Skip to content
docs

Type at least two characters. Press Enter for full results.

    Baseline settings by framework

    View as MarkdownOpen in ChatGPTOpen in Claude

    This page lists every setting each framework baseline sets, as shipped in Depot 0.8.0. For what a floor is and how baselines are assigned, see Compliance framework baselines.

    Scope

    Section titled “Scope”
    • The values come from the Outpost settings catalog, which is the only source the baselines and the compliance pages read. When the catalog changes in a release, the built-in baselines update with it.
    • CIS Benchmarks has no table because Outpost ships no CIS content.
    • The control column is the framework’s own identifier for the control the value supports. The full citation, including how Outpost reads the control and why it chose the value, appears in the console: on the setting’s framework badge in a profile’s Settings tab, and at the top of the control’s page under Compliance.

    How to read the tables

    Section titled “How to read the tables”
    ColumnMeaning
    SettingThe setting key, as the console shows it in profiles and on the compliance pages.
    PlatformsThe operating systems the setting applies to. All means every operating system with policy enforcement: Windows, Linux, and macOS. iOS, Android means managed phones and tablets. Depot means the setting governs records Outpost keeps, not an endpoint.
    FloorFor an enforced framework, the least strict value the setting can resolve to. A stricter value in your own profiles is kept.
    Recommended valueFor an advisory framework, the value its profile sets. Your own profiles can override it.
    ControlThe control, requirement, or rule the framework cites.

    Units follow the key name: a key ending in _seconds is in seconds, _days in days, and _bytes in bytes. true means on and false means off.

    macOS support is a preview. See Platform support.

    SOC 2

    Section titled “SOC 2”

    Profile SOC 2 Baseline. The console labels this framework SOC 2. Enforced: 60 floors across 9 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrueCC6.8
    antimalware.real_time_protectionWindowstrueCC6.8
    antimalware.tamper_protectionWindowstrueCC6.8
    audit.linux_auditd_enabledLinuxtrueCC7.2
    audit.logon_eventsWindowstrueCC7.2
    audit.policy_changeWindowstrueCC7.2
    compliance.endpoint_audit_retention_daysDepot365CC7.3
    compliance.evidence_retention_daysDepot365CC4.1
    device_activity.alert_on_driver_changeAlltrueCC7.1
    device_activity.alert_on_service_changeAlltrueCC7.1
    device_activity.alert_on_usb_storageAlltrueCC6.1
    device_activity.enabledAlltrueCC6.1
    device_control.usb_storage_policyWindowsread_onlyCC6.7
    encryption.escrow_recovery_keyAlltrueCC6.1
    encryption.linux_require_disk_encryptionLinuxtrueCC6.1
    encryption.macos_require_filevaultmacOStrueCC6.1
    encryption.require_os_drive_encryptionWindows, macOStrueCC6.1
    firewall.default_inbound_actionWindowsblockCC6.6
    firewall.enabled_domain_profileWindowstrueCC6.6
    firewall.enabled_private_profileWindows, macOStrueCC6.6
    firewall.enabled_public_profileWindowstrueCC6.6
    firewall.linux_enabledLinuxtrueCC6.6
    firewall.macos_enabledmacOStrueCC6.6
    lockout.duration_secondsWindows900CC6.1
    lockout.linux_duration_secondsLinux900CC6.1
    lockout.linux_threshold_attemptsLinux10CC6.1
    lockout.macos_duration_secondsmacOS900CC6.1
    lockout.macos_threshold_attemptsmacOS10CC6.1
    lockout.threshold_attemptsWindows10CC6.1
    monitoring.alert_on_new_admin_accountWindowstrueCC7.2
    monitoring.alert_on_service_stopAlltrueCC7.2
    monitoring.log_retention_daysAll365CC7.3
    password.complexity_enabledWindowstrueCC6.1
    password.history_countWindows4CC6.1
    password.linux_max_age_daysLinux90CC6.1
    password.linux_min_character_classesLinux3CC6.1
    password.linux_min_lengthLinux12CC6.1
    password.macos_history_countmacOS4CC6.1
    password.macos_max_age_daysmacOS90CC6.1
    password.macos_min_character_classesmacOS3CC6.1
    password.macos_min_lengthmacOS12CC6.1
    password.max_age_daysWindows90CC6.1
    password.min_lengthWindows, macOS12CC6.1
    patch.auto_approve_criticalAlltrueCC7.1
    patch.auto_approve_securityAlltrueCC7.1
    remote_access.file_transferAllto_endpointCC6.7
    script_execution.log_script_outputAlltrueCC7.2
    script_execution.require_signed_scriptsAlltrueCC8.1
    session.disconnect_idle_rdp_secondsWindows900CC6.1
    session.linux_screen_lock_timeout_secondsLinux900CC6.1
    session.macos_screen_lock_timeout_secondsmacOS900CC6.1
    session.require_password_on_wakeWindows, macOStrueCC6.1
    session.screen_lock_timeout_secondsWindows, macOS900CC6.1
    session.screensaver_enabledWindowstrueCC6.1
    software.allow_user_installsWindowsfalseCC6.8
    software.installer_signature_requiredAlltrueCC8.1
    uac.enabledWindowstrueCC6.1
    updates.automatic_security_updatesLinuxtrueCC7.1
    updates.macos_automatic_security_updatesmacOStrueCC7.1

    HIPAA Security Rule

    Section titled “HIPAA Security Rule”

