18.8.28.2 Ensure 'Do not display network selection UI' is set to 'Enabled'

Information

This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.

The recommended state for this setting is: Enabled.

Rationale:

An unauthorized user could disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.

Impact:

The PC's network connectivity state cannot be changed without signing into Windows.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled:

Computer Configuration\Policies\Administrative Templates\System\Logon\Do not display network selection UI

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template Logon.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates (or newer).

Default Value:

Disabled. (Any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.)

See Also

https://workbench.cisecurity.org/files/3714

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv6|5, CSCv7|5.1

Plugin: Windows

Control ID: 08bd807fadb4fa5f726e30ea5288d5dcd958858b32bd1a183b727716d1ba8195