Description: When WDigest authentication is enabled, Lsass.exe retains a copy of the user's plaintext password in memory, where it can be at risk of theft. Microsoft recommends disabling WDigest authentication unless it is needed. If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server. Update KB2871997 must first be installed to disable WDigest authentication using this setting in Windows 7, Windows 8, Windows Server 2008 R2 and Windows Server 2012.

For this setting to work on Windows 7, Windows 8, Windows Server 2008 R2 or Windows Server 2012, KB2871997 must first be installed.

Why It's Important: WDigest is an outdated authentication method that stores your password in memory in plain text. If attackers gain access to that memory, they can steal your password and use it to move across systems or escalate privileges. This setting disables WDigest to prevent that kind of credential theft. SHIELD enforces this policy to block one of the most common techniques used in attacks like Pass-the-Hash and credential dumping. It’s like making sure your keys aren’t left lying around—keeping login information secure and out of reach.

Learn More

Description: Configures the SMB v1 client driver's start type. To disable client-side processing of the SMBv1 protocol, select the "Enabled" radio button, then select "Disable driver" from the dropdown.

Why It's Important: This setting helps protect against hackers or malware that try to use local accounts to move between devices on the network. If the same username and password are used on multiple machines, an attacker could use that to access other systems. By enabling this policy, we make sure those accounts don’t have full admin rights when connecting remotely, reducing the risk of credential theft and unauthorized access. It’s like saying, “Even if you know the password, you don’t get full control unless you’re logged in directly.”

Learn More

Description: Configures the SMB v1 client driver's start type. To disable client-side processing of the SMBv1 protocol, select the "Enabled" radio button, then select "Disable driver" from the dropdown.

Why It's Important: SMBv1 is an old way for computers to talk to each other and share files, but it has serious security flaws that hackers can exploit. By disabling it, we’re closing a known security hole and making sure devices only use newer, safer methods to connect and share. It’s like retiring an old, broken lock and replacing it with a modern, secure one—keeping systems protected from attacks like ransomware and unauthorized access.

Learn More

Description: This policy disables server-side processing of the Server Message Block version 1 (SMBv1) protocol, which is a legacy file-sharing protocol. Setting this to "Disabled" is a critical security hardening measure and a widely recommended best practice. Microsoft has deprecated SMBv1 and removed it from default installations of Windows 10 (Enterprise and Education editions), Windows 11, and Windows Server 2019 and later. Disabling the server component ensures that no inbound SMBv1 traffic is processed, eliminating a major attack vector.

Why It's Important: [coming soon]

Learn More

Description: If this setting is enabled, SEHOP is enforced.

Why It's Important: SEHOP protects Windows systems from a type of attack that tries to hijack how programs handle errors—specifically through a method called SEH overwrite, which is common in buffer overflow exploits. Without SEHOP, attackers can manipulate the system’s error-handling process to run malicious code. This setting makes sure Windows checks the integrity of the error-handling chain before allowing it to run, helping block these attacks. SHIELD enables this policy to harden systems against memory-based vulnerabilities. It’s like verifying the emergency exit route before letting anyone use it—ensuring it hasn’t been tampered with and keeping attackers out.

Learn More

Description: When a system crashes, Windows can automatically restart to recover quickly. But in high-security environments, this can erase important crash data that helps diagnose the problem. That data includes error codes, memory dumps, and other clues that security teams need to investigate what went wrong. SHIELD disables automatic reboot to preserve that information for forensic analysis. It’s like pausing a crime scene investigation until all evidence is collected—ensuring nothing is lost and the root cause can be properly understood.

Why It's Important: [coming soon]

Learn More

Description: Enable Administrative Shares (recommended except for highly secure environments).

Why It's Important: By default, Windows can automatically create hidden administrative shares (like C$, ADMIN$) that allow remote access to system drives. While useful for remote management, these shares can be exploited by attackers if not properly secured. Disabling this setting prevents Windows from creating these auto shares, reducing the risk of unauthorized access and lateral movement across the network. SHIELD enforces this policy to harden systems against remote exploitation. It’s like disabling a hidden back entrance that only admins know about—secure in theory, but risky if exposed.

Learn More

Description: Enable Administrative Shares (recommended except for highly secure environments).

Why It's Important: Setting this to Disabled is a critical hardening measure in environments governed by strict security baselines like PSM. Administrative shares are often used for remote administration, but they also expose systems to:

Disabling these shares removes default remote entry points that are frequently exploited in post-compromise scenarios, especially when combined with weak credentials or unpatched vulnerabilities.

Learn More

Description: IP source routing protection level (protects against packet spoofing).