    Profile HIPAA Baseline. The console labels this framework HIPAA. Enforced: 42 floors across 12 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrue164.308(a)(5)(ii)(B)
    antimalware.real_time_protectionWindowstrue164.308(a)(5)(ii)(B)
    antimalware.signature_update_interval_secondsWindows86400164.308(a)(5)(ii)(B)
    audit.linux_auditd_enabledLinuxtrue164.312(b)
    audit.logon_eventsWindowstrue164.312(b)
    audit.policy_changeWindowstrue164.312(b)
    compliance.endpoint_audit_retention_daysDepot2190164.316(b)(2)(i)
    compliance.evidence_retention_daysDepot2190164.316(b)(2)(i)
    device_activity.alert_on_usb_storageAlltrue164.310(d)(2)(iii)
    device_control.usb_storage_encryption_requiredWindowstrue164.312(a)(2)(iv)
    device_control.usb_storage_policyWindowsread_only164.310(d)(1)
    encryption.escrow_recovery_keyAlltrue164.308(a)(7)(ii)(A)
    encryption.linux_require_disk_encryptionLinuxtrue164.312(a)(2)(iv)
    encryption.macos_require_filevaultmacOStrue164.312(a)(2)(iv)
    encryption.require_fixed_drive_encryptionWindowstrue164.312(a)(2)(iv)
    encryption.require_os_drive_encryptionWindows, macOStrue164.312(a)(2)(iv)
    firewall.enabled_domain_profileWindowstrue164.308(a)(1)(ii)(B)
    firewall.linux_enabledLinuxtrue164.308(a)(1)(ii)(B)
    firewall.macos_enabledmacOStrue164.308(a)(1)(ii)(B)
    lockout.linux_threshold_attemptsLinux10164.308(a)(5)(ii)(C)
    lockout.macos_threshold_attemptsmacOS10164.308(a)(5)(ii)(C)
    lockout.threshold_attemptsWindows10164.308(a)(5)(ii)(C)
    monitoring.alert_on_new_admin_accountWindowstrue164.308(a)(4)(ii)(C)
    monitoring.log_retention_daysAll2190164.316(b)(2)(i)
    password.complexity_enabledWindowstrue164.308(a)(5)(ii)(D)
    password.linux_max_age_daysLinux90164.308(a)(5)(ii)(D)
    password.linux_min_character_classesLinux3164.308(a)(5)(ii)(D)
    password.linux_min_lengthLinux12164.308(a)(5)(ii)(D)
    password.macos_max_age_daysmacOS90164.308(a)(5)(ii)(D)
    password.macos_min_character_classesmacOS3164.308(a)(5)(ii)(D)
    password.macos_min_lengthmacOS12164.308(a)(5)(ii)(D)
    password.max_age_daysWindows90164.308(a)(5)(ii)(D)
    password.min_lengthWindows, macOS12164.308(a)(5)(ii)(D)
    patch.auto_approve_criticalAlltrue164.308(a)(1)(ii)(B)
    remote_access.file_transferAllto_endpoint164.310(d)(1)
    session.disconnect_idle_rdp_secondsWindows900164.312(a)(2)(iii)
    session.linux_screen_lock_timeout_secondsLinux900164.312(a)(2)(iii)
    session.macos_screen_lock_timeout_secondsmacOS900164.312(a)(2)(iii)
    session.require_password_on_wakeWindows, macOStrue164.312(a)(2)(iii)
    session.screen_lock_timeout_secondsWindows, macOS900164.312(a)(2)(iii)
    session.screensaver_enabledWindowstrue164.312(a)(2)(iii)

    PCI DSS 4.0

    Section titled “PCI DSS 4.0”

    Profile PCI-DSS Baseline. The console labels this framework PCI DSS. Enforced: 87 floors across 33 cited controls.

    SettingPlatformsFloorControl
    antimalware.cloud_protection_levelWindowshigh5.2.2
    antimalware.macos_gatekeeper_enabledmacOStrue5.2.1
    antimalware.pua_protectionWindowstrue5.2.2
    antimalware.real_time_protectionWindowstrue5.2.1
    antimalware.signature_update_interval_secondsWindows864005.3.1
    antimalware.tamper_protectionWindowstrue5.3.5
    audit.linux_auditd_enabledLinuxtrue10.2.1.1
    audit.logon_eventsWindowstrue10.2.1.1
    audit.policy_changeWindowstrue10.2.1.6
    audit.process_creation_command_lineWindowstrue10.2.1.2
    audit.security_log_max_bytesWindows20132659210.3.2
    browser.enforce_safe_browsingWindowstrue5.4.1
    compliance.endpoint_audit_retention_daysDepot36510.5.1
    compliance.evidence_retention_daysDepot36512.4.2
    device_activity.alert_on_driver_changeAlltrue10.2.1.7
    device_activity.alert_on_service_changeAlltrue10.7.2
    device_activity.alert_on_usb_storageAlltrue9.4
    device_control.autorun_disabledWindowstrue2.2.4
    device_control.usb_storage_encryption_requiredWindowstrue3.5.1
    device_control.usb_storage_policyWindowsread_only9.4.1
    encryption.escrow_recovery_keyAlltrue3.7.1
    encryption.linux_require_disk_encryptionLinuxtrue3.5.1
    encryption.macos_require_filevaultmacOStrue3.5.1
    encryption.require_fixed_drive_encryptionWindowstrue3.5.1
    encryption.require_os_drive_encryptionWindows, macOStrue3.5.1
    firewall.allow_local_rule_mergeWindowsfalse1.5.1
    firewall.default_inbound_actionWindowsblock1.5.1
    firewall.enabled_domain_profileWindowstrue1.5.1
    firewall.enabled_private_profileWindows, macOStrue1.5.1
    firewall.enabled_public_profileWindowstrue1.5.1
    firewall.linux_enabledLinuxtrue1.5.1
    firewall.macos_enabledmacOStrue1.5.1
    lockout.admin_lockout_enabledWindowstrue8.3.4
    lockout.duration_secondsWindows18008.3.4
    lockout.linux_duration_secondsLinux18008.3.4
    lockout.linux_reset_counter_secondsLinux9008.3.4
    lockout.linux_threshold_attemptsLinux108.3.4
    lockout.macos_duration_secondsmacOS18008.3.4
    lockout.macos_threshold_attemptsmacOS108.3.4
    lockout.reset_counter_secondsWindows9008.3.4
    lockout.threshold_attemptsWindows108.3.4
    monitoring.agent_offline_alert_minutesAll3010.7.2
    monitoring.alert_on_new_admin_accountWindowstrue10.2.1.5
    monitoring.alert_on_service_stopAlltrue10.7.2
    monitoring.collect_event_log_errorsAlltrue10.2.1
    monitoring.event_log_channelsWindowsSystem, Application, Security10.2.1
    monitoring.log_retention_daysAll36510.5.1
    monitoring.service_watchlistWindows, LinuxWinDefend, mpssvc, EventLog10.7.2
    password.complexity_enabledWindowstrue8.3.6
    password.history_countWindows48.3.7
    password.linux_max_age_daysLinux908.3.9
    password.linux_min_character_classesLinux38.3.6
    password.linux_min_lengthLinux128.3.6
    password.macos_history_countmacOS48.3.7
    password.macos_max_age_daysmacOS908.3.9
    password.macos_min_character_classesmacOS38.3.6
    password.macos_min_lengthmacOS128.3.6
    password.max_age_daysWindows908.3.9
    password.min_lengthWindows, macOS128.3.6
    password.require_digitWindowstrue8.3.6
    password.reversible_encryptionWindowsfalse8.3.2
    patch.auto_approve_criticalAlltrue6.3.3
    patch.auto_approve_securityAlltrue6.3.3
    patch.deferral_days_qualityWindows306.3.3
    patch.reboot_policyWindowsnotify_user6.3.3
    patch.third_party_patching_enabledAlltrue6.3.3
    remote_access.clipboard_imagesAllto_endpoint3.4.2
    remote_access.clipboard_textAllto_endpoint3.4.2
    remote_access.file_transferAllto_endpoint3.4.2
    remote_access.idle_resume_requires_reauthAlltrue8.2.8
    remote_access.tech_idle_pause_minutesAll158.2.8
    script_execution.log_script_outputAlltrue10.2.1.2
    script_execution.require_signed_scriptsAlltrue6.5.1
    session.disconnect_idle_rdp_secondsWindows9008.2.8
    session.linux_screen_lock_timeout_secondsLinux9008.2.8
    session.macos_screen_lock_timeout_secondsmacOS9008.2.8
    session.require_password_on_wakeWindows, macOStrue8.2.8
    session.screen_lock_timeout_secondsWindows, macOS9008.2.8
    session.screensaver_enabledWindowstrue8.2.8
    software.allow_user_installsWindowsfalse2.2.4
    software.installer_signature_requiredAlltrue6.5.1
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktop7.2.2
    uac.enabledWindowstrue7.2.1
    updates.automatic_security_updatesLinuxtrue6.3.3
    updates.macos_automatic_security_updatesmacOStrue6.3.3
    vuln.alert_min_severityAllhigh6.3.1

