Top 10 Most Important Group Policy Settings for Preventing Security Breaches

There are some simple Group Policy Settings, which if appropriately configured, can help to prevent data breaches. You can make your organizational network safer by configuring the security and operational behavior of computers through Group Policy (a group of settings in the computer registry). Through Group Policy, you can prevent users from accessing specific resources, run scripts, and perform simple tasks such as forcing a particular home page to open for every user in the network. In this article, you will learn about some important Group Policy settings that simply cannot be ignored.

Common Steps to Modify Group Policies

You must always remember to modify custom GPOs only, (create a new GPO and link it to the domain) available under “Domain Controllers” in the Group Policy Management Console. After applying the suggested changes, make your GPO applicable to “Everyone” in the domain and update the Group Policy Objects.

1. Moderating Access to Control Panel

Setting limits on a computers’ Control Panel creates a safer business environment. Through Control Panel, you can control all aspects of your computer. So, by moderating who has access to the computer, you can keep data and other resources safe. Perform the following steps:

1. In Group Policy Management Editor (opened for a user-created GPO), navigate to “User Configuration” “Administrative Templates” “Control Panel”.
2. In the right pane, double-click “Prohibit access to Control Panel and PC settings” policy in to open its properties.
3. Select “Enabled” from the three options.
4. Click “Apply” and “OK”.

Figure 1: Configuring Control panel settings through GPO

2. Prevent Windows from Storing LAN Manager Hash

Windows generates and stores user account passwords in “hashes.” Windows generates both a LAN Manager hash (LM hash) and a Windows NT hash (NT hash) of passwords. It stores them in the local Security Accounts Manager (SAM) database or Active Directory.

The LM hash is weak and prone to hacking. Therefore, you should prevent Windows from storing an LM hash of your passwords. Perform the following steps to do so:

1. In Group Policy Management Editor window (opened for a custom GPO), go to “Computer Configuration” “Windows Settings” “Security Settings” “Local Policies” “Security Options”.
2. In the right pane, double-click “Network security: Do not store LAN Manager hash value on next password change” policy.
3. Select “Define this policy setting” checkbox and click “Enabled.
4. Click “Apply” and “OK”.

Figure 2: Configuring policy to not store LAN Manager hash value policy

3. Control Access to Command Prompt

Command Prompts can be used to run commands that give high-level access to users and evade other restrictions on the system. So, to ensure system resources’ security, it’s wise to disable Command Prompt.

After you have disabled Command Prompt and someone tries to open a command window, the system will display a message stating that some settings are preventing this action. Perform the following steps:

1. In the window of Group Policy Management Editor (opened for a custom GPO), go to “User Configuration” “Windows Settings” “Policies” “Administrative Templates” “System”.
2. In the right pane, double-click “Prevent access to the command prompt” policy.
3. Click “Enabled” to apply the policy.
4. Click “Apply” and “OK”.

Figure 3: Prevent access to the command prompt window

4. Disable Forced System Restarts

Forced system restarts are common. For example, you may face a situation where you were working on your computer and Windows displays a message stating that your system needs to restart because of a security update.

In many cases, if you fail to notice the message or take some time to respond, the computer restarts automatically, and you lose important, unsaved work. To disable forced restart through GPO, perform the following steps:

1. In “Group Policy Management Editor” window (opened for a custom GPO), go to “Computer Configuration” “Administrative Templates” “Windows Component” “Windows Update”.
2. In the right pane, double-click “No auto-restart with logged on users for scheduled automatic updates installations” policy.
3. Click “Enabled” to enable the policy.
4. Click “Apply” and “OK”.

Figure 4: No system auto-restart with logged on users

5. Disallow Removable Media Drives, DVDs, CDs, and Floppy Drives

Removable media drives are very prone to infection, and they may also contain a virus or malware. If a user plugs an infected drive to a network computer, it can affect the entire network. Similarly, DVDs, CDs and Floppy Drives are prone to infection.

It is therefore best to disable all these drives entirely. Perform the following steps to do so:

1. In Group Policy Management Editor window (opened for a custom GPO), go to “User Configuration” “Policies” “Administrative Templates” “System” “Removable Storage Access”.
2. In the right pane, double-click “All removable storage classes: Deny all accesses” policy
3. Click “Enabled” to enable the policy.
4. Click “Apply” and “OK”.

Figure 5: Deny access to all removable storage classes

6. Restrict Software Installations

When you give users the freedom to install software, they may install unwanted apps that compromise your system. System admins will usually have to routinely do maintenance and cleaning of such systems. To be on the safe side, it’s advisable to prevent software installations through Group Policy:

1. In Group Policy Management Editor (opened for a custom GPO), go to “Computer Configuration” “Administrative Templates” “Windows Component” “Windows Installer”.
2. In the right pane, double-click “Prohibit User Install” policy.
3. Click “Enabled” to enable the policy
4. Click “Apply” and “OK”.

