Blog Post

Microsoft Security Baselines Blog
6 MIN READ

Windows 11, version 24H2 security baseline

Rick_Munck's avatar
Rick_Munck
Icon for Microsoft rankMicrosoft
Oct 01, 2024

Microsoft is pleased to announce the release of the security baseline package for Windows 11, version 24H2!

 

Please download the content from the Microsoft Security Compliance Toolkit, test the recommended configurations, and customize / implement as appropriate.

 

This release includes several changes to further assist in the security of enterprise customers, including additional protections to LAN Manager, Kerberos, User Account Control, Microsoft Defender Antivirus updates, and more.

 

Mark of the Web

You may have seen previous discussions on the Mark of the Web (MotW) within our baselines at some point. A new setting has been added and configured, located at Windows Components\File Explorer\Do not apply the Mark of the Web tag to files copied from insecure sources. This new setting will be enforced with a value of Disabled. This adds the MotW when  copying a file from a network share (in the Internet Zone) into the local file system. If necessary, Zone Mapping can be used to map any file shares that are deemed trusted into the Trusted/Intranet Zones.

 

LAN Manager

For each release, we conduct a complete review of settings as part of our security baseline. Based on the latest review, we are updating our recommended settings for LAN Manager (Lanman) including Lanman Server and Lanman Workstation.

  • Network\Lanman Server
    • Audit client does not support encryption – set to a value of Enabled
    • Audit client does not support signing – set to a value of Enabled
    • Audit insecure guest logon – set to a value of Enabled
    • Enable authentication rate limiter – set to a value of Enabled
    • Enable remote mailslots – set to a value of Disabled
    • Mandate the maximum version of SMB – set to a value of Enabled: SMB 3.1.1
    • Mandate the minimum version of SMB – set to a value of Enabled: SMB 3.0.0
    • Set authentication rate limiter delay (milliseconds) – set to a value of Enabled: 2000
  • Network\Lanman Workstation
    • Audit insecure guest logon – set to a value of Enabled
    • Audit server does not support encryption – set to a value of Enabled
    • Audit server does not support signing - set to a value of Enabled
    • Enable remote mailslots – set to a value of Disabled
    • Mandate the maximum version of SMB – set to a value of Enabled: SMB 3.1.1
    • Mandate the minimum version of SMB – set to a value of Enabled: SMB 3.0.0
    • Require Encryption – set a value of Disabled

 

Configure hash algorithms for certificate logon

A new setting, located at System\KDC and System\Kerberos, has been added for smart card crypto agility. This setting lets users configure the hash algorithm to be used in certificate-based smart card (PKINIT) authentication of Kerberos. With this configuration, customers have the option to prevent SHA-1 from being used. The security baseline recommends support for SHA-256, SHA-384, and SHA-512, but does not recommend support for SHA-1. It’s important to note these settings are useful only if both the client and KDC (Windows Server 2025) are configured this way in the environment.

 

Sudo command

Located at System\Configure the behavior of the sudo command, this setting allows the customization of how the sudo command operates. Sudo for Windows can be used as a potential escalation of privilege vector when enabled in certain configurations. The baseline configures this setting to a value of Disabled, which disables sudo for Windows.

 

Microsoft Defender Antivirus

Microsoft Defender Antivirus (MDAV) plays a critical part in our security story. We are constantly making improvements to the product and have included six new settings in this release.

  • Windows Components\Microsoft Defender Antivirus\Control whether exclusions are visible to local users – set to a value of Enabled
  • Windows Components\Microsoft Defender Antivirus\Features\Enable EDR in block mode – set to a value of Enabled
  • Windows Components\Microsoft Defender Antivirus\Network Inspection System\Convert warn verdict to block – set to a value of Enabled
  • Windows Components\Microsoft Defender Antivirus\Real-time Protection\Configure real-time protection and Security Intelligence Updates during OOBE – set to a value of Enabled
  • Windows Components\Microsoft Defender Antivirus\Reporting\Configure whether to report Dynamic Signature dropped events – set to a value of Enabled
  • Windows Components\Microsoft Defender Antivirus\Scan\Scan excluded files and directories during quick scans – set to a value of Enabled: 1

 

Please ignore below edited section in the Windows 11 24H2 Security Baseline Release Notes.pdf that is contained in the Download Center Package. Please refer to the updated section below on Administrator protection.

