ThreatLocker Modules for DAC Resolutions | ThreatLocker Help Center

The table below identifies which ThreatLocker Defense Against Configurations (DAC) analysis checks offer remediation solutions directly within the ThreatLocker portal and which ThreatLocker modules are required to perform those remediations.

For a more detailed explanation of the available ThreatLocker modules, refer to the Knowledge Base article: Understanding and Changing the Module Options on the Organizations Page.

DAC analysis checks not included in this table either do not require a specific ThreatLocker module for remediation (e.g., ThreatLocker Agent or Advanced Settings configurations) or have a recommended remediation that involves a ThreatLocker Configuration Manager policy that has not yet been implemented in the platform.

DAC ID	Check Name	Module(s) Required
1	Application Control Learning Mode Duration Under 1 Hour	Allowlisting
2	Untrusted RDP is Blocked	Network Control
3	Policy to Block Inbound Traffic to SMB from Untrusted IPs	Network Control
4	Block Untrusted Software	Allowlisting
5	RDWeb Not Installed	Network Control
6	Office Macros Disabled	Configuration Manager
7	No Permanent Elevation Policy for Command Prompt	Elevation
8	SMB V1 Disabled	Configuration Manager
9	MSHTA Blocked or Restricted	Allowlisting Ringfencing
10	Installation Mode Duration Under 1 Hour	Allowlisting
11	Tamper Protection Disabled Duration Under 1 Hour	Allowlisting
12	Application Control Monitor Mode Duration Under 1 Hour	Allowlisting
13	No Permanent Elevation Policy for File Explorer	Elevation
14	BitLocker Enabled on C Drive	Configuration Manager (coming soon™)
15	Host File Write Protected	Storage Control
16	No Permanent Elevation Policy for PowerShell	Elevation
17	No Permanent Elevation Policy for Windows Terminal	Elevation
18	Unsigned Office Macros Blocked	Configuration Manager
25	RDWeb Not Accessible from Local IP	Network Control
26	RDWeb Not Accessible from Public IP	Network Control
27	VHDX Files Inaccessible to Random Processes	Allowlisting
29	Password Meets Minimum Age Requirement	Configuration Manager
30	Password Complexity Enforced	Configuration Manager
31	Password Meets Minimum Character Length Requirement	Configuration Manager
32	Password Meets Maximum Age Requirement	Configuration Manager
33	Account Invalid Login Attempts Lockout Threshold	Configuration Manager
34	Account Lockout Minimum Duration	Configuration Manager
35	PIV/CAC Smart Card Login Enforced	Configuration Manager
36	Credential Guard Enabled	Configuration Manager
37	Audit Account Logon Success and Failure Enabled	Configuration Manager
38	Audit Account Management Enabled	Configuration Manager
39	Audit Logon/Logoff Enabled	Configuration Manager
40	Audit Object Access Enabled	Configuration Manager
41	Audit Privilege Use Enabled	Configuration Manager
42	Audit System Events Enabled	Configuration Manager
43	Audit Policy Changes Enabled	Configuration Manager
44	Audit Directory Service Access Enabled	Configuration Manager
45	Audit Process Creation with Command Line Enabled	Configuration Manager
46	Security Event Log Size 192MB Minimum	Configuration Manager
47	Event Log Behavior When the Log File Reaches Maximum Size is Set to Disabled	Configuration Manager
48	Administrator Account Disabled or Renamed	Configuration Manager
49	Guest Account Disabled	Configuration Manager
50	Local Account Blank Password Use Limited	Configuration Manager
51	Force Audit Policy Subcategory Settings Enabled	Configuration Manager
52	Prevent or Restrict Removable Device Installation	Storage Control
53	Interactive Logon Message Title/Body For Users Required	Configuration Manager
54	Anonymous Network Enumeration Disabled When Smart Card Logged On	Configuration Manager
55	System Shut Down Without Login Disabled	Configuration Manager
57	LMHost File Write Protected	Storage Control
58	Hyper-V Manager Access Restricted	Allowlisting
59	No Over-Permitted Items by Microsoft Certificate	Allowlisting
60	Renamed Powershell Not Allowed to Run	Allowlisting Endpoint Detect
61	Remote Desktop Disabled for Inbound Connections	Network Control
62	Remote Desktop Network Level Authentication Required	Configuration Manager
63	Remote Desktop Required Encryption High	Configuration Manager
66	Hyper-V Manager Increases Detect Threat Score	Detect
67	Renamed Sticky Keys Detect Policy	Detect
68	Utilman Hash Mismatch Detect Policy	Detect
69	Web Browser Accesses More Than 50 Files Within 1 Hour Detect Alert	Detect
70	Over 200 Files Changed Within 1 Hour Detect Alert	Detect