Figure 6: Restricting software installations

7. Disable Guest Account

Through a Guest Account, users can get access to sensitive data. Such accounts grant access to a Windows computer and do not require a password. Enabling this account means anyone can misuse and abuse access to your systems.

Thankfully, these accounts are disabled by default. It’s best to check that this is the case in your IT environment as, if this account is enabled in your domain, disabling it will prevent people from abusing access:

1. In Group Policy Management Editor (opened for a custom GPO), go to “Computer Configuration” “Windows Settings” “Security Settings” “Local Policies” “Security Options”.
2. In the right pane, double-click “Accounts: Guest Account Status” policy.
3. Select “Define this policy setting” checkbox and click “Disabled”.
4. Click “Apply” and “OK”.

Figure 7: Disabling guest account

8. Set Minimum Password Length to Higher Limits

Set the minimum password length to higher limits. For example, for elevated accounts, passwords should be set to at least 15 characters, and for regular accounts at least 12 characters. Setting a lower value for minimum password length creates unnecessary risk. The default setting is “zero” characters, so you will have to specify a number:

1. In Group Policy Management Editor window (opened for a custom GPO), go to “Computer Configuration” “Windows Settings” “Security Settings” “Account Policies” “Password Policy”.
2. In the right pane, double-click “Minimum password length” policy, select “Define this policy setting” checkbox.
3. Specify a value for the password length.
4. Click “Apply” and “OK”.

Figure 8: Configuring minimum password age policy setting

9. Set Maximum Password Age to Lower Limits

If you set the password expiration age to a lengthy period of time, users will not have to change it very frequently, which means it’s more likely a password could get stolen. Shorter password expiration periods are always preferred.

Windows’ default maximum password age is set to 42 days. The following screenshot shows the policy setting used for configuring “Maximum Password Age”. Perform the following steps:

1. In Group Policy Management Editor window (opened for a custom GPO), go to “Computer Configuration” “Windows Settings” “Security Settings” “Account Policies” “Password Policy”.
2. In the right pane, double-click “Maximum password age” policy.
3. Select “Define this policy setting” checkbox and specify a value.
4. Click “Apply” and “OK”.

Figure 9: Configuring maximum password age policy setting

10. Disable Anonymous SID Enumeration

Active Directory assigns a unique number to all security objects in Active Directory; including Users, Groups and others, called Security Identifiers (SID) numbers. In older Windows versions, users could query the SIDs to identify important users and groups. This provision can be exploited by hackers to get unauthorized access to data. By default, this setting is disabled, ensure that it remains that way. Perform the following steps:

1. In Group Policy Management Editor window, go to “Computer Configuration” “Policies” “Windows Settings” “Security Settings” “Local Policies” “Security Options”.
2. In the right pane, double-click “Network Access: Do not allow anonymous enumeration of SAM accounts and shares” policy setting.
3. Choose ‘Enabled’ and then click ‘Apply’ and ‘OK’ to save your settings.

If you get these Group Policy settings correct, your organization’s security will automatically be in a better state. Please make sure to apply the modified Group Policy Object to everyone and update the Group Policies to reflect them on all domain controllers in your environment.

Keep GPO Changes in Control

If you want to remain in full control of your IT Infrastructure, you have to make sure no unwanted changes in these policies and other Group Policies are made. You can do this by performing continuous Group Policy Object auditing.

However, doing through native auditing can be tricky, due to the amount of noise generated and the unavailability of predefined reports. To keep a continuous track of changes made in Group Policy Objects, try Lepide Change Reporter for Group Policy Freeware. Our freeware solution allows you to audit every change made to Group Policies.

How to Delete a PivotTable in Excel

Excel for Office 365 Excel for the web Excel 2019 Excel 2016 Excel 2013 Excel 2010 More...

When you no longer need a PivotTable, select the entire PivotTable, and press the Delete key to remove it.

WindowsWeb

If you get a "Cannot change this part of a PivotTable report" message, make sure the entire PivotTable is selected. Press Ctrl+A, and press Delete again.

If you're using a device that doesn't have a keyboard, try removing the PivotTable like this:

1. Pick a cell anywhere in the PivotTable to show the PivotTable Tools on the ribbon.
   
2. Click Analyze > Select, and then pick Entire PivotTable.
3. Press Delete.

Tip: If your PivotTable is on a separate sheet that has no other data you want to keep, deleting that sheet is a fast way to remove the PivotTable.

Use slicers to filter data in Excel

Use slicers to filter data

Excel for Office 365 Excel for Office 365 for Mac Excel 2019 Excel 2016 More...

Slicers provide buttons that you can click to filter tables, or PivotTables. In addition to quick filtering, slicers also indicate the current filtering state, which makes it easy to understand what exactly is currently displayed.