 

User Account Control

Two settings affecting User Account Control have been added.

  • Enhanced Privilege Protection Mode helps provide an additional layer of protection against malware and other threats by isolating sensitive data and processes. Located in the security template at Security Options\Behavior of the elevation prompt for administrators in Enhanced Privilege Protection Mode, the baseline configures this setting to Prompt for credentials on secure desktop.
  • A second policy controls whether enhanced privilege protection is applied to admin approval mode elevations. Located in the security template at  Security Options\Configure type of Admin Approval Mode, we recommend setting this to a value of Admin Approval Mode with enhanced privilege protection.

Update: We were so excited about these new settings and feature around Administrator protection that we jumped the gun before things were fully ready! While the security settings are visible in the release they are not yet functional. Administrator protection is an upcoming feature in Windows 11 which protects free floating admin rights for administrator users allowing them to still perform all admin functions with just-in-time admin privileges. This feature is available now to Windows Insiders.

 

Additional items worth considering

The following settings should be evaluated based on your environment.

 

Delegated Managed Service Account (dMSA)

We have introduced a new policy called Enable delegated Managed Service Account (dMSA) Logons which is located at System\Kerberos. This controls dMSA logons for the machine. If you enable this policy setting, dMSA logons will be supported by the Kerberos client. Please review the prerequisites before adjusting the policy setting.

 

By default, dMSA is disabled because the Domain Controller (DC) must also be upgraded to Windows Server 2025 for the feature to function properly. If the DC is running a version earlier than Server 2025, the necessary schema updates for dMSA will not be present.

 

If your DC has been upgraded to Windows Server 2025, we suggest enabling this policy on both the client and DC sides. When enabled, you may need to specify realms, i.e., which domains or parts of the directory can authenticate and access the dMSA account. A child domain on an older server version can still interact with the accounts while maintaining security boundaries. It allows for a smoother transition and coexistence of features across a mixed-version environment. For example, if you have a primary domain called corp.contoso.com running on Windows Server 2025 and an older child domain called legacy.corp.contoso.com running on an older version of Windows Server (e.g., Windows Server 2022), you may specify the realm as legacy.corp.contoso.com. To learn more, see Setting up delegated Managed Service Accounts (dMSA) in Windows Server 2025.

 

Windows Protected Print

Windows Protected Print (WPP) is the new, modern and more secure print for Windows built from the ground up with security in mind. WPP blocks 3rd party drivers and hardens the entire print stack from attacks. WPP is designed to work with Mopria certified printers. While not yet configured in the security baseline, we recommend you consider the setting Printers\Configure Windows protected print as later versions of the baselines will look to enable this very important feature. You can learn more about the security benefits in our blog post.

 

Microsoft Defender Antivirus

There are several Microsoft Defender Antivirus (MDAV) settings we recommend you consider.

  • Windows Components\Microsoft Defender Antivirus\Real-time Protection\Configure performance mode status is beneficial for developers who utilize Dev Drive on Windows 11. More information on Dev Drive can be found here.

The following two settings are specific to VDI environments.

  • Windows Components\Microsoft Defender Antivirus\Network Inspection System\Turn on asynchronous inspection helps to ensure there is no slowdown in the detection process.
  • Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates\Configure security intelligence updates according to the scheduler for VDI clients controls the flow of the SIUs.

 

Other changes

We have decided to remove System\Group Policy\Configure registry policy processing from the security baseline after feedback from our support engineers on the numerous issues that were being traced back to it.

 

Several minor discrepancies between the documentation and group policies were noted since the last release. These should all be addressed going forward.

 

Please let us know your thoughts by commenting on this post or through the Security Baseline Community.

