Enable / disable CLFS logfile authentication

Supported OS tags: Windows10, Windows10RT, Windows11, WindowsServer2016

This policy setting configures CLFS logfile authentication, a security feature which aims to harden logfile parsing. Logfile authentication provides the ability for the CLFS driver to detect malicious modications made to logfiles. If modifications are detected, CLFS will deem the logfile as unsafe for parsing and return an error to the caller. CLFS is able to detect modifications by writing authentication codes to logfiles, which combines file data with a system-unique cryptographic key. A side effect of logfile authentication is that CLFS will fail to open logfiles that were created on other systems, as these logfiles contain authentication codes created using a system-unique cryptographic key. To open a logfile that was created on another system, an administrator must first use the "fsutil.exe clfs authenticate" command to correct the authentication codes. If you enable or do not configure this setting, CLFS will refer to local registry settings on whether logfile authentication should be done or not. By default, CLFS will do logfile authentication. The local registry settings for this feature can be found at "HKLM:\SYSTEM\CurrentControlSet\Services\CLFS\Authentication". If you disable his setting, CLFS will no longer perform logfile authentication. Logfiles will be able to be moved and opened across systems without Administrative action. However, CLFS will open and parse all logfiles, including maliciously crafted logfiles that may compromise the system.

This policy has no additional user input fields.

• Computer
  Dev drive filter attach policy

  At least Windows 11 Version 22H2
• Computer
  Disable delete notifications on all volumes

  At least Windows Server 2008 R2 or Windows 7
• Computer
  Enable dev drive

  At least Windows 11 Version 22H2
• Computer
  Enable Win32 long paths

  At least Windows Server 2016, Windows 10
• Computer
  Selectively allow the evaluation of a symbolic link

  At least Windows Vista