Why It's Important: IP source routing allows the sender of a packet to specify the route it should take through the network. While this can be useful for diagnostics, it’s rarely needed in modern environments and can be abused by attackers to spoof identities or bypass security controls. This setting disables source routing for IPv6 traffic, helping prevent packet spoofing and reducing the risk of network-based attacks. SHIELD enables this policy to harden network defenses and enforce secure routing behavior. It’s like refusing to accept packages with handwritten delivery routes—ensuring they follow trusted paths only.

Learn More

Description: Prevents the use of IP source routing, a legacy feature that allows the sender of a packet to dictate its path through the network.

Why It's Important: IP source routing lets the sender of a network packet decide the path it takes through the network. While this can be useful for diagnostics, it’s rarely needed and can be exploited by attackers to spoof IP addresses, bypass firewalls, and hide the origin of malicious traffic. This setting disables source routing entirely, enforcing the highest level of protection. SHIELD enables this policy to ensure packets follow standard, secure routing paths—making it easier to trace and block suspicious activity. It’s like refusing to accept packages with handwritten delivery routes—ensuring they follow trusted paths only.

Learn More

Description: Prevent the dial-up password from being saved (recommended).

Why It's Important: Saving passwords for dial-up or VPN connections can expose sensitive credentials to theft. These saved passwords are stored locally and can be extracted using tools that target Windows Credential Manager, registry entries, or local profile vaults. This setting prevents users from saving those passwords, ensuring credentials are entered manually each time. SHIELD enables this policy to reduce the risk of credential compromise through malware, insider threats, or physical access. It’s like requiring someone to enter a secure code every time instead of leaving it written down—more secure and harder to steal.

Learn More

Description: Allow automatic detection of dead network gateways (could lead to DoS).

Why It's Important: Dead Gateway Detection allows Windows to automatically switch to another network gateway if the current one stops responding. While this can improve connectivity in consumer environments, it introduces risks in secure enterprise networks. Enabling this feature could allow traffic to bypass firewall rules, segmentation policies, or be rerouted through less secure paths—making it harder to monitor and control. SHIELD disables this policy to ensure gateway changes are deliberate and controlled, preserving the integrity of network routing and reducing the risk of denial-of-service (DoS) or unauthorized access. It’s like requiring manual approval before rerouting traffic—ensuring every change is intentional and secure.

Learn More

Description: Allow ICMP redirects to override OSPF generated routes.

Why It's Important: ICMP redirects are messages sent by routers to suggest a more efficient route for network traffic. While useful in some network setups, they can be exploited by attackers to reroute traffic through malicious gateways, intercept data, or bypass security controls. Disabling ICMP redirects ensures that routing decisions are based on trusted configurations, not dynamic messages that could be spoofed. SHIELD enforces this policy to reduce the risk of man-in-the-middle attacks and maintain secure, predictable network behavior. It’s like refusing to follow shortcut directions from a stranger—sticking to verified routes only.

Learn More

Description: Hide Computer From the Browse List (not recommended except for highly secure environments).

Why It's Important: By default, Windows devices can appear in the network browse list, making them visible to other devices on the same network. While this is convenient for file sharing and collaboration, it also makes the device easier to discover by attackers scanning the network. This setting hides the computer from the browse list, reducing its visibility and making it harder for unauthorized users to target it. SHIELD enables this policy to support stealth and endpoint minimization—key principles in secure environments. It’s like removing your name from a public directory to avoid unwanted attention.

Learn More

Description: How often keep-alive packets are sent in milliseconds.

Why It's Important: Keep-alive packets are used to check whether a network connection is still active. By default, Windows sends these packets every 2 hours, which is too infrequent for high-security environments. If a connection is hijacked or dropped, it could go unnoticed for a long time. This setting reduces the interval to 5 minutes (300,000 ms), allowing quicker detection of broken or compromised connections. SHIELD enables this policy to improve network reliability and reduce the risk of stale sessions being exploited. It’s like checking in more frequently to make sure everything is still secure and functioning properly.

Learn More

Description: Configure IPSec exemptions for various types of network traffic.

Why It's Important: IPSec is used to secure network traffic by enforcing authentication, integrity, and confidentiality. By default, some types of system traffic—like DHCP or ICMP—may be exempt from IPSec enforcement, which creates potential weak spots in your network security. This setting disables those exemptions, ensuring that all traffic is subject to IPSec protections. SHIELD enables this policy to eliminate blind spots and enforce consistent security across all communications. It’s like requiring every visitor to go through the same security checkpoint—no exceptions, no shortcuts.

Learn More

Description: Allow the computer to ignore NetBIOS name release requests except from WINS servers.

