account W01guest
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category
Enabled
settings
Domain member: Digitally encrypt or sign secure channel data (always) Enabled
Domain member: Digitally encrypt secure channel data (when possible) Enabled
Domain member: Digitally sign secure channel data (when possible) Enabled
Domain member: Disable machine account password changes Disabled
Domain member: Maximum machine account password age 30 Days
Domain member: Require strong (Windows 2000 or later) session key Enabled
Interactive logon: Machine inactivity limit 900 seconds

Interactive logon: Number of previous logons to cache (in case domain controller is not available) 10 logons
Interactive logon: Prompt user to change password before expiration 14 days
Interactive logon: Require Domain Controller authentication to unlock workstation Disabled
Interactive logon: Smart card removal behavior Lock Workstation
Microsoft network server: Amount of idle time required before suspending session 15 minutes
Microsoft network server: Disconnect clients when logon hours expire Enabled
Microsoft network client: Digitally sign communications (always) Enabled
Microsoft network client: Digitally sign communications (if server agrees) Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers Disabled
Microsoft network server: Digitally sign communications (always) Enabled
Microsoft network server: Digitally sign communications (if Client agrees) Enabled
Microsoft network server: Server SPN target name validation level Accept if provided by client
Network access: Allow anonymous SID/Name translation Disabled
Network access: Do not allow anonymous enumeration of SAM accounts Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares Enabled
Network access: Do not allow storage of passwords and credentials for network authentication Enabled
Network access: Let Everyone permissions apply to anonymous users Disabled
Network access: Named Pipes that can be accessed anonymously (None)
Network access: Restrict anonymous access to Named Pipes and Shares Enabled
Network access: Shares that can be accessed anonymously (None)
Classic – Local users authenticate as
Network access: Sharing and security model for local accounts
themselves
Network security: Allow Local System to use computer identity for NTLM Enabled
Network security: Allow LocalSystem NULL session fallback Disabled
Network Security: Allow PKU2U authentication requests to this computer to use online identities Disabled
Enabled: RC4_HMAC_MD5
AES128_HMAC_SHA1
Network Security: Configure encryption types allowed for Kerberos
AES256_HMAC_SHA1
Future Encryption Types
Network security: Do not store LAN Manager hash value on next password change Enabled
Network security: Force logoff when logon hours expire Enabled
Send NTLMv2 Response only.
Network security: LAN Manager authentication level
Refuse LM and NTLM
Network security: LDAP client signing requirements Negotiate Signing
Require NTLMv2 session security,
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
Require 128-bit encryption
Require NTLMv2 session security,
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
Require 128-bit encryption
Recovery console: Allow automatic administrative logon Disabled
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Disabled

System objects: Require case insensitivity for non-Windows subsystems Enabled

System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links) Enabled
User Account Control: Admin Approval Mode for the Built-in Administrator account Enabled
 Prompt for consent on the secure
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
desktop
User Account Control: Behavior of the elevation prompt for standard users Prompt for credentials
User Account Control: Detect application installations and prompt for elevation Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations Enabled
User Account Control: Run all administrators in Admin Approval Mode Enabled
User Account Control: Virtualize file and registry write failures to per-user locations Enabled

1.6) User Rights: How To > Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Access Credential Manager as a trusted caller Not Defined
Access this computer from the network Administrators, Authenticated Users
Act as part of the operating system (None)
Adjust memory quotas for a process Administrators, Local Service, Network Service
Allow log on locally Administrators, Users
Back up files and directories Administrators
Change the system time LOCAL SERVICE, Administrators
Create a pagefile Administrators
Create a token object (None)
Administrators, LOCAL SERVICE, NETWORK SERVICE,
Create global objects
SERVICE
Create permanent shared objects (None)
Create Symbolic Links Administrators
Debug programs Administrators
Deny access to this computer from the network Guests
Guests
Deny log on as a batch job

Guest
Deny log on as a service

LOCAL SERVICE
Replace a process level token
NETWORK SERVICE  
Guests
Deny log on locally

Deny log on through Remote Desktop Services Guests

Enable computer and user accounts to be trusted for delegation (None)
Force shutdown from a remote system Administrators
Generate security audits Network Service, Local Service
Impersonate a client after authentication Administrators, SERVICE, Local Service, Network Service
Increase scheduling priority Administrators
Load and unload device drivers Administrators
Lock pages in memory (None)
Manage auditing and security log Administrators
Modify an object label (None)
Modify firmware environment values Administrators
Perform volume maintenance tasks Administrators
Profile single process Administrators
Replace a process level token Network Service, Local Service
Restore files and directories Administrators
Take ownership of files or other objects Administrators

