Skip to main content

5.5 Workstations & Endpoints

5.5 Workstations & Endpoints

  • Configuration Standards:

    • a. Disable Windows Management Instrumentation (WMI), PowerShell, and Secure Shell (SSH) on workstations. SSH may be temporarily enabled by a DTC technician for troubleshooting and disabled upon task completion.​

    • b. Disable PowerShell Remoting on servers.​

    • c. Enable SSH on servers for secure remote management.​

  • Security Agents:

    • d.c. Deploy Managed Detection and Response (MDR) or Endpoint Detection and Response (EDR) agents.​

    • e.d. Install VPN clients where applicable.​

    • f.e Deploy DNS content filtering agents on laptops.​

  • User Lockout Policy:

    • g.f. Trigger a 5-minute lockout period after 10 failed login attempts.​

  • Screen Lock Policy:

    • h.g. Activate screen lock after 12 hours of inactivity.​

  • Software Maintenance:

    • i.h. Deploy operating system patches according to the schedule. See Technical Controls

    • j.I. Install drivers according to the schedule. See Technical Controls

    • k.j. Deploy essential third-party applications according to the schedule. See Technical Controls

    • l.k. Install Line of Business (LOB) applications according to the schedule. See Technical Controls.

  • Application Allowlist Blocklist:
    • l. DTC does not enforce application allowlisting or blocklisting unless consulted with! Any applications deployed by the client is the responsibility of the client. We can work together though and take action to resolve these situations if the client has a documented allowlist and blocklist.

Technical Controls:

Control ID Description Tools/Methods
a Disable WMI, PowerShell, and SSH on workstations; enable SSH temporarily for troubleshooting. NinjaOne RMM, Microsoft Windows PowerShell, Internet Access, SOP
bDisable PowerShell Remoting on servers.NinjaOne RMM, Internet Access
c Enable SSH on servers for secure remote management. NinjaOne RMM, Internet AccessRMM
dc Deploy MDR/EDR agents on endpoints. NinjaOne RMM, Blackpoint SNAP Agent, Internet AccessAgent
ed Install VPN clients where applicable. NinjaOne RMM, Cloudflare WARP, ZeroTier, Internet AccessZeroTier
fe Deploy DNS content filtering agents on laptops. NinjaOne RMM, DNSFilter Roaming Agent, Internet AccessAgent
gf Implement a 5-minute lockout after 10 failed login attempts. NinjaOne RMM, Internet Access
hg Activate screen lock after 12 hours of inactivity. NinjaOne RMM, Internet Access
ih Deploy operating system patches as per schedule. NinjaOne RMM, Internet Access, SOP
jI Install drivers according to the deployment schedule. NinjaOne RMM, Internet Access SOP
kj Deploy essential third-party applications per schedule. NinjaOne RMM, Internet Access, SOP
lk Install Line of Business (LOB) applications as scheduled. NinjaOne RMM, Internet Access, SOP
j.l. Application Allowlist blocklist N/A
Back to top