Why It's Important: NetBIOS name release requests are used to manage how devices identify themselves on a network. However, attackers can abuse these requests to force a system to give up its name, disrupting services like network browsing and name resolution. This setting tells the system to ignore unsolicited name release requests unless they come from a trusted WINS server. SHIELD enables this policy to prevent denial-of-service attacks and protect the system’s identity on the network. It’s like refusing to hand over your ID unless the request comes from a verified authority.

Learn More

Description: Enable the computer to stop generating 8.3 style filenames: Enabled.

Why It's Important: The 8.3 filename format is a legacy feature from the MS-DOS era that creates short versions of long filenames (like PROGRA~1 for Program Files). While it was useful for compatibility with older software, it introduces security and performance risks in modern environments. Attackers can exploit 8.3 names to bypass access controls, hide malicious files, or evade monitoring tools. Disabling this feature ensures that only full, canonical filenames are used—reducing opportunities for stealthy or unintended access. SHIELD enables this policy to harden file system behavior and eliminate outdated functionality that could be abused.

Learn More

Description: Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS).

Why It's Important: Router Discovery Protocol (IRDP) allows systems to automatically detect and configure default gateways based on router advertisements. While this can simplify network setup, it also opens the door to serious security risks. Attackers can exploit IRDP to send fake router advertisements, redirecting traffic to malicious gateways. This can lead to man-in-the-middle attacks, route hijacking, and data interception. SHIELD disables this policy to ensure gateway configuration is static and controlled—like refusing to follow directions from an unverified source, keeping traffic on trusted paths only.

Learn More

Description: Enable Safe DLL search mode (recommended).

Why It's Important: When Windows loads a DLL (a type of system file), it checks several locations to find it. If Safe DLL Search Mode is disabled, Windows might load a DLL from the current folder before checking trusted system paths—giving attackers a chance to sneak in a malicious version. This setting makes sure Windows always looks in secure system folders first, reducing the risk of loading tampered or rogue DLLs. SHIELD enables this policy to protect against DLL hijacking attacks and ensure that only trusted system files are used. It’s like checking the official supply room before using tools from an unknown source—safer, smarter, and more secure.

Learn More

Description: The time in seconds before the screen saver grace period expires (0 recommended).

Why It's Important: When the screen saver activates, Windows gives a short grace period before requiring a password to unlock the system. If this grace period is longer than zero seconds, someone could cancel the screen saver and access the device without re-authenticating. Setting the grace period to 0 seconds ensures that any attempt to resume activity immediately prompts for a password. SHIELD enables this policy to protect unattended systems from unauthorized access. It’s like locking the screen the moment someone steps away—no delay, no opportunity for misuse.

Learn More

Description: Syn attack protection level (protects against DoS). Connections time out sooner if a SYN attack is detected.

Why It's Important: SYN flood attacks overwhelm a system by sending a flood of connection requests, trying to exhaust its resources and make it unavailable to legitimate users. These attacks can slow down or crash services by filling up the queue of half-open connections. This setting enables protection that detects abnormal patterns in incoming SYN packets and shortens the timeout for incomplete connections. SHIELD enables this policy to help systems stay responsive and resilient against denial-of-service attempts. It’s like clearing out stalled traffic quickly so real users can get through—keeping services stable and secure.

Learn More

Description: How many times unacknowledged data is retransmitted (3 recommended, 5 is default).

Why It's Important: When a device sends data and doesn’t get a reply, it tries again. If it keeps retrying too many times, it can slow down the system or waste resources—especially if the connection is broken or under attack. This setting lowers the retry count to 3, helping the system detect problems faster and recover more efficiently. SHIELD enables this policy to improve performance, reduce the risk of denial-of-service attacks, and keep systems responsive. It’s like giving up after three unanswered calls instead of five—quicker, smarter, and more secure.

Learn More

Description: How many times unacknowledged data is retransmitted (3 recommended, 5 is default).

Why It's Important: When a device sends data over the network and doesn’t get a response, it retries. By default, Windows retries five times, which can slow down recovery and consume unnecessary resources—especially in unreliable or malicious network conditions. This policy reduces the retry count to three, helping the system detect failures faster and respond more efficiently. SHIELD enables this setting to improve performance, reduce the risk of denial-of-service attacks, and ensure systems don’t waste time on dead connections. It’s like giving up after three unanswered calls instead of five—quicker, smarter, and more secure.

Learn More

Description: Percentage threshold for the security event log at which the system will generate a warning.

Why It's Important: The Windows security event log records important system and security-related events. If it fills up without warning, critical logs could be lost or overwritten—making it harder to investigate incidents or detect suspicious activity. This setting ensures the system generates a warning when the log reaches a certain percentage of its capacity. SHIELD enables this policy to help administrators take action before the log fills up, preserving valuable forensic data. It’s like getting a low-fuel alert before your tank runs dry—giving you time to respond before something important is lost.

Learn More