    CJIS Security Policy

    Section titled “CJIS Security Policy”

    Profile CJIS Baseline. The console labels this framework CJIS. Enforced: 76 floors across 25 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrueSI-3
    antimalware.pua_protectionWindowstrueSI-8
    antimalware.real_time_protectionWindowstrueSI-3
    antimalware.signature_update_interval_secondsWindows86400SI-3
    antimalware.tamper_protectionWindowstrueSI-3
    audit.linux_auditd_enabledLinuxtrueAU-2
    audit.logon_eventsWindowstrueAU-2
    audit.policy_changeWindowstrueAU-2
    audit.process_creation_command_lineWindowstrueAU-3
    audit.security_log_max_bytesWindows201326592AU-4
    browser.enforce_safe_browsingWindowstrueSI-8
    compliance.endpoint_audit_retention_daysDepot365AU-11
    credentials.local_admin.rotation_interval_daysWindows30IA-5
    device_activity.alert_on_driver_changeAlltrueAU-2
    device_activity.alert_on_service_changeAlltrueSI-4
    device_activity.alert_on_usb_storageAlltrueSC-28
    device_activity.enabledAlltrueAU-2
    device_control.autorun_disabledWindowstrueSI-3
    device_control.usb_storage_encryption_requiredWindowstrueMP-4
    device_control.usb_storage_policyWindowsread_onlyMP-7
    encryption.escrow_recovery_keyAlltrueSC-12
    encryption.linux_require_disk_encryptionLinuxtrueSC-28
    encryption.macos_require_filevaultmacOStrueSC-28
    encryption.os_drive_cipherWindowsxts_aes_256SC-28(1)
    encryption.require_fixed_drive_encryptionWindowstrueSC-28(1)
    encryption.require_os_drive_encryptionWindows, macOStrueSC-28
    firewall.default_inbound_actionWindowsblockSC-7(5)
    firewall.enabled_domain_profileWindowstrueSC-7
    firewall.enabled_private_profileWindows, macOStrueSC-7
    firewall.enabled_public_profileWindowstrueSC-7
    firewall.linux_enabledLinuxtrueSC-7
    firewall.macos_enabledmacOStrueSC-7
    lockout.admin_lockout_enabledWindowstrueAC-7
    lockout.duration_secondsWindows600AC-7
    lockout.linux_duration_secondsLinux600AC-7
    lockout.linux_threshold_attemptsLinux5AC-7
    lockout.macos_duration_secondsmacOS600AC-7
    lockout.macos_threshold_attemptsmacOS5AC-7
    lockout.threshold_attemptsWindows5AC-7
    monitoring.alert_on_new_admin_accountWindowstrueAC-2(4)
    monitoring.alert_on_service_stopAlltrueAU-5
    monitoring.collect_event_log_errorsAlltrueAU-2
    monitoring.event_log_channelsWindowsSystem, Application, SecurityAU-2
    monitoring.log_retention_daysAll365AU-11
    passcode.requirediOS, AndroidtrueAC-19
    password.complexity_enabledWindowstrueIA-5(1)
    password.history_countWindows10IA-5(1)
    password.linux_max_age_daysLinux90IA-5(1)
    password.linux_min_character_classesLinux3IA-5(1)
    password.linux_min_lengthLinux8IA-5
    password.macos_history_countmacOS10IA-5(1)
    password.macos_max_age_daysmacOS90IA-5(1)
    password.macos_min_character_classesmacOS3IA-5(1)
    password.macos_min_lengthmacOS8IA-5
    password.max_age_daysWindows90IA-5(1)
    password.min_lengthWindows, macOS8IA-5
    patch.auto_approve_criticalAlltrueSI-2
    patch.auto_approve_securityAlltrueSI-2
    patch.deferral_days_qualityWindows30SI-2
    patch.reboot_policyWindowsnotify_userSI-2
    remote_access.allowed_modesAllattended, consent, escortedAC-17
    remote_access.clipboard_imagesAllnoneAC-17
    remote_access.clipboard_textAllnoneAC-17
    remote_access.escort_quorumAll2AC-3
    remote_access.file_transferAllnoneAC-17
    script_execution.log_script_outputAlltrueAU-2
    script_execution.require_signed_scriptsAlltrueSI-10
    session.disconnect_idle_rdp_secondsWindows1800AC-11
    session.linux_screen_lock_timeout_secondsLinux1800AC-11
    session.macos_screen_lock_timeout_secondsmacOS1800AC-11
    session.require_password_on_wakeWindows, macOStrueAC-11
    session.screen_lock_timeout_secondsWindows, macOS1800AC-11
    session.screensaver_enabledWindowstrueAC-11
    uac.enabledWindowstrueAC-3
    updates.automatic_security_updatesLinuxtrueSI-2
    updates.macos_automatic_security_updatesmacOStrueSI-2

