5.5 Workstations & Endpoints

---

5.5 Workstations & Endpoints

• Configuration Standards:

  • a. Disable Windows Management Instrumentation (WMI), PowerShell, and Secure Shell (SSH) on workstations. SSH may be temporarily enabled by a DTC technician for troubleshooting and disabled upon task completion.​

  • b. Disable PowerShell Remoting on servers.​

  • c. Enable SSH on servers for secure remote management.​

• Security Agents:

  • d. Deploy Managed Detection and Response (MDR) or Endpoint Detection and Response (EDR) agents.​

  • e. Install VPN clients where applicable.​

  • f. Deploy DNS content filtering agents on laptops.​

• User Lockout Policy:

  • g. Trigger a 5-minute lockout period after 10 failed login attempts.​

• Screen Lock Policy:

  • h. Activate screen lock after 12 hours of inactivity.​

• Software Maintenance:

  • i. Deploy operating system patches according to the [Patchschedule. ScheduleSee Link].Technical Controls​

  • j. Install drivers asaccording perto the [Driverschedule. ScheduleSee Link].Technical Controls​

  • k. Deploy essential third-party applications followingaccording to the [Essentialschedule. AppsSee ScheduleTechnical Link].Controls​

  • l. Install Line of Business (LOB) applications according to the [LOBschedule. AppsSee ScheduleTechnical Link].Controls.​

• Allowlist Blocklist:
  • DTC does not enforce application allowlisting or blocklisting unless consulted with! Any applications deployed by the client is the responsibility of the client. We can work together though and take action to resolve these situations if the client has a documented allowlist and blocklist.

Technical Controls: