Detections
Analytics

WN11-CC-000385 - Windows Ink Workspace must be configured to disallow access above the lock.

Information

This action secures Windows Ink, which contains applications and features oriented toward pen computing.

Note: A different registry location is needed when systems are managed by Intune versus GPO.

Solution

Disable the convenience PIN sign-in.

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace >> Set 'Allow Windows Ink Workspace' to 'Enabled and set Options On, but disallow access above lock'.

For Intune-managed systems:

Set the Windows Ink Workspace Policy to disallow access above lock.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-11(1), CAT|II, CCI|CCI-000060, Rule-ID|SV-253424r1210299_rule, STIG-ID|WN11-CC-000385, Vuln-ID|V-253424

Plugin: Windows

Control ID: 9d4983ff0b8a300d423ac4b073135af0ea07cb8c0d589c4866b357c7576bb8aa