71	Admin Tools Lockdown on Increased Risk State Detect Policy	Detect
72	Detect EDR Dependencies Enabled	Detect
73	IP Scanning Tools Limited to Specific User	Allowlisting
74	Network Control Default Deny Policy Present	Network Control
75	Microsoft Office Ringfenced from PowerShell	Ringfencing
76	Microsoft Office Ringfenced from CMD Prompt	Ringfencing
77	Microsoft Office Ringfenced from RunDLL	Ringfencing
78	Permitted Web Browsers Ringfenced from PowerShell	Ringfencing
79	Permitted Web Browsers Ringfenced from RunDLL	Ringfencing
80	Permitted Web Browsers Ringfenced from CScript	Ringfencing
81	Permitted Applications Use Appropriate Amount of Custom Rules	Allowlisting
82	USB Drives are Blocked	Storage Control
83	Unencrypted USB Drives are Blocked	Storage Control
84	No Exact Duplicate Policies Found	Allowlisting Cloud/Endpoint Detect Elevation Network Control Web Control Ringfencing Storage Control
85	No Modules Included and Not Enabled	All Modules
86	No Permitted Applications with Overly Permissive Custom Rules	Allowlisting
92	Permitted Remote Tools Assigned to Specific Users	Allowlisting
93	Microsoft Recommended Driver Block is Implemented	Allowlisting
95	Use TCP for Outbound RPC Connections	Configuration Manager
96	Use Authentication for Outgoing RPC Connections	Configuration Manager
97	Use TCP for Incoming RPC Connections	Configuration Manager
98	Use Authentication for Incoming RPC Connections	Configuration Manager
99	RPC Over TCP Port is Enabled	Configuration Manager
100	Use Packet Level Privacy for Incoming RPC Connections	Configuration Manager
101	Print Spooler Vulnerability is Blocked	Configuration Manager
102	Multicast Name Resolution is Turned Off	Configuration Manager
103	Windows Installer Disabled	Configuration Manager
104	Remote Shell is Disabled	Configuration Manager
105	RDP Temp Directories are Deleted	Configuration Manager
106	AutoRun/AutoPlay DIsabled	Configuration Manager
107	Universal Plug and Play is Disabled	Configuration Manager
108	Windows Registry Backup is Enabled	Configuration Manager
109	Monitoring for Event Log Clearing is Enabled	Configuration Manager
110	No Applications Missing Updates Over 30 Days Old	Patch Management
112	Policy Count Within Normal Limits	All Modules
113	Disabled Policy Count Within Normal Limits	All Modules
119	Operating System Past End of Servicing	Patch Management (Windows OS)
124	Account Lockout Counter Will Reset After 15 or More Minutes	Configuration Manager
162	Require CTRL+ALT+DELETE to Login	Configuration Manager
164	Machine Inactivity Limit is Greater Than 0 but Less Than or Equal to 900 Seconds	Configuration Manager
167	Smart Card Removal Behavior is Set to Lock Workstation or Higher	Configuration Manager
168	Machine Account Lockout Threshold is Set to Less Than 10 But Not 0	Configuration Manager
169	RDP Client Ringfencing to Only Trusted Hosts	Allowlisting Ringfencing
172	Hypervisors are Permitted Only for Specified Users	Allowlisting
175	Users are Blocked from Installing Printer Drivers	Configuration Manager
176	Developer Tools are Blocked from Edge and/or Chrome	Configuration Manager
177	Password Prompting Blocked from Edge and/or Chrome	Configuration Manager
178	Run Dialog and Explorer File Path Bar are Disabled	Configuration Manager
199	No Permanent Elevation Policy for macOS Built-In Shells	Elevation
200	No Permanent Elevation Policy for macOS Finder	Elevation
201	No Permanent Elevation Policy for macOS Terminal	Elevation
202	No Over-Permitted Items by Apple Certification	Allowlisting
203	Microsoft Office Ringfenced from Shell	Ringfencing
205	Untrusted Remote Desktop Not Allowed	Network Control
206	VNC Client Ringfenced	Ringfencing
211	No Ringfence Policies in Monitor Mode Over 21 Days	Ringfencing
212	No Deny Policies in Monitor Mode Over 21 Days	Allowlisting
213	No Elevation Policies without Application Ringfencing	Elevation Ringfencing
214	No Excluded Processes Present	Allowlisting
215	No Process Exclusions Present for High-Risk Applications	Allowlisting
216	Less Than 40% of Application Control Policies are Unused	Allowlisting
217	Less Than 25% of Application Control Policies Can Access Data	Allowlisting
227	No Over Permissive File Access Exceptions	Allowlisting Ringfencing
229	Remote Monitoring and Management Tools Installed Files	Allowlisting
241	Initial Learning Duration is Less than 60 Days	Allowlisting
242	Microsoft 365 Connector is Correctly Configured	Cloud Detect
243	Endpoint Detect Runbook is Configured	Endpoint Detect
244	Cloud Detect Runbook is Configured	Cloud Detect
245	No High Risk Applications Permitted	Allowlisting