Information
By default, users can add their computer to a HomeGroup on a home network.
The recommended state for this setting is: Enabled.
Note: The HomeGroup feature is available in all workstation releases of Windows from Windows 7 through Windows 10 Release 1803. Microsoft removed the feature completely starting with Windows 10 Release 1803. However, if your environment still contains any Windows 10 Release 1803 (or older) workstations, then this setting remains important to disable HomeGroup on those systems. This recommendation will be removed from future CIS Windows 10 benchmarks that are released after April 14, 2020 (i.e. end of Microsoft support for Windows 10 Release 1803, the last version to support HomeGroup).
Rationale:
While resources on a domain-joined computer cannot be shared with a HomeGroup, information from the domain-joined computer can be leaked to other computers in the HomeGroup.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled:
Computer Configuration\Policies\Administrative Templates\Windows Components\HomeGroup\Prevent the computer from joining a homegroup
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template Sharing.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates (or newer).
Impact:
A user on this computer will not be able to add this computer to a HomeGroup. This setting does not affect other network sharing features. Mobile users who access printers and other shared devices on their home networks will not be able to leverage the ease of use provided by HomeGroup functionality.
Default Value:
Disabled. (A user can add their computer to a HomeGroup. However, data on a domain-joined computer is not shared with the HomeGroup.)