    NIST SP 800-171

    Section titled “NIST SP 800-171”

    Profile NIST 800-171 Baseline. The console labels this framework NIST SP 800-171. Enforced: 77 floors across 28 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrue3.14.2
    antimalware.pua_protectionWindowstrue3.14.2
    antimalware.real_time_protectionWindowstrue3.14.2
    antimalware.signature_update_interval_secondsWindows864003.14.4
    antimalware.tamper_protectionWindowstrue3.14.2
    audit.linux_auditd_enabledLinuxtrue3.3.1
    audit.logon_eventsWindowstrue3.3.1
    audit.policy_changeWindowstrue3.3.1
    audit.process_creation_command_lineWindowstrue3.3.2
    audit.security_log_max_bytesWindows2013265923.3.1
    compliance.endpoint_audit_retention_daysDepot10953.3.1
    device_activity.alert_on_driver_changeAlltrue3.4.3
    device_activity.alert_on_service_changeAlltrue3.14.6
    device_activity.alert_on_usb_storageAlltrue3.8.7
    device_activity.enabledAlltrue3.3.1
    device_control.autorun_disabledWindowstrue3.4.6
    device_control.usb_storage_encryption_requiredWindowstrue3.8.7
    device_control.usb_storage_policyWindowsread_only3.8.7
    encryption.escrow_recovery_keyAlltrue3.13.10
    encryption.linux_require_disk_encryptionLinuxtrue3.13.16
    encryption.macos_require_filevaultmacOStrue3.13.16
    encryption.require_fixed_drive_encryptionWindowstrue3.13.16
    encryption.require_os_drive_encryptionWindows, macOStrue3.13.16
    firewall.allow_local_rule_mergeWindowsfalse3.4.2
    firewall.default_inbound_actionWindowsblock3.13.6
    firewall.enabled_domain_profileWindowstrue3.13.1
    firewall.enabled_private_profileWindows, macOStrue3.13.1
    firewall.enabled_public_profileWindowstrue3.13.1
    firewall.linux_enabledLinuxtrue3.13.1
    firewall.macos_enabledmacOStrue3.13.1
    lockout.admin_lockout_enabledWindowstrue3.1.8
    lockout.duration_secondsWindows9003.1.8
    lockout.linux_duration_secondsLinux9003.1.8
    lockout.linux_threshold_attemptsLinux53.1.8
    lockout.macos_duration_secondsmacOS9003.1.8
    lockout.macos_threshold_attemptsmacOS53.1.8
    lockout.threshold_attemptsWindows53.1.8
    monitoring.alert_on_new_admin_accountWindowstrue3.5.5
    monitoring.alert_on_service_stopAlltrue3.14.6
    monitoring.log_retention_daysAll10953.3.1
    passcode.requirediOS, Androidtrue3.1.18
    password.complexity_enabledWindowstrue3.5.7
    password.history_countWindows243.5.8
    password.linux_max_age_daysLinux903.5.6
    password.linux_min_character_classesLinux33.5.7
    password.linux_min_lengthLinux123.5.7
    password.macos_history_countmacOS243.5.8
    password.macos_max_age_daysmacOS903.5.6
    password.macos_min_character_classesmacOS33.5.7
    password.macos_min_lengthmacOS123.5.7
    password.max_age_daysWindows903.5.6
    password.min_lengthWindows, macOS123.5.7
    password.reversible_encryptionWindowsfalse3.5.10
    patch.auto_approve_criticalAlltrue3.14.1
    patch.auto_approve_securityAlltrue3.14.1
    patch.deferral_days_qualityWindows303.14.1
    patch.reboot_policyWindowsnotify_user3.14.1
    remote_access.allowed_modesAllattended, consent, escorted3.1.12
    remote_access.file_transferAllto_endpoint3.1.12
    script_execution.log_script_outputAlltrue3.3.2
    script_execution.powershell_execution_policyWindowsall_signed3.4.8
    script_execution.require_signed_scriptsAlltrue3.4.8
    session.disconnect_idle_rdp_secondsWindows9003.1.11
    session.linux_screen_lock_timeout_secondsLinux9003.1.10
    session.macos_screen_lock_timeout_secondsmacOS9003.1.10
    session.require_password_on_wakeWindows, macOStrue3.1.10
    session.screen_lock_timeout_secondsWindows, macOS9003.1.10
    session.screensaver_enabledWindowstrue3.1.10
    software.allow_user_installsWindowsfalse3.4.9
    software.installer_signature_requiredAlltrue3.4.8
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktop3.1.5
    uac.detect_application_installsWindowstrue3.4.9
    uac.enabledWindowstrue3.1.5
    uac.standard_user_elevationWindowsautomatically_deny3.1.7
    updates.automatic_security_updatesLinuxtrue3.14.1
    updates.macos_automatic_security_updatesmacOStrue3.14.1
    vuln.alert_min_severityAllhigh3.11.3

    NIST SP 800-53 Rev 5

    Section titled “NIST SP 800-53 Rev 5”

    Profile NIST 800-53 Baseline. The console labels this framework NIST SP 800-53. Enforced: 83 floors across 30 cited controls.

