18.7.1.1 Ensure 'Turn off notifications network usage' is set to 'Enabled'

Information

This policy setting blocks applications from using the network to send notifications to update tiles, tile badges, toast, or raw notifications. This policy setting turns off the connection between Windows and the Windows Push Notification Service (WNS). This policy setting also stops applications from being able to poll application services to update tiles.

The recommended state for this setting is: Enabled.

Rationale:

Windows Push Notification Services (WNS) is a mechanism to receive 3rd-party notifications and updates from the cloud/Internet. In a high security environment, external systems, especially those hosted outside the organization, should be prevented from having an impact on the secure workstations.

Impact:

Applications and system features will not be able receive notifications from the network from WNS or via notification polling APIs.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled:

Computer Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Turn off notifications network usage

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WPN.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative Templates (or newer).

Default Value:

Disabled.

See Also

https://workbench.cisecurity.org/files/3784

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 559a1ff597407bca23a5a944743cbddeecc18cb07b503c2366a9afaf20325370