Forum Discussion
PCI-DSS - can we make windows 10 only talk to WSUS or System Center?
Hi James,
Thanks for your question. A few comments that might help:
- HIPPA is currently working on an updated version of their "HIPAA Compliance with Microsoft Windows 10 Enterprise" which explains which features to enable/disable to improve compliancy. The version from February 2017 can be find here.
- With Windows 10 Enterprise, you can switch the diagnostic to Security level. If you want to eliminate network traffic any further, keep in mind that security of the OS can be impacted. There are certain security features that won't work, e.g. SmartScreen or Certificate Revocation List checks. It's possible to reduce the traffic beyond the Security level. Microsoft has documented how to disable every component in the OS that requires some sort of network/internet connectivity. Details on how to do that can be found here. Keep in mind that disabling the security related components of the operating system means your organization takes that responsibility. Good luck!
Kind regards,
Pieter
Hi James,
Thanks for your question. A few comments that might help:
- HIPPA is currently working on an updated version of their "HIPAA Compliance with Microsoft Windows 10 Enterprise" which explains which features to enable/disable to improve compliancy. The version from February 2017 can be find here.
- With Windows 10 Enterprise, you can switch the diagnostic to Security level. If you want to eliminate network traffic any further, keep in mind that security of the OS can be impacted. There are certain security features that won't work, e.g. SmartScreen or Certificate Revocation List checks. It's possible to reduce the traffic beyond the Security level. Microsoft has documented how to disable every component in the OS that requires some sort of network/internet connectivity. Details on how to do that can be found here. Keep in mind that disabling the security related components of the operating system means your organization takes that responsibility. Good luck!
Kind regards,
Pieter
PieterWigleven wrote:Hi James,
- With Windows 10 Enterprise, you can switch the diagnostic to Security level. If you want to eliminate network traffic any further, keep in mind that security of the OS can be impacted. There are certain security features that won't work, e.g. SmartScreen or Certificate Revocation List checks.
It's possible to reduce the traffic beyond the Security level.
Microsoft has documented how to
disable every component in the OS that requires some sort of network/internet connectivity. Details on how to do that can be found https://docs.microsoft.com/en-us/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services. Keep in mind that disabling the security related components of the operating system means your organization takes that responsibility. Good luck!
Kind regards,
Pieter
Hello, SLI Overnight team here working on effecting best possible security for an updated Windows 10 image on our lab system for testing. We're aware this is an older thread, but it is definitely one IOPO that deserves a lot more attention than it's received thus far.
Some good suggestions were made in the reply given; however they're lacking in detail. Group Policy Administration for example; is tricky business since 1709 and the same can be said for 1803.
In our situation, we barely use Windows, but keep around 10 or less workstations in a WorkGroup (not HomeGroup [HomeGroups are disabled] ) that we share when they're needed for programs that best run on the Windows' OS Platform. Additionally, at this time, Microsoft only makes one product that is of any use to us, and that's Windows 10 Enterprise. With exception to WEX (Windows 10 Enterprise) we do not use any other Microsoft Products unless MS Accounts that are not part of Office 365 are also considered to be "products" as opposed to "services" whereas the terminology can come down to matters of opinion (we'd not debate which term people choose to use either way, and consider it a matter of professional choice). As to any other MS "services" those are not in use by our organization or its members either.
The above being said, our workstations are configured standalone, without Active Directory because we do not use Microsoft Server solutions at this time either, and most of our infrastructure is supported by Linux along with some implementations of our own proprietary designs that are not on Windows based platforms, but do support the regulation of traffic from Windows 10 workstations authorized to function on our essentially air gapped private cloud.
Some of the reductions needing to be made to reduce traffic are rather extravagant with multiple points in Group Policy to implement the changes. This article has been bookmarked by our team, and we're seeking permission from the daytime staff to post some screen shots of what we're talking about. If we get permission, we'll follow up with some screen shots, but if we don't, we'll be unable to post examples; however we're confident there are those in the community that likely can post some screen shots of Group Policy in the kinds of areas we're speaking of, and were mentioned in the reply we've just quoted that also have additional options beyond " With Windows 10 Enterprise, you can switch the diagnostic to Security level." In fact, there are multiple points in Group Policy that, if used in combination, will eliminate such extraneous traffic as the OP was suggesting be eliminated. In our case, such traffic registers as "lost packets" and while that's the desired behavior from our perspective, it's always better from both throughput and system load standpoints, to not have those packets sent out at all.
Obviously, for any readers that just read the paragraph above that might be overthinking what we just said, Yes, we author the same Group Policy on all our Windows 10 Workstations, and No it's not our only security measure when using Windows 10, it's one of many.
We'll do what we can to provide further follow up on this thread to help out; however regardless of how Group Policy is administered such as Local Machine or Active Directory via a Windows Server and MS Domain for Propagation to all systems in the Domain instead of a WorkGroup for standalone and local operation, having an effective Group Policy in use is essential because a strong Group Policy can eliminate about 95% of the undesired traffic generated by Windows 10.
It's hoped that this post encourages others to take a heavy and scrutinous look at all of the available settings in Group Policy. As always, test each setting in Group Policy prior to making regular use of each setting because some settings in Group Policy do NOT function as they're described to within the details of each, and as always, "Testing, testing, 1, 2, 3..." is the only way to verify whether or not a given setting is functioning in the desired manner that is right for your organization.
Best Regards,
SLI Overnight Team
DISCLAIMER:
Post is provided without warranty or guarantee. Results may vary depending on hardware and environment.
