Data/EnterpriseRecommended.json
|
{ "$schema": "./Baseline.schema.json", "Name": "EnterpriseRecommended", "Version": "1.0.0", "Description": "A conservative checklist of important Windows health and security settings. EndpointForge can safely preview a small set of supported fixes; hardware protections are checked but never changed automatically.", "Controls": [ { "Id": "EF-FW-DOMAIN", "Title": "Domain firewall profile is enabled", "Description": "Requires Windows Firewall for the domain profile.", "WhyItMatters": "The firewall helps block unwanted network connections while this computer is connected to an organization network.", "HowChecked": "EndpointForge asks Windows whether the Domain firewall profile is turned on.", "WhatWouldChange": "EndpointForge would turn on the Domain firewall profile. It would not replace firewall rules.", "ManualAction": "If an organization policy controls the firewall, ask your IT administrator to review that policy.", "SafetyNotes": "No restart is normally needed. Organization policy can override the local setting.", "RecoveryGuidance": "If a confirmed application problem follows the change, use approved Windows Firewall policy or tools to restore the prior profile state shown in the change receipt.", "Type": "FirewallProfile", "Severity": "Critical", "Name": "Domain", "DesiredValue": true, "Remediable": true, "RequiresReboot": false }, { "Id": "EF-FW-PRIVATE", "Title": "Private firewall profile is enabled", "Description": "Requires Windows Firewall for the private profile.", "WhyItMatters": "The firewall helps block unwanted network connections on trusted home or work networks.", "HowChecked": "EndpointForge asks Windows whether the Private firewall profile is turned on.", "WhatWouldChange": "EndpointForge would turn on the Private firewall profile. It would not replace firewall rules.", "ManualAction": "If an organization policy controls the firewall, ask your IT administrator to review that policy.", "SafetyNotes": "No restart is normally needed. Organization policy can override the local setting.", "RecoveryGuidance": "If a confirmed application problem follows the change, use approved Windows Firewall policy or tools to restore the prior profile state shown in the change receipt.", "Type": "FirewallProfile", "Severity": "Critical", "Name": "Private", "DesiredValue": true, "Remediable": true, "RequiresReboot": false }, { "Id": "EF-FW-PUBLIC", "Title": "Public firewall profile is enabled", "Description": "Requires Windows Firewall for the public profile.", "WhyItMatters": "The firewall is especially important on public networks, where other connected devices may not be trusted.", "HowChecked": "EndpointForge asks Windows whether the Public firewall profile is turned on.", "WhatWouldChange": "EndpointForge would turn on the Public firewall profile. It would not replace firewall rules.", "ManualAction": "If an organization policy controls the firewall, ask your IT administrator to review that policy.", "SafetyNotes": "No restart is normally needed. Organization policy can override the local setting.", "RecoveryGuidance": "If a confirmed application problem follows the change, use approved Windows Firewall policy or tools to restore the prior profile state shown in the change receipt.", "Type": "FirewallProfile", "Severity": "Critical", "Name": "Public", "DesiredValue": true, "Remediable": true, "RequiresReboot": false }, { "Id": "EF-UAC-ENABLED", "Title": "User Account Control is enabled", "Description": "Requires EnableLUA to remain enabled.", "WhyItMatters": "User Account Control helps prevent programs from making administrator-level changes without your knowledge.", "HowChecked": "EndpointForge reads the Windows setting that turns User Account Control on or off.", "WhatWouldChange": "EndpointForge would turn on User Account Control.", "ManualAction": "If this setting is controlled by your organization, ask IT to review its Windows security policy.", "SafetyNotes": "A restart is required before this change is fully active. Applications may begin asking for administrator approval when needed.", "RecoveryGuidance": "Use the before value in the change receipt and your approved Windows security policy if an administrator determines the setting must be restored.", "Type": "Registry", "Severity": "Critical", "Path": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "ValueName": "EnableLUA", "ValueType": "DWord", "DesiredValue": 1, "Remediable": true, "RequiresReboot": true }, { "Id": "EF-DEFENDER-REALTIME", "Title": "Microsoft Defender real-time protection is enabled", "Description": "Requires real-time protection when Microsoft Defender is available.", "WhyItMatters": "Real-time protection scans files and activity for known threats while you use the computer.", "HowChecked": "EndpointForge asks Microsoft Defender whether real-time protection is active.", "WhatWouldChange": "EndpointForge would ask Microsoft Defender to turn real-time monitoring on.", "ManualAction": "If another antivirus product or organization policy controls protection, ask your security administrator to review it.", "SafetyNotes": "Tamper protection, another antivirus product, or organization policy may prevent or later replace the local change.", "RecoveryGuidance": "If a security administrator