M1028 Operating System Configuration: OS Settings That Shut Down Common Techniques

Many ATT&CK techniques work only because an operating system setting was left at a permissive value: NTLM still accepted, administrator names listed at the elevation prompt, setuid bits on binaries that do not need them. MITRE ATT&CK M1028 Operating System Configuration is the mitigation for these cases: specific OS settings that remove the condition a technique depends on. This guide takes the ATT&CK point of view: the 39 technique and sub-technique mappings ATT&CK v20 gives M1028, grouped into 20 concrete settings and ranked by how many techniques each one addresses, then how to roll them out safely, what they leave uncovered and how to measure coverage. It is for detection engineers, endpoint and server platform owners and security architects who already run a baseline and want to know which settings carry the most ATT&CK weight.

Key takeaways

• M1028 is a list of specific settings, not general hardening. Each ATT&CK mapping names a concrete change: restrict NTLM, stop UAC listing administrator accounts, keep sudo tty_tickets on, reduce BITS job lifetime.
• Credential and persistence settings carry the most weight. NTLM restriction, authentication package controls, scheduled task context, domain controller hardening and setuid reduction each cover three mappings.
• A good baseline already contains most of it. Vendor and CIS baselines set many of these values; the work is confirming that every one of the 20 is enforced and not excepted away.
• Audit before you block. NTLM restriction, SMBv1 removal and LSA plug-in checks all have audit modes that show what would break first.
• Configuration drift is the real failure. Measure the share of hosts that match the baseline, not whether a baseline document exists.

What M1028 is

ATT&CK v20 defines Operating System Configuration as "adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality." Its implementation guidance covers disabling unused features (SMBv1, LLMNR, NetBIOS, remote registry), enforcing OS protections (DEP, ASLR and Control Flow Guard on Windows; AppArmor or SELinux on Linux), secure access settings (UAC, restricted sudo), file system permissions, restricting RDP, SSH and VNC with Network Level Authentication for RDP, boot hardening with Secure Boot and disk encryption, and regular audits against CIS Benchmarks or SCAP content.

In D3FEND, M1028 is related to Platform Hardening (D3-PH), "hardening components of a Platform with the intention of making them more difficult to exploit." D3FEND places countermeasures such as System Configuration Permissions (D3-SCP), Driver Load Integrity Checking (D3-DLIC), Disk Encryption (D3-DENCR), TPM Boot Integrity (D3-TBI) and Software Update (D3-SU) under Platform Hardening.

How to build and run a baseline programme is covered in the CIS Benchmarks Guide, the Windows Endpoint Hardening Guide and the Linux Server Hardening Guide. This page does not repeat them; it shows which settings ATT&CK credits and why.

Settings ranked by ATT&CK technique coverage

The 39 mappings collapse into 20 settings. The count column is the number of ATT&CK v20 technique or sub-technique mappings each setting addresses, according to ATT&CK's own usage text. Coverage count is a prioritisation aid, not a measure of risk: a single-mapping setting on a domain controller can matter more than a three-mapping setting on a kiosk.

By tactic, the mappings cluster in Credential Access, Persistence and Privilege Escalation, with a tail across Discovery, Stealth, Lateral Movement, Exfiltration, Impact and Command and Control. That shape is why M1028 pays off most on identity-bearing systems: domain controllers, jump hosts and servers that run service accounts.

Implementation priorities

The order below is an NHI Mgmt Group recommendation that weighs coverage, blast radius and rollout risk.

1. Domain controllers and tier 0 first. Apply the domain controller hardening, password filter and authentication package checks, and NTLM audit there before any other tier. A change to the authentication path on a domain controller affects every identity in the domain.
2. NTLM: audit, add exceptions, then deny. Microsoft's documented sequence is to set "Network security: Restrict NTLM: Audit NTLM authentication in this domain" to the option you plan to enforce, review the NTLM Operational log under Applications and Services Logs\Microsoft\Windows\NTLM, add legitimate servers to "Add server exceptions in this domain", and only then set "Restrict NTLM: NTLM authentication in this domain" to a deny option. See the NTLM Deprecation and Elimination Guide.
3. Remove SMBv1 with auditing first. Microsoft documents Set-SmbServerConfiguration -AuditSmb1Access $true, which logs event ID 3000 in the Microsoft-Windows-SMBServer\Audit log for each SMBv1 client, before Set-SmbServerConfiguration -EnableSMB1Protocol $false. SMBv1 is not installed by default on Windows 11 and Windows Server 2019 and later, so the remaining cases are usually older systems and devices.
4. Credential exposure settings on all Windows hosts. Set CachedLogonsCount deliberately: Microsoft gives a default of 10, a range of 0 to 50, and suggests 2 for end-user and mobile computers as a balance, or 0 where offline sign-in is not needed. Set EnableMPRNotifications to disabled (the documented default behaviour sends empty password fields; the policy applies to Windows 11 22H2 and later).
5. Linux and macOS privilege paths. Inventory setuid and setgid binaries, remove the bit where it is not needed, confirm sudo timestamps are per terminal, and set shell history options. See the sudo and sudoers Security Guide.
6. Remote access and session settings. Enforce NLA and RDP session time limits by GPO; restrict RDP, SSH and VNC to management networks (pairs with M1030 Network Segmentation).
7. The single-mapping tail. BITS lifetime, file extensions, removable media, new network adapters, hidden users, WinRE, root certificate protection. These are cheap Group Policy or MDM settings; batch them into one baseline release.