    SettingPlatformsFloorControl
    antimalware.cloud_protection_levelWindowshighSI-3
    antimalware.macos_gatekeeper_enabledmacOStrueSI-3
    antimalware.pua_protectionWindowstrueSI-3
    antimalware.real_time_protectionWindowstrueSI-3
    antimalware.signature_update_interval_secondsWindows86400SI-3
    antimalware.tamper_protectionWindowstrueSI-3
    audit.linux_auditd_enabledLinuxtrueAU-2
    audit.logon_eventsWindowstrueAU-2
    audit.policy_changeWindowstrueAU-2
    audit.process_creation_command_lineWindowstrueAU-3
    audit.security_log_max_bytesWindows201326592AU-4
    browser.enforce_safe_browsingWindowstrueSI-3
    compliance.endpoint_audit_retention_daysDepot1095AU-11
    device_activity.alert_on_driver_changeAlltrueCM-6
    device_activity.alert_on_service_changeAlltrueCM-6
    device_activity.alert_on_usb_storageAlltrueMP-7
    device_activity.enabledAlltrueAU-2
    device_control.autorun_disabledWindowstrueCM-7
    device_control.block_bluetooth_file_transferWindowstrueCM-7
    device_control.usb_storage_encryption_requiredWindowstrueMP-7
    device_control.usb_storage_policyWindowsread_onlyMP-7
    encryption.escrow_recovery_keyAlltrueSC-12
    encryption.linux_require_disk_encryptionLinuxtrueSC-28(1)
    encryption.macos_require_filevaultmacOStrueSC-28(1)
    encryption.require_fixed_drive_encryptionWindowstrueSC-28(1)
    encryption.require_os_drive_encryptionWindows, macOStrueSC-28(1)
    firewall.allow_local_rule_mergeWindowsfalseCM-6
    firewall.default_inbound_actionWindowsblockSC-7(5)
    firewall.enabled_domain_profileWindowstrueSC-7
    firewall.enabled_private_profileWindows, macOStrueSC-7
    firewall.enabled_public_profileWindowstrueSC-7
    firewall.linux_enabledLinuxtrueSC-7
    firewall.macos_enabledmacOStrueSC-7
    lockout.admin_lockout_enabledWindowstrueAC-7
    lockout.duration_secondsWindows900AC-7
    lockout.linux_duration_secondsLinux900AC-7
    lockout.linux_threshold_attemptsLinux5AC-7
    lockout.macos_duration_secondsmacOS900AC-7
    lockout.macos_threshold_attemptsmacOS5AC-7
    lockout.threshold_attemptsWindows5AC-7
    monitoring.agent_offline_alert_minutesAll30SI-4
    monitoring.alert_on_new_admin_accountWindowstrueAC-2(4)
    monitoring.alert_on_service_stopAlltrueSI-4
    monitoring.collect_event_log_errorsAlltrueAU-6
    monitoring.event_log_channelsWindowsSystem, Application, SecurityAU-2
    monitoring.log_retention_daysAll1095AU-11
    passcode.requirediOS, AndroidtrueAC-19
    password.complexity_enabledWindowstrueIA-5(1)
    password.history_countWindows24IA-5(1)
    password.linux_max_age_daysLinux90IA-5(1)
    password.linux_min_character_classesLinux3IA-5(1)
    password.linux_min_lengthLinux12IA-5(1)
    password.macos_history_countmacOS24IA-5(1)
    password.macos_max_age_daysmacOS90IA-5(1)
    password.macos_min_character_classesmacOS3IA-5(1)
    password.macos_min_lengthmacOS12IA-5(1)
    password.max_age_daysWindows90IA-5(1)
    password.min_lengthWindows, macOS12IA-5(1)
    password.reversible_encryptionWindowsfalseIA-5(1)
    patch.auto_approve_criticalAlltrueSI-2
    patch.auto_approve_securityAlltrueSI-2
    patch.deferral_days_qualityWindows30SI-2
    patch.reboot_policyWindowsnotify_userSI-2
    remote_access.allowed_modesAllattended, consent, escortedAC-17
    remote_access.file_transferAllto_endpointAC-17
    script_execution.log_script_outputAlltrueAC-6(9)
    script_execution.powershell_execution_policyWindowsall_signedCM-7(2)
    script_execution.require_signed_scriptsAlltrueCM-14
    session.disconnect_idle_rdp_secondsWindows900AC-12
    session.linux_screen_lock_timeout_secondsLinux900AC-11
    session.macos_screen_lock_timeout_secondsmacOS900AC-11
    session.require_password_on_wakeWindows, macOStrueAC-11
    session.screen_lock_timeout_secondsWindows, macOS900AC-11
    session.screensaver_enabledWindowstrueAC-11(1)
    software.allow_user_installsWindowsfalseCM-11
    software.installer_signature_requiredAlltrueCM-14
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktopAC-6
    uac.detect_application_installsWindowstrueCM-11
    uac.enabledWindowstrueAC-6
    uac.standard_user_elevationWindowsautomatically_denyAC-6(10)
    updates.automatic_security_updatesLinuxtrueSI-2
    updates.macos_automatic_security_updatesmacOStrueSI-2
    vuln.alert_min_severityAllhighRA-5

    CMMC Level 2

    Section titled “CMMC Level 2”

