Forum Widgets
Latest Discussions
Microsoft Policy Analyzer 4.0 crashes after apply April updates
Good morning community !! After apply security/.NET patches corresponding to April, the policy analyzer is not working anymore... On details See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. ************** Exception Text ************** Deleted because system do not permit to publish it ************** Loaded Assemblies ************** mscorlib Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll ---------------------------------------- PolicyAnalyzer Assembly Version: 4.0.2004.13001 Win32 Version: 4.0.2004.13001 CodeBase: file:///C:/Personal/PolicyAnalyzer/PolicyAnalyzer/PolicyAnalyzer_40/PolicyAnalyzer.exe ---------------------------------------- System.Windows.Forms Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll ---------------------------------------- System Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll ---------------------------------------- System.Drawing Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll ---------------------------------------- System.Configuration Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll ---------------------------------------- System.Xml Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll ---------------------------------------- Accessibility Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/Accessibility/v4.0_4.0.0.0__b03f5f7f11d50a3a/Accessibility.dll ---------------------------------------- System.Core Assembly Version: 4.0.0.0 Win32 Version: 4.8.9032.0 built by: NET481REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll ---------------------------------------- ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer (machine.config) must have the jitDebugging value set in the system.windows.forms section. The application must also be compiled with debugging enabled. For example: <configuration> <system.windows.forms jitDebugging="true" /> </configuration> When JIT debugging is enabled, any unhandled exception will be sent to the JIT debugger registered on the computer rather than be handled by this dialog box. It was working fine since patching apply. I tried to uninstall patches, but the error still remains Any clue to fix this? Thank you !!SolvedAngelParedero23Apr 10, 2025Copper Contributor2.2KViews1like18CommentsSecurity Baseline for Server 2025 is missing ADMX/ADML files?
I imported the new "Windows Server 2025 Security Baseline" into our AD using Baseline-ADImport.ps1. Not a problem. From the "Templates" folder, I copied the SecGuide.admx and MSS-Legacy.admx files, along with the en-US folder to our central store in SYSVOL, as normal (backed upp the files I replace first). When checking the GPOs in Group Policy Management though, I see a lot of "Extra Registry Settings" which would indicate that its missing a admx/adml file or similar. I've verified that neither of the included files i copied includes anything about the missing registry settings. For MSFT Windows Server 2025 - Member Server, there is a whole list of Extra Registry Settings. What am I missing here? Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled 1 Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1 1 Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256 3 Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384 3 Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512 3 Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabled 1 Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1 1 Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256 3 Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384 3 Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512 3 Software\Policies\Microsoft\Windows NT\Printers\RPC\ForceKerberosForRpc 0 Software\Policies\Microsoft\Windows NT\Printers\RPC\RpcProtocols 5 Software\Policies\Microsoft\Windows\Bowser\EnableMailslots 0 Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption 1 Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning 1 Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon 1 Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter 1 Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs 2000 Software\Policies\Microsoft\Windows\LanmanServer\MinSmb2Dialect 768 Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon 1 Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption 1 Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning 1 Software\Policies\Microsoft\Windows\LanmanWorkstation\MinSmb2Dialect 768 Software\Policies\Microsoft\Windows\NetworkProvider\EnableMailslots 0 Software\Policies\Microsoft\Windows\System\AllowCustomSSPsAPs 1 Software\Policies\Microsoft\Windows\System\RunAsPPL 1SolvedTurraniusFeb 12, 2025Copper Contributor1.6KViews0likes5CommentsConfusing Naming of Intune M365 Apps Baseline
