Windows Security

Account Policy / Password Policy

Length, Complex, Max days, Remember password, Min days

Create account: net user <username> <password> /add

Example: net user abc 123456 /add

Delete account: net user <username> /delete

Account Policy / Account Lockout Policy

Account lockout duration: after reach the try time limit, lock time

Account lockout threshold: try time limit

Reset account lockout counter after: after some time, the lockout counter will be clean

Local Policy / Audit Policy

Audit account logon events: record the login fail or success

Audit account management: record the account change: create, delete, change group ...

Audit object access: record the file access or directory access success or fail (need to add audit user in file or directory properties)

Local Policy / User Rights Assignment

Access this computer from the network: control the account to visit the share folder to login by network

Force shutdown from a remote system: control to shutdown computer from remote desktop connection

Change the system time: give power to change system time 

Deny log on locally: the account only can use to visit the share resource but can not log in the server

Deny access to this computer from the network

Local Policy / Security Options

Shutdown: Allow system to be shut down without having to log on

Interactive logon: Do not display last user name

Accounts: Limit local account use of blank passwords to console logon only

Software Restriction Policies (Need Restart)

Additional Rules \ New Hash Rule: define the exe file can not be execute

Additional Rules \ New Path Rule: define the all the file in this path can not be execute

Group Policy(gpedit.msc)

Computer Configuration \ Administrative Templates \ AutoPlay Policies

1. Turn off Autoplay: close the autoplay feature

2. Default behavior for AutoRun: disable the autorun script

User Configuration \ Administrative Templates \ Systems 

1. Prevent access to registry editing tools

2. Don't run specifiied Windows applications: prevent application running by the execution file name

Computer Configuration \ Administrative Templates \ Windows Components \ Windows Logon Options

1. Display information about previous logons during user logon

When user login the server, system send out email automatically

1. write send email script;

2. set the script to following position

User Configuration \ Windows Settings \ Scripts(Logon/Logoff)

Put the script in the path: C:\Windows\System32\GroupPolicy\User\Scripts\Logon