    Profile CMMC Level 2 Baseline. The console labels this framework CMMC Level 2. Enforced: 73 floors across 27 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrueSI.L1-3.14.2
    antimalware.pua_protectionWindowstrueSI.L1-3.14.2
    antimalware.real_time_protectionWindowstrueSI.L1-3.14.2
    antimalware.signature_update_interval_secondsWindows86400SI.L1-3.14.4
    antimalware.tamper_protectionWindowstrueSI.L1-3.14.2
    audit.linux_auditd_enabledLinuxtrueAU.L2-3.3.1
    audit.logon_eventsWindowstrueAU.L2-3.3.1
    audit.policy_changeWindowstrueAU.L2-3.3.1
    audit.process_creation_command_lineWindowstrueAU.L2-3.3.2
    audit.security_log_max_bytesWindows201326592AU.L2-3.3.1
    compliance.endpoint_audit_retention_daysDepot1095AU.L2-3.3.1
    device_control.autorun_disabledWindowstrueCM.L2-3.4.6
    device_control.usb_storage_encryption_requiredWindowstrueMP.L2-3.8.7
    device_control.usb_storage_policyWindowsread_onlyMP.L2-3.8.7
    encryption.escrow_recovery_keyAlltrueSC.L2-3.13.10
    encryption.linux_require_disk_encryptionLinuxtrueSC.L2-3.13.16
    encryption.macos_require_filevaultmacOStrueSC.L2-3.13.16
    encryption.require_fixed_drive_encryptionWindowstrueSC.L2-3.13.16
    encryption.require_os_drive_encryptionWindows, macOStrueSC.L2-3.13.16
    firewall.allow_local_rule_mergeWindowsfalseCM.L2-3.4.2
    firewall.default_inbound_actionWindowsblockSC.L2-3.13.6
    firewall.enabled_domain_profileWindowstrueSC.L1-3.13.1
    firewall.enabled_private_profileWindows, macOStrueSC.L1-3.13.1
    firewall.enabled_public_profileWindowstrueSC.L1-3.13.1
    firewall.linux_enabledLinuxtrueSC.L1-3.13.1
    firewall.macos_enabledmacOStrueSC.L1-3.13.1
    lockout.admin_lockout_enabledWindowstrueAC.L2-3.1.8
    lockout.duration_secondsWindows900AC.L2-3.1.8
    lockout.linux_duration_secondsLinux900AC.L2-3.1.8
    lockout.linux_threshold_attemptsLinux5AC.L2-3.1.8
    lockout.macos_duration_secondsmacOS900AC.L2-3.1.8
    lockout.macos_threshold_attemptsmacOS5AC.L2-3.1.8
    lockout.threshold_attemptsWindows5AC.L2-3.1.8
    monitoring.alert_on_new_admin_accountWindowstrueIA.L2-3.5.5
    monitoring.alert_on_service_stopAlltrueSI.L2-3.14.6
    monitoring.log_retention_daysAll1095AU.L2-3.3.1
    password.complexity_enabledWindowstrueIA.L2-3.5.7
    password.history_countWindows24IA.L2-3.5.8
    password.linux_max_age_daysLinux90IA.L2-3.5.6
    password.linux_min_character_classesLinux3IA.L2-3.5.7
    password.linux_min_lengthLinux12IA.L2-3.5.7
    password.macos_history_countmacOS24IA.L2-3.5.8
    password.macos_max_age_daysmacOS90IA.L2-3.5.6
    password.macos_min_character_classesmacOS3IA.L2-3.5.7
    password.macos_min_lengthmacOS12IA.L2-3.5.7
    password.max_age_daysWindows90IA.L2-3.5.6
    password.min_lengthWindows, macOS12IA.L2-3.5.7
    password.reversible_encryptionWindowsfalseIA.L2-3.5.10
    patch.auto_approve_criticalAlltrueSI.L1-3.14.1
    patch.auto_approve_securityAlltrueSI.L1-3.14.1
    patch.deferral_days_qualityWindows30SI.L1-3.14.1
    patch.reboot_policyWindowsnotify_userSI.L1-3.14.1
    remote_access.allowed_modesAllattended, consent, escortedAC.L2-3.1.12
    remote_access.file_transferAllto_endpointAC.L2-3.1.12
    script_execution.log_script_outputAlltrueAU.L2-3.3.2
    script_execution.powershell_execution_policyWindowsall_signedCM.L2-3.4.8
    script_execution.require_signed_scriptsAlltrueCM.L2-3.4.8
    session.disconnect_idle_rdp_secondsWindows900AC.L2-3.1.11
    session.linux_screen_lock_timeout_secondsLinux900AC.L2-3.1.10
    session.macos_screen_lock_timeout_secondsmacOS900AC.L2-3.1.10
    session.require_password_on_wakeWindows, macOStrueAC.L2-3.1.10
    session.screen_lock_timeout_secondsWindows, macOS900AC.L2-3.1.10
    session.screensaver_enabledWindowstrueAC.L2-3.1.10
    software.allow_user_installsWindowsfalseCM.L2-3.4.9
    software.installer_signature_requiredAlltrueCM.L2-3.4.8
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktopAC.L2-3.1.5
    uac.detect_application_installsWindowstrueCM.L2-3.4.9
    uac.enabledWindowstrueAC.L2-3.1.5
    uac.standard_user_elevationWindowsautomatically_denyAC.L2-3.1.7
    updates.automatic_security_updatesLinuxtrueSI.L1-3.14.1
    updates.macos_automatic_security_updatesmacOStrueSI.L1-3.14.1
    vuln.alert_min_severityAllhighRA.L2-3.11.3

    ISO/IEC 27001

    Section titled “ISO/IEC 27001”

    Profile ISO 27001 Baseline. The console labels this framework ISO/IEC 27001. Enforced: 72 floors across 16 cited controls.

    SettingPlatformsFloorControl
    antimalware.macos_gatekeeper_enabledmacOStrueA.8.7
    antimalware.pua_protectionWindowstrueA.8.7
    antimalware.real_time_protectionWindowstrueA.8.7
    antimalware.signature_update_interval_secondsWindows86400A.8.7
    antimalware.tamper_protectionWindowstrueA.8.7
    audit.linux_auditd_enabledLinuxtrueA.8.15
    audit.logon_eventsWindowstrueA.8.15
    audit.policy_changeWindowstrueA.8.15
    audit.process_creation_command_lineWindowstrueA.8.15
    audit.security_log_max_bytesWindows201326592A.8.15
    compliance.endpoint_audit_retention_daysDepot365A.5.33
    compliance.evidence_retention_daysDepot365A.5.33
    device_activity.alert_on_usb_storageAlltrueA.7.10
    device_control.autorun_disabledWindowstrueA.8.7
    device_control.usb_storage_encryption_requiredWindowstrueA.7.10
    device_control.usb_storage_policyWindowsread_onlyA.7.10
    encryption.escrow_recovery_keyAlltrueA.8.24
    encryption.linux_require_disk_encryptionLinuxtrueA.8.24
    encryption.macos_require_filevaultmacOStrueA.8.24
    encryption.require_fixed_drive_encryptionWindowstrueA.8.24
    encryption.require_os_drive_encryptionWindows, macOStrueA.8.24
    firewall.default_inbound_actionWindowsblockA.8.20
    firewall.enabled_domain_profileWindowstrueA.8.20
    firewall.enabled_private_profileWindows, macOStrueA.8.20
    firewall.enabled_public_profileWindowstrueA.8.20
    firewall.linux_enabledLinuxtrueA.8.20
    firewall.macos_enabledmacOStrueA.8.20
    lockout.admin_lockout_enabledWindowstrueA.8.5
    lockout.duration_secondsWindows900A.8.5
    lockout.linux_duration_secondsLinux900A.8.5
    lockout.linux_threshold_attemptsLinux10A.8.5
    lockout.macos_duration_secondsmacOS900A.8.5
    lockout.macos_threshold_attemptsmacOS10A.8.5
    lockout.threshold_attemptsWindows10A.8.5
    monitoring.alert_on_new_admin_accountWindowstrueA.8.16
    monitoring.alert_on_service_stopAlltrueA.8.16
    monitoring.log_retention_daysAll365A.8.15
    password.complexity_enabledWindowstrueA.5.17
    password.history_countWindows24A.5.17
    password.linux_max_age_daysLinux90A.5.17
    password.linux_min_character_classesLinux3A.5.17
    password.linux_min_lengthLinux12A.5.17
    password.macos_history_countmacOS24A.5.17
    password.macos_max_age_daysmacOS90A.5.17
    password.macos_min_character_classesmacOS3A.5.17
    password.macos_min_lengthmacOS12A.5.17
    password.max_age_daysWindows90A.5.17
    password.min_lengthWindows, macOS12A.5.17
    password.reversible_encryptionWindowsfalseA.5.17
    patch.auto_approve_criticalAlltrueA.8.8
    patch.auto_approve_securityAlltrueA.8.8
    patch.deferral_days_qualityWindows30A.8.8
    patch.reboot_policyWindowsnotify_userA.8.8
    remote_access.clipboard_imagesAllto_endpointA.8.12
    remote_access.clipboard_textAllto_endpointA.8.12
    remote_access.file_transferAllto_endpointA.8.12
    script_execution.log_script_outputAlltrueA.8.15
    script_execution.require_signed_scriptsAlltrueA.8.18
    session.disconnect_idle_rdp_secondsWindows900A.5.15
    session.linux_screen_lock_timeout_secondsLinux900A.7.7
    session.macos_screen_lock_timeout_secondsmacOS900A.7.7
    session.require_password_on_wakeWindows, macOStrueA.7.7
    session.screen_lock_timeout_secondsWindows, macOS900A.7.7
    session.screensaver_enabledWindowstrueA.7.7
    software.allow_user_installsWindowsfalseA.8.19
    software.installer_signature_requiredAlltrueA.8.19
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktopA.8.2
    uac.detect_application_installsWindowstrueA.8.19
    uac.enabledWindowstrueA.8.2
    updates.automatic_security_updatesLinuxtrueA.8.8
    updates.macos_automatic_security_updatesmacOStrueA.8.8