Testing and rollback: deliver each group as a separate GPO, Intune profile or configuration management role, pilot it on a ring of representative hosts, and keep the previous version ready to re-link. Microsoft recommends starting from its published security baselines (Security Compliance Toolkit for Group Policy, MDM baselines for Intune) rather than building from scratch, and notes they assume standard users without administrative rights.

Where identity fits

Several M1028 settings are really identity controls in OS form. NTLM restriction and cached-logon limits decide which reusable credential material sits on a host. Scheduled task context matters because tasks are a common home for service accounts with stored passwords; forcing tasks to run as the authenticated account instead of SYSTEM limits abuse. Domain controller hardening protects the system that creates every account. When you audit NTLM, expect the long tail to be non-human: legacy service accounts, scanners and appliances that authenticate by NTLM. Each one needs an owner and a migration plan rather than a permanent exception. See the Local Administrator Password Solution (LAPS) Guide for local administrator credentials, which M1028 does not cover.

What M1028 does not stop

• Credential theft from memory by an administrator. Restricting NTLM reduces what is stored and accepted, but protecting LSASS itself is the job of M1043 Credential Access Protection and M1025 Privileged Process Integrity (LSA protection, Credential Guard).
• Abuse of features you still need. If RDP, SMB or scheduled tasks are required, configuration narrows their abuse but does not remove it; detection carries the rest.
• Valid credentials. No OS setting stops an attacker who logs in with a legitimate, correctly privileged account.
• Exploited vulnerabilities. Hardening reduces attack surface; patching is M1051 Update Software.
• Drift. A setting applied once and later excepted for a project gives no protection. ATT&CK's own guidance calls for regular audits with CIS Benchmarks or SCAP tools.

Detection and measurement

Configuration is measurable, which makes M1028 one of the easier mitigations to report on. Use CIS-CAT, OpenSCAP or your MDM's compliance view to score hosts against the baseline, and add explicit checks for each of the 20 settings above.

• Watch the settings themselves: alert on changes to HKLM\SYSTEM\CurrentControlSet\Control\Lsa values (Notification Packages, SubmitControl), new password filter or network provider DLLs, Driver Signature Enforcement being disabled, and root certificate additions.
• Use the audit logs the settings produce: NTLM Operational events, SMBServer Audit event 3000, and Code Integrity events for LSA plug-ins.
• Linux: monitor setuid bit changes and sudoers edits with auditd rules, and history file truncation.

Common failure patterns

• Blocking NTLM without auditing. Microsoft warns that skipping the audit step can cause many NTLM authentications to fail; the resulting outage usually ends with the restriction rolled back entirely.
• Baselines applied to endpoints but not servers. Many of the highest-count settings (domain controller hardening, password filters, scheduled task context) matter most on servers.
• Exceptions that never expire. A service account that needs NTLM becomes a permanent hole when nobody owns the migration.
• Cloud and container images outside the baseline. Golden images built by pipelines skip GPO and need the same settings applied in the image build.
• Treating the baseline score as coverage. A 95 percent CIS score can still miss specific ATT&CK-credited settings that the chosen profile leaves at default.

Framework mapping

Related mitigations

• M1042 Disable or Remove Feature or Program: removing features entirely rather than configuring them.
• M1054 Software Configuration: the same idea applied to applications rather than the OS.
• M1052 User Account Control: UAC level and behaviour on Windows.
• M1024 Restrict Registry Permissions: stops the settings above being changed by non-administrators.

Practitioner checklist

• Score every host tier against the 20 settings in the coverage table, starting with domain controllers.
• Run NTLM in audit mode, build the exception list from the NTLM Operational log, then enforce a deny option.
• Audit SMBv1 use with event 3000 and remove it where no client depends on it.
• Verify only expected password filters and network providers are registered on domain controllers and servers.
• Set scheduled tasks to run as the authenticated account and review tasks that store service account passwords.
• Set CachedLogonsCount deliberately per device type and disable EnableMPRNotifications.
• Reduce setuid and setgid binaries and confirm per-terminal sudo timestamps on Linux and macOS.
• Bake the same settings into cloud and container golden images, not only Group Policy and MDM.
• Alert on changes to the LSA registry key, Driver Signature Enforcement and root certificate stores.
• Give every exception an owner and an expiry date and report the count monthly.

Standards and references

• MITRE ATT&CK: M1028 Operating System Configuration
• MITRE D3FEND: Platform Hardening
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• Microsoft Learn: Windows security baselines
• Microsoft Learn: Network security: Restrict NTLM: NTLM authentication in this domain
• Microsoft Learn: How to detect, enable and disable SMBv1, SMBv2 and SMBv3
• Microsoft Learn: Interactive logon: Number of previous logons to cache
• CIS: CIS Benchmarks

Related NHI Mgmt Group resources: CIS Benchmarks Guide · Windows Server Hardening Guide · NTLM Deprecation and Elimination Guide · CIS Control 4 Secure Configuration of Enterprise Assets and Software Guide