Create a slicer to filter data

1. Click anywhere in the table or PivotTable.
2. On the Home tab, go to Insert > Slicer.
   
3. In the Insert Slicers dialog box, select the check boxes for the fields you want to display, then select OK.
4. A slicer will be created for every field that you selected. Clicking any of the slicer buttons will automatically apply that filter to the linked table or PivotTable.
   Notes: 

   • To select more than one item, hold Ctrl, and then select the items that you want to show.
   • To clear a slicer's filters, select Clear Filter  in the slicer.
5. You can adjust your slicer preferences in the Slicer tab (in newer versions of Excel), or the Design tab (Excel 2016 and older versions) on the ribbon.
   Note: Select and hold the corner of a slicer to adjust and resize it.
6. If you want to connect a slicer to more than one PivotTable, go to Slicer > Report Connections > check the PivotTables to include, then select OK.
   Note: Slicers can only be connected to PivotTables that share the same data source.

Slicer components

A slicer typically displays the following components:

1. A slicer header indicates the category of the items in the slicer. 2. A filtering button that is not selected indicates that the item is not included in the filter. 3. A filtering button that is selected indicates that the item is included in the filter. 4. A Clear Filter button removes the filter by selecting all items in the slicer. 5. A scroll bar enables scrolling when there are more items than are currently visible in the slicer. 6. Border moving and resizing controls allow you to change the size and location of the slicer.

Display or hide the fill handle in Microsoft Excel

Display or hide the fill handle in Excel

Excel for Office 365 Excel 2019 Excel 2016 Excel 2013 Excel 2010

By default, the fill handle and drag-and-drop editing is turned on in Excel so that you can drag the mouse to move and copy cells by doing the following:

• Move a cell or range of cells by positioning the mouse pointer on a cell or cell range border so that it changes to a move pointer  , and then dragging the cell to another location.
• Copy a cell or range of cells by holding down CTRL while you position the mouse pointer on a cell or cell range border so that it changes to a copy pointer  , and then dragging the cell or range of cells to another location.
• Drag the fill handle  to copy data or to fill adjacent cells with a series of data.

You can turn this option on or off as needed by doing the following:

1. Click File > Options.
2. In the Advanced category, under Editing options, select or clear the Enable fill handle and cell drag-and-drop check box.

Fill handle is showing Quick Analysis and no fill option

For some reason, the option to fill (like a series 1 -50) has gone from the handle when I drag down cells.

It now shows a formatting option as per this picture.

Answer for this question:

Instead to returning fill handler option,  you you will have drag with right click to get Fill Series.

How to reduce ribbon size in Microsoft Excel 2016/2019

After recent updates, the ribbon in Microsoft Excel can take up to 1/3 of the available screen space. Microsoft Office help tells that you can hide or unhide your ribbon, but you cannot reduce the size of your ribbon, or size of the text or the icons. False! You can change the mode and remove unnecessary white space around buttons, and, thus, reduce the ribbon size.

The Ribbon display in Touch Mode:

The Ribbon display in Mouse Mode (the habitual look of the previous versions of Microsoft Excel):

To change the Ribbon mode, click on the dropdown arrow on the right side of the Quick Access Toolbar and choose the Touch/Mouse Mode command:

The Touch/Mouse Mode button was added to your Quick Access Toolbar menu (see more Adding Commands to the Quick Access Toolbar):

By choosing a specific option, you can change the Ribbon mode according to your needs.

Note: This option works for all Microsoft Office applications at once. If you change the mode in Excel, it changes in Microsoft Word, PowerPoint and Outlook.

How to Collapse Ribbon to get more space on screen in Microsoft Office 2016/2019

Collapse Ribbon to get more space on screen

When you need as much space as possible on screen to view a document, you can collapse (or minimize) the Ribbon and then restore it very simple.

To collapse (or minimize) the Ribbon, do one of the following:

• Double-click the label of the tab you're currently using.
• Click the Minimize the Ribbon button:

• Press Ctrl+F1.
• In the Ribbon displays options list, choose Show Tabs:
  

While the Ribbon is minimized, click any tab to turn it back on temporarily. It will automatically hide when you're done using it.

To totally hide the Ribbon, just choose Auto-hide Ribbon in the Ribbon displays options list:

It hide Ribbon and displays three dots near the upper-right corner of the screen instead. Click the three dots button to redisplay the Ribbon temporarily. When you click back in the document, the Ribbon hides itself again:

To expand the Ribbon back to its normal size when you want to have it displayed again, do one of the following:

• Double-click the current tab again.
• While the Ribbon is minimized, click any tab to turn it back on temporarily and the click the Expand the Minimized Ribbon button:
  
• Press Ctrl+F1.
• In the Ribbon displays options list, choose Show Tabs and Commands: