Device Health Attestation Service

Signed-off-by: Tommy <contact@tommytran.io>

Group Policies/Computer Configuration/Control Panel/Allow Online Tips.md

@@ -0,0 +1,5 @@
+# Allow Online Tips
+
+`Computer Configuration\Administrative Templates\Control Panel`
+
+- Allow Online Tips -> Disabled (Not sure about privacy implications, but no reason for it to be on)

Group Policies/Computer Configuration/Control Panel/Personalization.md

@@ -0,0 +1,5 @@
+# Personalization
+
+`Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options`
+
+- Prevent enabling lock screen camera -> Enabled (Probably not invasive, though I don't see a reason for it to be on)

Group Policies/Computer Configuration/Control Panel/Regional and Language options.md

@@ -0,0 +1,6 @@
+# Regional and Language Options
+
+`Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options`
+
+- Allow users to enable online speech recognition services -> Disabled
+- Handwriting personalization -> Turn off automatic learning -> Enabled

Group Policies/Computer Configuration/Start Menu and Taskbar.md

@@ -10,3 +10,4 @@ This is not strictly problematic, though I get quite irritated with most used ap
 - Remove frequent program list from Start Menu -> Enabled
 - Do not keep history of recently opened documents -> Enabled
 - Show or hide "Most used" list from Start menu -> Enabled -> Hide
+- Pin Apps to Start when installed -> Disabled

Group Policies/Computer Configuration/System/Credentials Delegation.md

@@ -0,0 +1,5 @@
+# Credentials Delegation
+
+`Computer Configuration\Administrative Templates\System\Credentials Delegration`
+
+- Encryption Oracle Remediation -> Enabled -> Force Updated Clients

Group Policies/Computer Configuration/System/Device Health Attestation Service.md

@@ -0,0 +1,5 @@
+# Device Health Attestation Service
+
+`Computer Configuration\Administrative Templates\System\Device Health Attestation Service`
+
+- Enable Device Health Attestation Monitoring and Reporting -> Disabled (Not inherently bad, but unless you have access to the cloud based reporting portal, why even bother keeping it on?)

Group Policies/Computer Configuration/Windows Components/Printers.md

@@ -0,0 +1,5 @@
+# Printers
+
+`Computer Configuration\Administrative Templates\Printers`
+
+- Isolate print drivers from applications -> Enabled

Group Policies/Computer Configuration/Windows Components/Windows Update.md

@@ -0,0 +1,6 @@
+# Windows Update
+
+`Computer Configuration\Administrative Templates\Windows Components\Windows Update`
+
+- Manage updates offered from Windows Update -> Enable optional updates -> Enabled -> Automatically recieve optional updates
+- Manage updates offered from Windows Update -> Select when Quality Updates are recieved -> Enabled -> Defer for 0 days