confirms the change must be reversed, use the prior state in the receipt and the approved antivirus management tool.", "Type": "Defender", "Severity": "Critical", "Property": "RealTimeProtectionEnabled", "DesiredValue": true, "Remediable": true, "RequiresReboot": false }, { "Id": "EF-SMB1-DISABLED", "Title": "SMB 1.0 optional feature is disabled", "Description": "Requires the legacy SMB1 optional feature to be disabled when present.", "WhyItMatters": "SMB 1.0 is an obsolete file-sharing protocol with serious security weaknesses.", "HowChecked": "EndpointForge asks Windows whether the SMB 1.0 optional feature is enabled.", "WhatWouldChange": "EndpointForge would disable the SMB 1.0 Windows optional feature.", "ManualAction": "Replace or isolate devices that still require SMB 1.0 before disabling it across an organization.", "SafetyNotes": "A restart may be required. Very old file servers, printers, or applications may stop connecting.", "RecoveryGuidance": "Do not re-enable SMB 1.0 casually. If a critical legacy dependency is confirmed, follow your organization's exception process and use the receipt to identify the prior state.", "Type": "WindowsOptionalFeature", "Severity": "High", "Name": "SMB1Protocol", "DesiredValue": "Disabled", "Remediable": true, "RequiresReboot": true }, { "Id": "EF-WUA-NOT-DISABLED", "Title": "Windows Update service is not disabled", "Description": "Requires the Windows Update service to use manual trigger start.", "WhyItMatters": "Windows needs this service available to discover and install approved security and reliability updates.", "HowChecked": "EndpointForge reads the Windows Update service start setting.", "WhatWouldChange": "EndpointForge would set the service to Manual, allowing Windows to start it when needed. It would not install updates.", "ManualAction": "If updates are managed centrally, confirm the service setting with the team that manages Windows updates.", "SafetyNotes": "This change does not download or install updates and normally does not require a restart.", "RecoveryGuidance": "If an administrator confirms a different start setting is required, restore the before value shown in the receipt through the approved service or device-management policy.", "Type": "Service", "Severity": "High", "Name": "wuauserv", "StartupType": "Manual", "Status": "", "DesiredValue": "Manual", "Remediable": true, "RequiresReboot": false }, { "Id": "EF-BITLOCKER-OS", "Title": "BitLocker protects the operating system volume", "Description": "Audits BitLocker protection. Encryption is never enabled automatically.", "WhyItMatters": "BitLocker helps protect files if a computer or its drive is lost or stolen.", "HowChecked": "EndpointForge asks Windows whether BitLocker protection is active on the operating system drive.", "WhatWouldChange": "Nothing. EndpointForge never turns on drive encryption automatically.", "ManualAction": "Use your organization's approved BitLocker process so the recovery key is stored safely before encryption is enabled.", "SafetyNotes": "Enabling encryption without a recovery-key plan can cause permanent data loss. This item is report-only.", "RecoveryGuidance": "No automatic change is made. Follow your organization's BitLocker recovery process if access is lost.", "Type": "BitLocker", "Severity": "High", "MountPoint": "%SystemDrive%", "DesiredValue": "On", "Remediable": false, "RequiresReboot": false }, { "Id": "EF-SECUREBOOT", "Title": "Secure Boot is enabled", "Description": "Audits Secure Boot on supported UEFI devices.", "WhyItMatters": "Secure Boot helps prevent untrusted software from loading before Windows starts.", "HowChecked": "EndpointForge asks supported firmware whether Secure Boot is active.", "WhatWouldChange": "Nothing. EndpointForge never changes firmware settings.", "ManualAction": "Ask IT or the computer manufacturer for the approved firmware procedure if Secure Boot should be enabled.", "SafetyNotes": "Changing firmware settings can prevent a computer from starting. This item is report-only.", "RecoveryGuidance": "No automatic change is made. Use the manufacturer's recovery procedure for any firmware problem.", "Type": "SecureBoot", "Severity": "High", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "EF-TPM-READY", "Title": "Trusted Platform Module is present and ready", "Description": "Audits TPM presence and readiness. TPM state is never changed automatically.", "WhyItMatters": "A Trusted Platform Module stores security keys in protected hardware and supports features such as BitLocker and Windows Hello.", "HowChecked": "EndpointForge asks Windows whether a TPM is present and ready for use.", "WhatWouldChange": "Nothing. EndpointForge never initializes, clears, or changes a TPM.", "ManualAction": "Ask IT or the computer manufacturer to review firmware and TPM readiness. Never clear a TPM without confirming recovery keys and impact.", "SafetyNotes": "Clearing or resetting a TPM can make encrypted data unavailable. This item is report-only.", "RecoveryGuidance": "No automatic change is made. Follow the device and encryption recovery procedures approved by your organization.", "Type": "Tpm", "Severity": "High", "DesiredValue": { "TpmPresent": true, "TpmReady": true }, "Remediable": false, "RequiresReboot": false } ] } |