5.38 (L2) Ensure 'Windows Push Notifications System Service (WpnService)' is set to 'Disabled'

Information

This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server.

The recommended state for this setting is: Disabled

Note: In the first two releases of Windows 10 (R1507 & R1511), the display name of this service was initially named

Windows Push Notifications Service

- but it was renamed to

Windows Push Notifications System Service

starting with Windows 10 R1607.

Windows Push Notification Services (WNS) is a mechanism to receive third-party notifications and updates from the cloud/Internet. In a high security environment, external systems, especially those hosted outside the organization, should be prevented from having an impact on the secure workstations.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Windows Push Notifications System Service

Impact:

Live Tiles and other features will not get live updates.

See Also

https://workbench.cisecurity.org/benchmarks/17129

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 4eef970ccd9ba532016a444314e908bd3d27f94fe3740ef01ac0f6d7c0303ac1