    DISA STIG

    Section titled “DISA STIG”

    Profile DISA STIG Hardening. The console labels this framework STIG. Advisory: 87 recommended values across 63 cited controls. None of them is a floor.

    SettingPlatformsRecommended valueControl
    antimalware.cloud_protection_levelWindowshighWNDF-AV-000010
    antimalware.excluded_pathsWindowsnoneWNDF-AV-000005
    antimalware.macos_gatekeeper_enabledmacOStrueApple macOS STIG
    antimalware.pua_protectionWindowstrueWNDF-AV-000001
    antimalware.real_time_protectionWindowstrueWNDF-AV-000021
    antimalware.signature_update_interval_secondsWindows86400WNDF-AV-000030
    audit.linux_auditd_enabledLinuxtrueRHEL 9 STIG, auditd active
    audit.logon_eventsWindowstrueWN11-AU-000070
    audit.policy_changeWindowstrueWN11-AU-000100
    audit.process_creation_command_lineWindowstrueWN11-CC-000066
    audit.security_log_max_bytesWindows1048576WN11-AU-000500
    browser.block_password_managerWindowstrueEDGE-00-000043
    browser.enforce_safe_browsingWindowstrueEDGE-00-000050
    browser.extension_install_blocklistWindows*EDGE-00-000041
    browser.incognito_mode_availabilityWindowsdisabledEDGE-00-000005
    device_activity.alert_on_driver_changeAlltrueWN11-CC-000000
    device_activity.alert_on_service_changeAlltrueWN11-00-000000
    device_activity.alert_on_usb_storageAlltrueWN11-00-000000
    device_activity.enabledAlltrueWN11-AU-000000
    device_control.autorun_disabledWindowstrueWN11-CC-000185
    device_control.block_bluetooth_file_transferWindowstrueWN11-00-000210
    discovery.snmp_enabledAllfalseWN11-00-000105
    encryption.linux_require_disk_encryptionLinuxtrueRHEL 9 STIG, LUKS data at rest
    encryption.macos_require_filevaultmacOStrueApple macOS STIG
    encryption.require_fixed_drive_encryptionWindowstrueWN11-00-000030
    encryption.require_os_drive_encryptionWindows, macOStrueWN11-00-000030
    encryption.require_pre_boot_authenticationWindowstrueWN11-00-000031
    firewall.allow_local_rule_mergeWindowsfalseWNFWA-000024
    firewall.default_inbound_actionWindowsblockWN11-FW-000010
    firewall.default_outbound_actionWindowsallowWNFWA-000005
    firewall.enabled_domain_profileWindowstrueWNFWA-000001
    firewall.enabled_private_profileWindows, macOStrueWNFWA-000002
    firewall.enabled_public_profileWindowstrueWNFWA-000003
    firewall.linux_enabledLinuxtrueRHEL 9 STIG, firewalld active
    firewall.macos_enabledmacOStrueApple macOS STIG
    firewall.macos_stealth_modemacOStrueApple macOS STIG
    lockout.admin_lockout_enabledWindowstrueWN11-AC-000010
    lockout.duration_secondsWindows900WN11-AC-000005
    lockout.linux_reset_counter_secondsLinux900RHEL 9 STIG, faillock fail_interval
    lockout.linux_threshold_attemptsLinux3RHEL 9 STIG, faillock deny
    lockout.macos_duration_secondsmacOS900Apple macOS STIG
    lockout.macos_threshold_attemptsmacOS3Apple macOS STIG
    lockout.reset_counter_secondsWindows900WN11-AC-000015
    lockout.threshold_attemptsWindows3WN11-AC-000010
    monitoring.alert_on_new_admin_accountWindowstrueWN11-AU-000040
    password.complexity_enabledWindowstrueWN11-AC-000040
    password.history_countWindows24WN11-AC-000025
    password.linux_max_age_daysLinux60RHEL 9 STIG, PASS_MAX_DAYS
    password.linux_min_age_daysLinux1RHEL 9 STIG, PASS_MIN_DAYS
    password.linux_min_character_classesLinux4RHEL 9 STIG, pwquality minclass
    password.linux_min_lengthLinux15RHEL 9 STIG, pwquality minlen
    password.macos_history_countmacOS5Apple macOS STIG
    password.macos_max_age_daysmacOS60Apple macOS STIG
    password.macos_min_character_classesmacOS4Apple macOS STIG
    password.macos_min_lengthmacOS15Apple macOS STIG
    password.max_age_daysWindows60WN11-AC-000025
    password.min_lengthWindows, macOS14WN11-AC-000035
    password.reversible_encryptionWindowsfalseWN11-AC-000045
    patch.auto_approve_criticalAlltrueWN11-00-000040
    patch.auto_approve_securityAlltrueWN11-00-000040
    patch.deferral_days_qualityWindows30WN11-00-000040
    power.require_password_on_resumeWindowstrueWN11-CC-000145
    remote_access.clipboard_imagesAllto_endpointWN11-CC-000275
    remote_access.clipboard_textAllto_endpointWN11-CC-000275
    remote_access.file_transferAllto_endpointWN11-CC-000275
    script_execution.log_script_outputAlltrueWN11-CC-000327
    script_execution.powershell_execution_policyWindowsall_signedWN11-CC-000326
    session.disconnect_idle_rdp_secondsWindows900WN11-CC-000280
    session.hide_last_signed_in_userWindowstrueWN11-SO-000075
    session.legal_notice_captionWindowsDoD Notice and Consent BannerWN11-SO-000080
    session.legal_notice_textWindowsThe notice text the control citesWN11-SO-000075
    session.linux_screen_lock_timeout_secondsLinux900RHEL 9 STIG, GNOME idle-delay
    session.macos_guest_account_disabledmacOStrueApple macOS STIG
    session.macos_screen_lock_timeout_secondsmacOS900Apple macOS STIG
    session.require_password_on_wakeWindows, macOStrueWN11-SO-000070
    session.screen_lock_timeout_secondsWindows, macOS900WN11-SO-000070
    session.screensaver_enabledWindowstrueWN11-SO-000070
    software.allow_user_installsWindowsfalseWN11-CC-000315
    ssh.macos_remote_loginmacOSoffApple macOS STIG
    ssh.permit_root_loginLinuxnoRHEL 9 STIG, PermitRootLogin
    ssh.x11_forwardingLinuxnoRHEL 9 STIG, X11Forwarding
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktopWN11-SO-000250
    uac.detect_application_installsWindowstrueWN11-SO-000260
    uac.enabledWindowstrueWN11-SO-000245
    uac.standard_user_elevationWindowsautomatically_denyWN11-SO-000255
    updates.automatic_security_updatesLinuxtrueRHEL 9 STIG, security patching
    updates.macos_automatic_security_updatesmacOStrueApple macOS STIG

