Security settings

With security settings, you can modify the security policy of an organizational unit, domain, or site, from any one computer that is joined to a domain.

Security settings allow a security administrator to modify security settings assigned to a Group Policy object.

To modify the security settings on your local computer, see Local Security Policy.

  • Before changing security settings, see Checklist: Securing your computers using Security Configuration Manager.
  • For tips about using security settings, see Best Practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.

Other security policy tools include:

Security Configuration Manager | Description
Security Templates | You can define a security policy in a template. These templates can be applied to a Group Policy object or to your local computer security.
Security Configuration and Analysis | You can use this tool to configure your computer using a security template or to compare your current computer settings to the settings defined in a security template.
Local Security Policy | You can use this tool to edit individual security settings on your local computer.
Secedit.exe Command-line tool | You can use this tool to automate security configuration tasks.


Best practices

  • Always test a newly-created policy on a test computer before applying it to your network.

    XOX

  • Be aware that more than one policy can be applied to a computer.

    Because of this, there can be conflicts in security policy settings. The order of precedence from highest precedence to lowest precedence is Organizational Unit, Domain, and Local Computer. For more information, see Applying security policy.

    You can use Resultant Set of Policies to find out what policies apply to a certain computer. For more information , see Resultant set of policy.

  • Keep in mind that there can only be one account policy in a domain: the Default Domain Policy. For more information, see Account and local policies.
  • When importing templates through Group Policy:
    • Do not apply the Compatible template to Domain Controller machines. For example, do not import the Compatible template to Default Domain Policy or Default Domain Controller Policy.
    • Do not apply the Setup security template through Group Policy.
  • For local security policy, use the Local Security Policy shortcut for editing and finetuning security policy. Use Security Templates to create a local policy and then use Security Configuration and Analysis to apply the policy.


How To...

  • Edit a security setting on a Group Policy object
  • Import a security template to a Group Policy object


Edit a security setting on a Group Policy object

Microsoft Windows graphic

To edit a security setting on a Group Policy object

  1. Perform one of these steps:
    2. If Do this
    You are on a workstation or server, which is joined to a domain, and you would like to modify security settings for a Group Policy object
    • Click Start, point to Run, type mmc and click OK.
    • On the File menu, click Add/Remove Snap-in.
    • In Add/Remove Snap-in, click Add, and in Add Standalone Snap-in, double-click Group Policy.
    • In Select Group Policy Object, click Browse, navigate to and click the policy object you would like to modify, and then click Finish.
    • Click Close and then click OK.
    You are on a domain controller and you want to modify security settings for an organizational unit
    • Open Active Directory Users and Computers.
    • In the console tree, right-click the domain or organizational unit you want to set Group Policy for.
    • Click Properties, and then click the Group Policy tab.
    • Do one of the following:
      • To create a new Group Policy object, on the Filemenu, click New and then click Edit.
      • To change an existing Group Policy object, click the object you want to change, and on the File menu, click Edit.
  2. In the console tree, click Security Settings.

    Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
  3. In the console tree, do one of the following:
    • To edit Password Policy or Account Lockout Policy, double-click Account Policies and click Password Policy or Account Lockout Policy.
    • To edit Audit Policy, User Rights Assignment, or Security Options, double-click Local Policies and click Audit Policy, User Rights Assignment, or Security Options.
  4. In the details pane, right-click the policy that you want to modify and click Properties.
  5. Select the Define these policy settings check box.
  6. Change the settings of this policy and click OK.

Notes

  • XOX
  • Always test a newly-created policy on a test organizational unit before applying it to your network.
  • When you change a security setting, once you click OK, that change will take effect the next time the settings are refreshed.
  • XOX

Related Topics


Concepts

This section provides general information on configuring the security areas in Security Settings:

  • Security settings overview
  • Understanding security settings
  • Security setting descriptions
  • Troubleshooting


Security Settings overview

Organizational Units, domains, and sites are linked to Group Policy objects. The Security Settings tool allows you change the security configuration of the Group Policy object, in turn, affecting multiple computers. With Security Settings you can modify the security settings of many computers, depending on the Group Policy object you modify, from just one computer joined to a domain.

Security settings or security policies are rules that are configured on a computer or multiple computers for protecting resources on a computer or network. Security settings can control:

  • How users are authenticated to a network or computer.
  • What resources users are authorized to use.
  • Whether or not a user's or group's actions are recorded in the event log.
  • Group membership.

For more information, see Security setting descriptions.

Using Security Settings

You can change the security configuration on multiple computers in two ways:

  • Create a security Policy using a security template with Security Templates and then importing it through Security Settings to a Group Policy object. For more information, see To import a security template to a Group Policy object.
  • Change a few select settings with Security Settings. For more information, see To edit a security setting on a Group Policy object.


Understanding security settings

  • Applying security settings
  • Account and local policies
  • Event log
  • Restricted groups
  • File system, registry, system services


Applying security settings

This section covers different considerations when applying security settings.

When policy is applied

Once you have edited the security settings, the settings are refreshed on the computers linked to your Group Policy object:

  • When a computer is restarted the settings on that computer will be refreshed.
  • XOX

To force a computer to refresh its security settings as well as all Group Policy settings, see the gpupdate command-line tool.

Precedence of policy when more than one policy is applied to a computer

For security settings which are defined by more than one policy, the following order of precedence, from highest to lowest, is observed:

  • Organizational unit policy
  • Domain policy
  • Site policy
  • Local computer policy

For example, the domain policy will override the local security policy for a workstation which is defined on a domain wherever there is a conflict. Likewise, if the same workstation is a member of an organizational unit, the settings applied from the organizational unit policy will override both the domain and local settings. If the workstation is a member of more than one organizational unit, then the organizational unit that immediately contains the workstation has the highest order of precedence.

Use the Resultant Set of Policies tool to find out what policies are applied and in what order to a computer. For more information, see Resultant set of policy.

Persistence in security settings

Security settings may still persist even if the setting is no longer defined in the policy that originally applied it.

Persistence in security settings occurs when:

  • The setting has not been previously defined on the local computer at the time policy was applied.
  • The setting is for a registry object in the subtree of the Registry node.
  • The setting is for a file system object.

Whenever Group Policy is applied, the computer stores the local security settings into a database. If a Group Policy object defines a security setting, then does not define that setting, the setting takes on the original local setting stored in the database. If a value does not exist in the database, then the setting does not have a setting to revert to, and it remains defined as is. This behavior is sometimes referred to as tattooing.

Registry and file settings will remain at the security setting that is applied through policy until that setting is set to another value.

Filtering security settings based on group membership

You can also decide what computers will or will not have a Group Policy object applied to them by denying them either the Apply Group Policy or Read permission on that Group Policy object. Both of these permissions are needed to apply Group Policy.


Concepts

This section provides general information on configuring security using Security Settings:

  • Security Settings overview
  • Applying Security Settings
  • Understanding Security Settings