1.7) Pengaturan lainnya

Allow Windows to automatically connect
to suggested open hotspots, to
Set to Disable
networks shared by contacts, and to
hotspots offering paid services
Enable insecure guest logons
Prohibit use of Internet Connection
Sharing on your DNS domain network
Computer Configuration\Administrative
Templates\Network\WLAN Service\WLAN Settings
Computer Configuration\Administrative
Set to Disable
Templates\Network\Lanman Workstation
Computer Configuration\Administrative
Set to Enable
Templates\Network\Network Connections
Set to Enable and Computer Configuration\Administrative
show following Templates\Network\Network Provider
configured in
Hardened UNC Paths

Value Name:
\\*\SYSVOL
Value:
RequireMutualAuthenti
Hardened UNC Paths cation=1,
RequireIntegrity=1

Value Name:
\\*\NETLOGON
Value:
RequireMutualAuthenti
cation=1,
RequireIntegrity=1
Set to Enable with Computer Configuration\Administrative
“ECC Curve Order” Templates\Network\SSL Configuration Settings
ECC Curve Order
NistP384
NistP256
Minimize the number of simultaneous Computer Configuration\Administrative
connections to the Internet or a Set to Enable Templates\Network\Windows Connection Manager
Windows Domain
Prohibit connection to non-domain Computer Configuration\Administrative
networks when connected to domain Set to Enable Templates\Network\Windows Connection Manager
authenticated network
Include command line in process Computer Configuration\Administrative
Set to Enable
creation events Templates\System\Audit Process Creation
Remote host allows delegation of non- Computer Configuration\Administrative
Set to Enable
exportable credentials Templates\System\Credentials Delegation
Set to Enable Computer Configuration\Administrative
Templates\System\Group Policy
Select “Process even if
Configure registry policy processing
the Group Policy
objects have not
changed”
Computer Configuration\Administrative
Turn off downloading of print drivers
Set to Enable Templates\System\Internet Communication
over HTTP
Management\Internet Communication settings
Computer Configuration\Administrative
Turn off Internet download for Web
Set to Enable Templates\System\Internet Communication
publishing and online ordering wizards
Management\Internet Communication settings
Configure Solicited Remote Assistance Set to Disable Computer Configuration\Administrative

Enumerate local users on domain-joined
Set to Disable
computers
Turn on convenience PIN sign-in
Do not display network selection UI
Turn off printing over HTTP
Untrusted Font Blocking
Require a password when a computer
wakes (on battery)
Require a password when a computer
wakes (plugged in)
Enable RPC Endpoint Mapper Client
Authentication
Restrict Unauthenticated RPC clients
Allow Microsoft accounts to be optional
Prevent downloading of enclosures
Turn on Basic feed authentication over
HTTP
Allow indexing of encrypted files
Allow user control over installs
Always install with elevated privileges
Prevent Internet Explorer security
prompt for Windows Installer scripts
Sign-in last interactive user
automatically after a system-initiated
restart
Turn off Inventory Collector
Set the default behavior for AutoRun
Turn off Autoplay
Turn off toast notifications on the lock
screen
Disallow Autoplay for non-volume
devices
Turn off Microsoft consumer
experiences
Enumerate administrator accounts on
elevation
Download Mode
Do not allow passwords to be saved
Templates\System\Remote Assistance
Computer Configuration\Administrative
Templates\System\logon
Computer Configuration\Administrative
Set to Enable
Templates\System\logon
Computer Configuration\Administrative
Set to Enable
Templates\System\logon
Computer Configuration\Administrative
Set to Enable Templates\System\Internet Communication
Management\Internet Communication settings
Set to Enable, block Computer Configuration\Administrative
untrusted fonts and Templates\System\Mitigation Options
log events
Computer Configuration\Administrative
Set to Enable Templates\System\Power Management\Sleep
Settings
Computer Configuration\Administrative
Set to Enable Templates\System\Power Management\Sleep
Settings
Computer Configuration\Administrative
Set to Enable
Templates\System\Remote Procedure Call
Set to Enable, Computer Configuration\Administrative
Authenticated Templates\System\Remote Procedure Call
Computer Configuration\Administrative
Set to Enable
Templates\Windows Components\App Runtime
Computer Configuration\Administrative
Set to Enable
Templates\Windows Components\RSS Feeds
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\RSS Feeds
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\Search
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\Windows Installer
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\Windows Installer
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\Windows Installer
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Logon
Options
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Application
Compatibility
Set to Enable / Do not Computer Configuration\Administrative
execute any autorun Templates\Windows Components\AutoPlay Policies
commands
Computer Configuration\Administrative
Set to Enable
Templates\Windows Components\AutoPlay Policies
User Configuration\Administrative Templates\Start
Set to Enable
Menu and Taskbar\Notifications
Computer Configuration\Administrative
Set to Enable
Templates\Windows Components\AutoPlay Policies
Computer Configuration\Administrative
Set to Enable
Templates\Windows Components\Cloud Content
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Credential User
Interface
Computer Configuration\Administrative
Set to Not Configured Templates\Windows Components\Delivery
Optimization
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Remote Desktop
Services\Remote Desktop Connection Client

