Minimum password length: Your minimum password size should be 12 characters or more. Don't bellyache if you only have 8-character passwords (the most common size I see). Windows passwords aren't even close to secure until they are 12 characters long -- and really you want 15 characters to be truly secure. Fifteen is a magic number in the Windows authentication world. Get there, and it closes all sorts of backdoors. Anything else is accepting unnecessary risk.
Maximum password age: Most passwords should not be used longer than 90 days. But if you go to 15 characters (or longer), one year is actually acceptable. Multiple public and private studies have proven that passwords of 12 characters or longer are relatively secure against password cracking to about that length of time.
Event logs: Enable your event logs for success and failure. As I've covered in this column many times, the vast majority of computer crime victims might have noticed the crime had they had their logs on and been looking.
Disable anonymous SID enumeration: SIDs (Security Identifiers) are numbers assigned to each user, group, and other security subject in Windows or Active Directory. In early OS versions, non-authenticated users could query these numbers to identify important users (such as Administrators) and groups, a fact hackers loved to exploit.
Don't let the anonymous account reside in the everyone group: Both of these settings, when set incorrectly, allow an anonymous (or null) hacker far more access on a system than should be given. These have been disabled by default since 2000, and you should make sure they stay that way.
Enable User Account Control: Lastly, since Windows Vista, UAC has been the No. 1 protection tool for people browsing the Web. I find that many clients turn it off due to old information about application compatibility problems. Most of those problems have gone away, and many of the remaining ones can be solved with Microsoft's free application compatibility troubleshooting utility. If you disable UAC, you're far closer to Windows NT security than you are a modern operating system.
Here's the best part: Each of these settings is set correctly by default in Windows Vista/Server 2008 (and later). Most of my Windows security books were all about the settings I wanted you to more securely harden. These days, my best advice is don't muck it up. When I see problems, it's because people go out of their way to weaken them, and that's never good.
There are a handful of more important things to do before you even begin worrying about group policy, such as perfect patching and preventing your users from installing Trojan horse programs, but once you have those actions under control, correctly configuring your group policy is a great next step.
If you want to get your most bang for your buck, don't research all 3,700 settings. Just make sure you get the top 10 right.
This story, "The 10 Windows group policy settings you need to get right," was originally published at InfoWorld.com. Keep up on the latest developments in network security and read more of Roger Grimes' Security Adviser blog at InfoWorld.com. For the latest business technology news, follow InfoWorld.com on Twitter.