Hi, To which Office Apps does the exisiting ( and only)"Microsoft 365 Apps for Enterprise Security Baseline" apply to? Its says Version 2306When I create a profile I get this information within the baseline So this baseline only applies to Office 2016? If yes, how do I protect the M365 Office Apps?SolvedheinzelrumpelFeb 12, 2025Brass Contributor181Views0likes1CommentPolicy Analyzer - Compare all settings
Is there a way on the Policy Analyzer to include comparison for all 3000+ GPO settings?SolvedjemfernandezJun 28, 2023Copper Contributor17KViews0likes9CommentsHash
Hello, Where I can find the hash files (Policy Analyzer, LGPO...)? Thank you for your help. Have a good day VALADE RauminSolvedRaumin19Apr 19, 2023Copper Contributor2.1KViews0likes2CommentsExplanation about redirection guard
Hello, I need some explanation about redirection guard. https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-printers#configureredirectionguardpolicy What is the additional protection if this setting is enabled ? What kind of attacks are prevented ? Regards.SolvedLe_MichelMar 29, 2023Brass Contributor8.2KViews0likes1CommentMicrosoft Edge v100 InTune Policy's
Hi All, Really pleased to finally see the setting "Hide restore pages dialog after browser crash" included in the new v100 release. However, The setting isn't available in InTune Endpoint Device Manager policy's (Settings Catalogue). Do you know when to expect the updated settings options would be available in the InTune policies as a general rule of thumb? I.e. new policies are available after a few weeks after version release? Many thanks all.SolvedMarkRobinson157Apr 14, 2022Copper Contributor1.6KViews0likes3CommentsMisleading instructions in Baseline-LocalInstall
Requirements in Baseline-LocalInstall.ps1 say that: REQUIREMENTS: * PowerShell execution policy must be configured to allow script execution; for example, with a command such as the following: Set-ExecutionPolicy RemoteSigned However, it's not signed, so it is not possible to run it with such ExecutionPolicy. It is possible to run it with `Set-ExecutionPolicy -Scope Process Unrestricted`, but I was wondering if I downloaded it from the wrong place, and there is signed file somwhere.SolvedilmarslDec 04, 2021Copper Contributor2.5KViews1like3CommentsMore exhaustive list than "Top 10 ways to secure Microsoft 365"
Dear community, is there a more exhaustive and detailed checklist than Microsoft's security baseline? https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/secure-your-business-dataSolvedKirilNov 29, 2021Iron Contributor1.7KViews1like3CommentsMicrosoft Baseline Security for windows 10 v2004
Hello, I have a group of PCs that are under a separate active directory OU, that are running windows 10 v2004. I would like to apply on these PCs the Microsoft baseline security, my question is that the baseline security for windows 10 v2004 comes with 11 policies (listed below): 1. MSFT Internet Explorer 11 - Computer 2. MSFT Internet Explorer 11 - User 3. MSFT Windows 10 2004 - BitLocker 4. MSFT Windows 10 2004 - Computer 5. MSFT Windows 10 2004 - User 6. MSFT Windows 10 2004 and Server 2004 - Defender Antivirus 7. MSFT Windows 10 2004 and Server 2004 - Domain Security 8. MSFT Windows 10 2004 and Server 2004 Member Server - Credential Guard 9. MSFT Windows Server 2004 - Domain Controller Virtualization Based Security 10. MSFT Windows Server 2004 - Domain Controller 11. MSFT Windows Server 2004 - Member Server Do I have to apply all the baseline security policies to the OU? or only the windows 10 ones, such as : 1. MSFT Internet Explorer 11 - Computer 2. MSFT Internet Explorer 11 - User 3. MSFT Windows 10 2004 - BitLocker 4. MSFT Windows 10 2004 - Computer 5. MSFT Windows 10 2004 - User 6. MSFT Windows 10 2004 and Server 2004 - Defender Antivirus 7. MSFT Windows 10 2004 and Server 2004 - Domain Security 8. MSFT Windows 10 2004 and Server 2004 Member Server - Credential Guard Also, what should be the lining order of the policies? Thanking youSolvedsharkeeNov 29, 2021Copper Contributor2KViews1like1Comment
Resources
Tags
- security baseline26 Topics
- security15 Topics
- security compliance toolkit10 Topics
- microsoft 3653 Topics
- guides2 Topics
- updates2 Topics
- microsoft edge2 Topics
- final1 Topic
- compliance1 Topic