Do not allow drive redirection
Always prompt for password upon
connection
Require secure RPC communication
Set client connection encryption level
Enable screen saver
Password protect the screen saver
Screen Saver time out
Prevent enabling lock screen camera
Prevent enabling lock screen slide show Set to Enable
Turn off Data Execution Prevention for
Explorer
Turn off heap termination on corruption Set to Disable
Turn off shell protocol protected mode Set to Disable
Do not preserve zone information in file
attachments
Allow clearing browsing data on exit
Allow InPrivate browsing
Configure Password Manager
Enables or disables Windows Game
Recording and Broadcasting
Turn on PowerShell Script Block
Logging
Allow Basic authentication
Allow unencrypted traffic
Disallow Digest authentication
Allow Basic authentication
Allow unencrypted traffic
Disallow WinRM from storing RunAs
credentials
Computer Configuration\Administrative
Templates\Windows Components\Remote Desktop
Set to Enable
Services\Remote Desktop Session Host\Device and
Resource Redirection
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Remote Desktop
Services\Remote Desktop Session Host\Security
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Remote Desktop
Services\Remote Desktop Session Host\Security
Computer Configuration\Administrative
Set to Enable and High
Templates\Windows Components\Remote Desktop
level
Services\Remote Desktop Session Host\Security
User Configuration\Administrative Templates\Control
Set to Enable
Panel\Personalization
User Configuration\Administrative Templates\Control
Set to Enable
Panel\Personalization
Set to Enable (15 User Configuration\Administrative Templates\Control
minutes) Panel\Personalization
Computer Configuration\Administrative
Set to Enable
Templates\Control Panel\Personalization
Computer Configuration\Administrative
Templates\Control Panel\Personalization
Computer Configuration\Administrative
Set to Disable
Templates\Windows Components\File Explorer
Computer Configuration\Administrative
Templates\Windows Components\File Explorer
Computer Configuration\Administrative
Templates\Windows Components\File Explorer
User Configuration\Administrative
Set to Disable Templates\Windows Components\Attachment
Manager
User Configuration\Administrative
Set to Disable
Templates\Windows Components\Microsoft Edge
User Configuration\Administrative
Set to Disable
Templates\Windows Components\Microsoft Edge
User Configuration\Administrative
Set to Disable
Templates\Windows Components\Microsoft Edge
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Game
Recording and Broadcasting
User Configuration\Administrative
Set to Enable Templates\Windows Components\Windows
PowerShell
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Client
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Client
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Client
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Service
Computer Configuration\Administrative
Set to Disable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Service
Computer Configuration\Administrative
Set to Enable Templates\Windows Components\Windows Remote
Management (WinRM)\WinRM Service
 Pengaturan
System Value/Parameter yang Cara pengimplementasiannya
Disetujui
All Removable Storage Configuration/Administrative Template/System/Removable Storage Access
Enabled
Classes: Deny All access
Removable Storage Disks: Configuration/Administrative Template/System/Removable Storage Access
Enabled
Deny read access
Removable Storage Disks: Configuration/Administrative Template/System/Removable Storage Access
Enabled
Deny write access
CD and DVD: Deny read Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
CD and DVD: Deny write Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
Floppy Drives: Deny read Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
Floppy Drives: Deny write Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
Tape Drives: Deny read Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
Tape Drives: Deny write Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
WPD Devices: Deny read Configuration/Administrative Template/System/Removable Storage Access
Enabled
access
WPD Devices: Deny write Configuration/Administrative Template/System/Removable Storage Access
Enabled
access

Pengaturan
System Value/Parameter yang
Disetujui
System Value/Parameter DBS Agreed to Setting
USB Storage harus disetting
Set REG_DWORD : 4 (Dec)
Deny
- Grant only to Administrators
- Deny to SYSTEM Group
Cara pengimplementasiannya
How to Implement
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Usb
Stor
%SystemRoot%\Inf\Usbstor.pnf
%SystemRoot%\Inf\Usbstor.inf

Pengaturan tambahan untuk Health Check (setahun dua kali)

Antivirus  automatic update, scheduled automatic scan

Windows update and Patches history  automatic update

Web filtering  block akses internet ke web mail (Hotmail, yahoo, gmail, dan lainnya), storage website
(box, mega, dropbox, icloud, dan lainnya), dan social media (facebook, googleplus, dan lainnya)

Windows properties

Pengaturan email

Contoh perpindahan data sensitive (dienkripsi)

Durasi Screen Saver di lock

Shared folder  IP$C

Software installed  *xxxxxxdiganti sesuai komputerxxxxx*

Last change password Date (net user di CMD)