We have a number of important settings enabled (password changes, screen-locks etc), but I'm sure there's loads more really useful settings that we could enable.

Any suggestions would be gratefully appreciated... particularly in the security area.

closed as not constructive by Chris S Jan 26 '12 at 5:13

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

locked by HopelessN00b Dec 5 '14 at 2:38

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.

Read more about locked posts here.


The above are usualy the starting point

Computer Policies:

  • Review Account Policies/Audit Policy
  • Review Local Policies/User Rights Assignment
  • Local Policies/Security Options/Shutdown/Shutdown: Clear virtual memory page file = Enabled
  • System Services\Messenger\Startup Mode = Disabled
  • Public Key Policies/Encrypting File System/Allow users to encrypt files using EFS = disabled (unless you have a PKI and accounts in place to allow decryption)

User Policies:

  • Review Administrative Templates\Control Panel
  • Administrative Templates\System\Prevent access to registry editing tools = enabled
  • Administrative Templates\System\Prevent access to the command prompt = enabled

There are many more useful and important ones, but those cover most of the XP/Vista/2003 gotchas. It sounds painful but the only thing you can do is make sure you have the latest .adm files loaded into group policy management console and go through each and every one making a decision based upon the business needs.

  • +1 for the phrase "based upon the business needs" -- in particular, for each part of the business. The policy needed on the receptionist(s) PC(s) will likely be quite different to that of the Sales team or Development.. – Rob May 27 '09 at 12:05

Oft-overlooked Windows Settings/Internet Explorer Maintenance/URLs/Favorites and Links/ - with all the corporate links (a 'Helpdesk Ticket' link that they cannot lose being crucial to my sanity).

Server OU - Most of my GPOs have to do with making my RDC sessions into servers more consistent, useful, and simple.

Administrative Templates/Windows Components/Terminal Services/Client/Server data redirection/Do not allow LPT port recirection ... keeps the driver install failure spam out of my event logs.

Force bginfo (from Sysinternals) upon login - to paint the server/ip/etc name on the desktop. Anything to help me out in not rebooting / changing settings on the wrong server (again).

Administrative Templates/Start Menu and Taskbar - remove baloon Tips, Remove... Shut Down (I'd prefer this is kept to commandline), Remove Search/Help.

Note: Not to insult anybody's intelligence, but make sure you're using the Group Policy Management Console (if 2003, SP specific) instead of the godawful built in interface.

The Jeremy Moskowitz book has been a huge help to me.


Admin Templates/System/Internet Communication Management - there's a LOT of stuff in there you may want to disable.

Admin Templates/Desktop/Prohibit user from changing My Documents path - oh yes.

Otherwise, I've gone from keeping everything tight to leaving it fairly loose. Technology is supposed to empower people after all, and while you can disable stuff like Start Menu right-clicking, what are you really gaining from it?

Finally, never forget: policy is not the same as security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.