Information
This policy setting allows local users to be enumerated on domain-joined computers.
The recommended state for this setting is: 'Disabled'.
Rationale:
A malicious user could use this feature to gather account names of other users, that information could then be used in conjunction with other types of attacks such as guessing passwords or social engineering.
The value of this countermeasure is small because a user with domain credentials could gather the same account information using other methods.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
Computer Configuration\Policies\Administrative Templates\System\Logon\Enumerate local users on domain-joined computers
Note: This Group Policy path may not exist by default.
It is provided by the Group Policy template 'Logon.admx/adml' that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative Templates (or newer).
Impact:
None - this is the default behavior.