Skip to main content

5.5 Workstations & Endpoints

5.5 Workstations & Endpoints

  • Configuration Standards:

    • a. Disable Windows Management Instrumentation (WMI), PowerShell, and Secure Shell (SSH) on workstations. SSH may be temporarily enabled by a DTC technician for troubleshooting and disabled upon task completion.​

    • b. Enable SSH on servers for secure remote management.​

  • Security Agents:

    • c. Deploy Managed Detection and Response (MDR) or Endpoint Detection and Response (EDR) agents.​

    • d. Install VPN clients where applicable.​

    • e Deploy DNS content filtering agents on laptops.​

  • User Lockout Policy:

    • f. Trigger a 5-minute lockout period after 10 failed login attempts.​

  • Screen Lock Policy:

    • g. Activate screen lock after 12 hours of inactivity.​

  • Software Maintenance:

    • h. Deploy operating system patches according to the schedule. See Technical Controls

    • I. Install drivers according to the schedule. See Technical Controls

    • j. Deploy essential third-party applications according to the schedule. See Technical Controls

    • k. Install Line of Business (LOB) applications according to the schedule. See Technical Controls.

  • Application Allowlist Blocklist:
    • l. DTC does not enforce application allowlisting or blocklisting unless consulted with! Any applications deployed by the client is the responsibility of the client. We can work together though and take action to resolve these situations if the client has a documented allowlist and blocklist.

Technical Controls:

Control ID Description Tools/Methods
a Disable WMI, PowerShell, and SSH on workstations; enable SSH temporarily for troubleshooting. NinjaOne RMM, Microsoft Windows PowerShell, SOP
b Enable SSH on servers for secure remote management. NinjaOne RMM
c Deploy MDR/EDR agents on endpoints. NinjaOne RMM, Blackpoint SNAP Agent
d Install VPN clients where applicable. NinjaOne RMM, Cloudflare WARP, ZeroTier
e Deploy DNS content filtering agents on laptops. NinjaOne RMM, DNSFilter Roaming Agent
f Implement a 5-minute lockout after 10 failed login attempts. NinjaOne RMM, Internet Access
g Activate screen lock after 12 hours of inactivity. NinjaOne RMM, Internet Access
h Deploy operating system patches as per schedule. NinjaOne RMM, Internet Access, SOP
I Install drivers according to the deployment schedule. NinjaOne RMM, Internet Access SOP
j Deploy essential third-party applications per schedule. NinjaOne RMM, Internet Access, SOP
k Install Line of Business (LOB) applications as scheduled. NinjaOne RMM, Internet Access, SOP
l. Application Allowlist blocklist N/A
Back to top