Updated Dec 03, 2024
Version 5.0
compliance
final
guides
security
security baseline
security compliance toolkit
updates
windows
  • MEB2004's avatar
    MEB2004
    Copper Contributor
    Oct 21, 2024

    AaronMargosis_Tanium Thank you for testing the UNC path issue. My case has been open for seven weeks now. I hope I get the 24H2 security baseline soon and it solves this issue. Also, I appreciate the explanation on the Defender registry permissions.

  • Rick_Munck's avatar
    Rick_Munck
    Icon for Microsoft rankMicrosoft
    Oct 03, 2024

    TomPowell there are still some LTSC versions out there that have IE11 on them. We carry them forward so they don't have to go hunt for it

  • Rick_Munck's avatar
    Rick_Munck
    Icon for Microsoft rankMicrosoft
    Oct 04, 2024

    HotCakeX looks like you found a good one. After research it appears the cause of this is that the ADMX is pointing to "Software\Policies\Microsoft\Windows Defender\NIS" but it should be pointing to "Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection"

     

    I don't have an ETA to share but it is now tracked and being worked to fix.

     

    Thanks for catching this!

  • HotCakeX's avatar
    HotCakeX
    MVP
    Oct 05, 2024

    Rick_Munck My pleasure, Thanks for checking it quickly and confirming it.

     

    by the way, there is another policy called "Apply UAC restrictions to local accounts on network logons" and it is located at "Computer Configuration\Administrative Templates\MS Security Guide"

     

    Since 23H2 baselines, and now in 24H2 baselines, it is set to "Disabled" state which is an insecure state. By default, it is enabled in Windows and it should remain enabled imho.

     

    This makes all network logins an admin without having to do token elevation (User account control confirmation).


    Please keep this at the default state or enabled.

    Disabling this option is only for super legacy Windows XP and older compatibility, starting Vista and above, this should never be disabled.

     

    Here is the description of it:

     

    This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.).

     

    Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Enabling this policy significantly reduces that risk.

     

    Enabled (recommended): Applies UAC token-filtering to local accounts on network logons. Membership in powerful group such as Administrators is disabled and powerful privileges are removed from the resulting access token. This configures the LocalAccountTokenFilterPolicy registry value to 0. This is the default behavior for Windows.

     

    Disabled: Allows local accounts to have full administrative rights when authenticating via network logon, by configuring the LocalAccountTokenFilterPolicy registry value to 1.

     

    For more information about local accounts and credential theft, see "Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques":

    http://www.microsoft.com/en-us/download/details.aspx?id=36036.

     

    For more information about LocalAccountTokenFilterPolicy, see

    http://support.microsoft.com/kb/951016.

     


     

  • Rick_Munck's avatar
    Rick_Munck
    Icon for Microsoft rankMicrosoft
    Oct 28, 2024

    Sebocat I would drop this from previous configurations as well based on what I was briefed on.

     

    I did go back and pull a few of the references I was provided, here are some of the sanitized summaries.

    • Windows Firewall: Randomly drops all inbound connections, blocking traffic allowed by GPO
    • Windows Firewall: On boot the firewall profile state is not as defined in the GPO
    • Windows Firewall: Active on 'Domain/Private/Public profile' despite specific GPO 'Windows Firewall: Protect all network connections = Disabled
  • Rick_Munck's avatar
    Rick_Munck
    Icon for Microsoft rankMicrosoft
    Oct 01, 2024

    katPedraza the content distro is replicating...  It should be up soon if not already, all depends on the magic of where you are and when it hits unfortunately.

  • Rick_Munck's avatar
    Rick_Munck
    Icon for Microsoft rankMicrosoft
    Oct 02, 2024

    MikkelLundKnudsen I cannot give you a date but what I can say is that we turned the baseline over to the team to start the conversion process as soon as we completed our work. It typically does take some time for the conversion to occur but I know we are working to close that gap with each release.

  • AaronMargosis_Tanium's avatar
    AaronMargosis_Tanium
    Iron Contributor
    Oct 03, 2024

    TomPowell Rick_Munck -- also, I believe site-to-zone mapping still matters, as do the per-zone security settings. And I believe there are still Windows (and third-party) components that use the underlying tech that IE relied on.