SYS.2.2.3 Windows 10 Clients

Since Windows 10-based devices are closely intertwined with the cloud services of Microsoft, the extent to which these cloud services should or may be used MUST be strategically determined before this occurs.

The functional scope and functional changes included in a given Windows 10 version MUST be selected based on the identified protection needs and the purpose of use at hand. The feasibility of the required safeguards MUST be considered in the selection process. Based on the results of this review, the established procurement process at hand MUST be extended to include the selection of a corresponding licence model and service branches (CB, CBB, or LTSC).

Telemetry services transmit diagnostic and usage data that the manufacturer links to unique characteristics for the purposes of troubleshooting, the improvement of services and products, and identification. This data can only be greatly reduced in Windows 10 Enterprise by setting the telemetry level to 0 (Security). If this setting cannot be effectively implemented, appropriate safeguards (e.g. at the network level) MUST be taken to ensure that this data is not transmitted to the manufacturer.

Unless equivalent or higher safeguards (such as execution control) have been implemented to protect an IT system from malware infection, a specialised malware protection component MUST be deployed on Windows 10 clients.

Logging into the system and domain MUST ONLY be possible using an account of a self-operated directory service. The ability to log in using local accounts SHOULD be reserved for administrators. Online login accounts (e.g. Microsoft accounts or accounts from other providers of identity management systems) MUST NOT be used because doing so transmits personal data to the systems of the respective manufacturer.

Only Kerberos SHOULD be used for central authentication. A group policy SHOULD prevent the use of older protocols. If this is not possible, NTLMv2 MUST be implemented as an alternative. Authentication by means of LAN Manager and NTLMv1 MUST NOT be allowed within an organisation or production operating environments. The cryptographic mechanisms used SHOULD be configured and documented according to the identified protection needs and based on the applicable internal guidelines. Deviating settings SHOULD be justified and coordinated with the respective security management personnel.

Access to files and folders on a local system and to network shares SHOULD be configured in accordance with an authorisation and access concept. The standard administrative approvals on the system SHOULD also be taken into account. Users' write privileges SHOULD be restricted to a defined area in the file system. In particular, users SHOULD NOT be granted write privileges to folders of the operating system or of installed applications.

The SmartScreen feature, which checks files and web content downloaded from the Internet and transmits personal data to Microsoft in the process under certain circumstances, SHOULD be disabled.

Cortana SHOULD be disabled.

The synchronisation of user data with Microsoft cloud services and the process of sharing WLAN passwords SHOULD be disabled completely.

The use of the Microsoft Store SHOULD be checked and evaluated with respect to its compatibility with the data protection and security regulations of the organisation at hand. The general installation of apps in Windows 10 is not dependent on a connection to the Microsoft Store, so it SHOULD be disabled if it is not needed.

Storing passwords, certificates, and other information for automatic logins to websites and IT systems SHOULD NOT be allowed.

The effects on the configuration of the local firewall SHOULD be taken into account when planning Windows remote support procedures (this does not refer to RDP). Remote support SHOULD only be performed following an explicit invitation. When storing an invitation in a file, the file SHOULD be protected by a password. The user currently logged in SHOULD always have to agree explicitly to starting a session. A remote support invitation SHOULD have an appropriate maximum duration. If this service is not used, it SHOULD be disabled completely.

The effects on the configuration of the local firewall SHOULD be taken into account when planning remote access. The group of users authorised for remote desktop access (RDP) SHOULD be specified by assigning corresponding user rights. In complex infrastructures, it SHOULD only be possible to reach an RDP target system via an intermediate RDP gateway. In order to use RDP, a check SHOULD be performed to ensure that the following convenience functions are in accordance with the protection needs of the target system:

• Use of the cache
• Integration of printers
• Integration of removable media and network drives
• Use of file repositories and smartcard connections

If the use of remote desktop access is not planned, it SHOULD be disabled completely. The cryptographic protocols and algorithms deployed SHOULD comply with the respective organisation's internal specifications.

For privileged accounts, the configuration parameters of User Account Control (UAC) SHOULD be set with an appropriate balance between user-friendliness and security. The decisions regarding the configuration parameters to be used SHOULD be documented. In addition, the related documentation SHOULD include all accounts with administrator rights. Regular checks SHOULD be carried out to determine whether the ability to extend rights is necessary.

Since the Encrypting File System (EFS) protects the keys used with the passwords of user accounts, secure passwords SHOULD be used. In addition, restrictive access rights SHOULD protect files that are encrypted using EFS. The recovery agent SHOULD be a dedicated account and not the administrator. In this context, the private key of this account SHOULD be secured and removed from the system. Backups of all private keys SHOULD be created. When using EFS with local user accounts, the local password memories SHOULD be encrypted by means of syskey. Windows Defender Credential Guard can also be used as an alternative. Users SHOULD be trained in the correct use of EFS.

PowerShell and WPS files SHOULD ONLY be executed by administrators. The execution of PowerShell SHOULD be logged centrally and the logs SHOULD be monitored. The execution of PowerShell scripts SHOULD be restricted using the command Set-Execution Policy AllSigned to prevent any accidental execution of unsigned scripts.

SecureBoot SHOULD be used on UEFI-based systems, and the status of the protected mode for the LSA credential store SHOULD be monitored during system startup (see also SYS.2.2.3.A11 Protection of Login Information in Windows 10). If remote maintenance of clients is intended using RDP, the “restrictedAdmin” option for RDP SHOULD be used for deployments of Windows 10 in domains with the functional level 2012 R2 or higher.

If a security concept is created for an IT system using Windows 10, it SHOULD be checked whether the last access time stamp can be activated in the file system to facilitate analysis of system misuse. Such checks SHOULD take into account possible effects of this setting, such as performance aspects or resulting limitations in incremental backups.

It SHOULD be taken into account that the Connected User Experience and Telemetry (CUET) component in Windows 10 is an integral part of the operating system that, in addition to the telemetry feature, provides Microsoft with a way to access local systems remotely. This type of remote access to Windows 10 clients SHOULD be logged on the network side and blocked if required.