The Windows Local Group Policy (LGP) has fewer options than a domain-based Group Policy, and generally an LGP is used to configure settings for systems that are not part of Active Directory.

In this lab, you explore different options of using the Windows LGP.

Part 1: Create a GPO with Group Policy Editor

  1. Create a snapshot of your Windows VM. Open the Windows VM.
  2. Click Start and enter “Run”. Click on the Run application.
  3. In Run, run the mmc application. Click OK.
  4. If you are prompted by UAC, enter the password or click Yes.
  5. Click File and Add/Remove Snap-in.
  6. In the Add or Remove Snap-ins box, click Group Policy Object Editor and click Add.
  7. In the Select Group Policy Object dialog box, click Browse.
  8. Click This computer and then OK.
  9. Click Finish.
  10. Click OK to display the Console Root screen.
Windows Group Policy Editor
  1. Administrative Templates are registry-based policy settings that appear in the Local Group Policy Editor. In the left pane under Console Root, click Local Computer Policy.
  2. Double-click Computer Configuration.
  3. Double-click Administrative Templates.
  4. In the left pane, click All Settings. In the middle pane, scroll down through the different LPGs that can be set on the local computer.
  5. Now change the LGP so that only strong TLS cryptography will be used. In the left pane, double-click Network.
  6. Click SSL Configuration Settings.
  7. In the center pane, double-click SSL Cipher Suite Order. This identifies which SSL suites will be supported.
  8. Click Enabled.
  9. Note the suites listed in the left pane under SSL Cipher Suites. In a browser, visit the Cipher Suites in TLS/SSL site listed under Help.
  10. Click TLS Cipher Suites in Windows 10 v1507 for more information on an older Windows version. Locate SSL_CK_RC4_128_WITH_MD5 in the list of available SSL cipher suites.
  11. Return back to the previous webpage. Click to get more information on the latest Windows version. Note the available cipher suites. This should match those listed in step 19.
  12. Close the browser.
  13. In the SSL Cipher Suite Order window, click Apply.
  14. Click OK.
  15. In the left pane expand Windows Components. Click Windows Update.
  16. Double-click on Allow Automatic Updates immediate installation.
  17. Click Enabled.
  18. Click Apply and OK.

Part 2: Modify a GPO with PowerShell

The Group Policy Editor reads and sets registry values. Setting the registry settings has the same effect as setting the group policy.

  1. Run the regedit application.
  2. In Registry Editor, browse to “Computer\HKLM\SOFTWARE\Policies\Microsoft\Cryptography\SSL\00010002”. HKLM is a shortcut for HKEY_LOCAL_MACHINE. Note the Data under Functions.
  3. Browse to “Computer\HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU”. Note the Data under AutoInstallMinorUpdates.
  4. Double-click AutoInstallMinorUpdates.
  5. Change the Value data to “0”. Click OK. The local GPO setting could be edited manually here or for automation in PowerShell.
  6. Click Start and enter “Windows PowerShell”. Click on Run as administrator.
  7. In PowerShell, use the Get-ItemProperty command for the Registry entry from step 30. 
    Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\SSL\00010002

    Notice the displayed information.

  8. Repeat step 35 for the Registry entry from step 31. 
    Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

    Notice the displayed information.

  9. Use the Set-ItemProperty command to change registry data. 
    Set-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU -Name AutoInstallMinorUpdates -Value 1

  10. In Registry Editor, click View from the menu bar, then Refresh. Notice the change in the registry data for AutoInstallMinorUpdates.

    Some more steps may have to be taken to have this persist.

  11. Close all windows.
  12. Turn off the VM. Revert to the snapshot.
  13. Write up a paragraph answering the following questions.
    1. In step 14, which settings can you identify that directly relate to security?
    2. In step 21, was SSL_CK_RC4_128_WITH_MD5 listed as an available SSL cipher suite? Why?
    3. What are the benefits of each way of modifying local GPOs?

More Info