    Microsoft security baseline

    Section titled “Microsoft security baseline”

    Profile Microsoft Security Baseline. The console labels this framework Microsoft baseline. Advisory: 40 recommended values across 6 cited controls. None of them is a floor.

    SettingPlatformsRecommended valueControl
    antimalware.cloud_protection_levelWindowshighWindows 11 24H2 Security Baseline
    antimalware.pua_protectionWindowstrueWindows 11 24H2 Security Baseline
    antimalware.real_time_protectionWindowstrueWindows 11 24H2 Security Baseline
    audit.logon_eventsWindowstrueWindows 11 24H2 Security Baseline
    audit.policy_changeWindowstrueWindows 11 24H2 Security Baseline
    audit.process_creation_command_lineWindowstrueWindows 11 24H2 Security Baseline
    audit.security_log_max_bytesWindows201326592Windows 11 24H2 Security Baseline
    browser.enforce_safe_browsingWindowstrueMicrosoft Edge v139 Security Baseline
    browser.extension_install_blocklistWindows*Microsoft Edge v139 Security Baseline
    device_activity.alert_on_driver_changeAlltrueDevice Installation
    device_activity.alert_on_service_changeAlltrueWindows Defender Antivirus
    device_activity.alert_on_usb_storageAlltrueRemovable Storage Access
    device_control.autorun_disabledWindowstrueWindows 11 24H2 Security Baseline
    device_control.usb_storage_encryption_requiredWindowstrueWindows 11 24H2 Security Baseline
    encryption.os_drive_cipherWindowsxts_aes_256Windows 11 24H2 Security Baseline (BitLocker)
    encryption.require_os_drive_encryptionWindows, macOStrueWindows 11 24H2 Security Baseline (BitLocker)
    firewall.allow_local_rule_mergeWindowsfalseWindows 11 24H2 Security Baseline
    firewall.default_inbound_actionWindowsblockWindows 11 24H2 Security Baseline
    firewall.default_outbound_actionWindowsallowWindows 11 24H2 Security Baseline
    firewall.enabled_domain_profileWindowstrueWindows 11 24H2 Security Baseline
    firewall.enabled_private_profileWindows, macOStrueWindows 11 24H2 Security Baseline
    firewall.enabled_public_profileWindowstrueWindows 11 24H2 Security Baseline
    lockout.admin_lockout_enabledWindowstrueWindows 11 24H2 Security Baseline
    lockout.duration_secondsWindows600Windows 11 24H2 Security Baseline
    lockout.reset_counter_secondsWindows600Windows 11 24H2 Security Baseline
    lockout.threshold_attemptsWindows10Windows 11 24H2 Security Baseline
    password.complexity_enabledWindowstrueWindows 11 24H2 Security Baseline
    password.history_countWindows24Windows 11 24H2 Security Baseline
    password.min_lengthWindows, macOS14Windows 11 24H2 Security Baseline
    password.reversible_encryptionWindowsfalseWindows 11 24H2 Security Baseline
    power.require_password_on_resumeWindowstrueWindows 11 24H2 Security Baseline
    remote_access.clipboard_imagesAllto_endpointWindows 11 24H2 Security Baseline
    remote_access.clipboard_textAllto_endpointWindows 11 24H2 Security Baseline
    remote_access.file_transferAllto_endpointWindows 11 24H2 Security Baseline
    script_execution.log_script_outputAlltrueWindows 11 24H2 Security Baseline
    session.screen_lock_timeout_secondsWindows, macOS900Windows 11 24H2 Security Baseline
    uac.admin_approval_promptWindowsprompt_for_consent_secure_desktopWindows 11 24H2 Security Baseline
    uac.detect_application_installsWindowstrueWindows 11 24H2 Security Baseline
    uac.enabledWindowstrueWindows 11 24H2 Security Baseline
    uac.standard_user_elevationWindowsautomatically_denyWindows 11 24H2 Security Baseline
    Section titled “Related”

    Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.