{ "schemaVersion": 1, "summary": { "totalResults": 2398, "findingResults": 885, "environmentResults": 1513, "actionableFindings": 455, "notRunChecks": 169, "findingOutcomes": { "pass": 256, "fail": 450, "not_run": 169, "warning": 3, "execution_error": 2, "not_applicable": 4, "informational": 1 }, "findingSeverities": { "critical": 17, "high": 190, "medium": 200, "low": 42, "info": 23, "unknown": 413 }, "findingTools": { "purple-knight": 119, "maester": 318, "pingcastle": 37, "cis-cat": 411 }, "environmentStates": { "observed": 1416, "empty": 84, "license-restricted": 10, "explicitly-absent": 3 } }, "findings": [ { "id": "SI000055", "title": "Permission changes on AdminSDHolder object", "description": "This indicator checks for modifications on the access control list (ACL) of the AdminSDHolder object.", "recommendation": "

Organizations should investigate the permissions on the AdminSDHolder object if modified, and use attack path analysis software, such as Forest Druid, to analyze attack paths to privileged users in Active Directory.

Organizations, if changing the permissions on AdminSDHolder, should have an established process in place for awareness.

\n

Unplanned changes to AdminSDHolder should be considered highly suspicious and must be investigated further. Unplanned changes to AdminSDHolder are a very strong indicator of compromise of Active Directory.

", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000096", "title": "Privileged Users with Weak Password Policy", "description": "This indicator looks for privileged users in each domain that don't have a strong password policy enforced, according to ANSSI framework. It checks both FGPP (Fine-Grained Password Policy) and the password policy applied to the domain. A strong password as defined by ANSSI is at least 8 characters long and updated no later than every 3 years.", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000157", "title": "Certificate templates that allow requesters to specify a subjectAltName", "description": "This indicator checks if certificate templates are enabling requesters to specify a subjectAltName in the CSR.", "recommendation": "

Ensure that when a SAN is allowed on a certificate template it is absolutely required on the template, so that the certificate must specify a subjectAltName. If not absolutely required, it should be disabled. This configuration can be viewed under the "Supply in request" option in the "Subject Name" tab in certtmpl.msc. When an authentication EKU is also present on the certificate template this becomes very dangerous and action should be taken to disable SAN on it.

", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000077", "title": "Print spooler service is enabled on a DC", "description": "This indicator checks for Domain Controllers running the print spooler service.This indicator requires the local server to be running the print spooler service to function, or it will return Failed to run", "recommendation": "Print spooler services are enabled by default. If not absolutely required, disable the service on all domain controllers. If required, make sure the server is fully patched and follow Microsoft guidance here.", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000095", "title": "AD Certificate Authority with Web Enrollment - ESC8", "description": "This indicator attempts to identify AD CS servers in the domain that accept NTLM authentication to Web Enrollment Services. The script enumerates CAs in the Enrollment Services container, resolves their IP and attempts NTLM authentication to https://IP/certsrv and http://IP/certsrv. Note: This indicator currently does not identify EPA or other mitigations suggested by Microsoft.The indicator will return a Passed if an enrollment service is contacted, but NTLM authentication is denied (positive effect on the posture score) for any endpoint.The indicator will return an IoE Found if NTLM authentication is available on an enrollment service (negative effect on security posture) on any endpoint.The indicator will Fail to Run (no effect on security posture score) if one of the following is true for all endpoints:Cannot Resolve - Enrollment Service Certificate found in AD CS container, but address cannot be resolvedUnreachable - IP is resolved, but service cannot be reached", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000036", "title": "Zerologon vulnerability", "description": "This indicator checks for security vulnerability CVE-202-1472.", "severity": "critical", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "CIS.M365.1.1.1", "title": "Ensure Administrative accounts are cloud-only", "description": "1.1.1 (L1) Ensure Administrative accounts are cloud-only Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Regular user accounts should never be utilized for administrative tasks and care should be taken, in the case of a hybrid environment, to keep Administrative accounts separated from on-prem accounts. Administrative accounts should not have applications assigned so that they have no access to potentially vulnerable services (EX. email, Teams, SharePoint, etc.) and only access to perform tasks as needed for administrative purposes. #### Remediation action: To created licensed, separate Administrative accounts for Administrative users: 1. Navigate to Microsoft 365 admin center [https://admin.microsoft.com](https://admin.microsoft.com). 2. Click to expand **Users** select **Active users** 3. Click **Add a user**. 4. Fill out the appropriate fields for Name, user, etc. 5. When prompted to assign licenses select as needed **Microsoft Entra ID P1** or **Microsoft Entra ID P2**, then click **Next**. 6. Under the **Option settings** screen you may choose from several types of Administrative access roles. Choose **Admin center access** followed by the appropriate role then click **Next**. 7. Select **Finish adding**. #### Related links * [Microsoft 365 Admin Center](https://admin.microsoft.com) * [CIS Microsoft 365 Foundations Benchmark v 4.0.0 - Page 20](https://www.cisecurity.org/benchmark/microsoft_365)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CIS.M365.1.1.3", "title": "Ensure that between two and four global admins are designated", "description": "1.1.3 (L1) Ensure that between two and four global admins are designated More than one global administrator should be designated so a single admin can be monitored and to provide redundancy should a single admin leave an organization. Additionally, there should be no more than four global admins set for any tenant. Ideally global administrators will have no licenses assigned to them. #### Remediation action: To correct the number of global tenant administrators: 1. Navigate to Microsoft 365 admin center [https://admin.microsoft.com](https://admin.microsoft.com). 2. Select **Users** > **Active Users**. 3. In the Search field enter the name of the user to be made a Global Administrator. 4. To create a new Global Admin: 1. Select the user's name. 2. A window will appear to the right. 3. Select **Manage roles**. 4. Select **Admin center access**. 5. Check **Global Administrator**. 6. Click Save changes. To remove Global Admins: 1. Select **User**. 2. Under Roles select **Manage roles**. 3. De-Select the appropriate role. 4. Click **Save changes**. #### Related links * [Microsoft 365 Admin Center](https://admin.microsoft.com) * [CIS Microsoft 365 Foundations Benchmark v5.0.0 - Page 28](https://www.cisecurity.org/benchmark/microsoft_365)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.2.3", "title": "Sign-ins detected as high risk SHALL be blocked.", "description": "Sign-ins detected as high risk SHALL be blocked. Rationale: Blocking high-risk sign ins may prevent compromised sign-ins from accessing the tenant. This prevents compromised sign-ins from accessing the tenant. #### Remediation action: Create a Conditional Access policy blocking sign-ins determined high risk by the Identity Protection service. Configure the following policy settings in the new Conditional Access policy as per the values below: * Users > Include > **All users** * Target resources > Cloud apps > **All cloud apps** * Conditions > Sign-in risk > **High** * Access controls > Grant > **Block Access** Note: While CISA recommends blocking, the [Microsoft recommendation](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies#microsofts-recommendation) is to require multi-factor authentication for high-risk sign-ins. #### Related links * [CISA Risk Based Policies - MS.AAD.2.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad23v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L138)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.applicationCredentialExpiry", "title": "Renew expiring application credentials.", "description": "Renewing an application’s credentials prior to their expiry date is crucial for maintaining uninterrupted operations and minimizing the risk of any downtime resulting from outdated credentials. #### Remediation action: 1. From the impacted resources table, click on “More details” to see and note the ID of the credential. 2. Click the “Update credential” link to navigate to the Application registration blade. 3. Navigate to the Certificates & Secrets section of the app registration. 4. Pick the credential type that you want to rotate and navigate to either Certificates or Client Secret tab and follow the prompts to add a new credential of that type. 5. Once the certificate or secret is successfully added, update the service code to ensure it works with the new credential. 6. Use the Microsoft Entra sign-in logs to validate that the Key ID of the credential matches the one that was recently added. 7. After validating the new credential, navigate back to App registrations > Certificates and Secrets for the app and remove the old credential. **Impact:** #### Related links: * [Renew expiring application credentials - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.mfaRegistrationV2", "title": "Ensure all users can complete multifactor authentication.", "description": "Multifactor authentication (MFA) helps protect devices and data that are accessible to these users. Adding more authentication methods, such as the Microsoft Authenticator app or a phone number, increases the level of protection if one factor is compromised. #### Remediation action: 1. We provide step-by-step guidance to select and enable the right MFA method for your organization in the Microsoft 365 admin center. [Go to the Microsoft 365 MFA wizard](https://admin.microsoft.com/adminportal/home?Q=SecureScore\" # \"/featureexplorer/security/ConditionalAccess). 2. If you would like to perform the implementation yourself, first check what Microsoft Entra ID license you have under “Prerequisites” in Microsoft Secure Score or [see your license type under \"Basic information\" in the Microsoft Entra ID Overview.](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview). 3. If you’ve invested in Microsoft Entra ID Premium P1 or P2 licenses, you can create a Conditional Access policy from scratch or by using a template. [Follow these steps to create a Conditional Access policy from scratch or by using a template](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-registration). 4. If you would like to perform the implementation yourself and you’re using Microsoft Entra ID Free, turn on security defaults. Note: Security defaults and Conditional Access can’t be used side by side. [Enable security defaults](https://docs.microsoft.com/azure/active-directory/fundamentals/concept-fundamentals-security-defaults). 5. Keep track of your user’s progress of registering authentication methods by going to Microsoft Entra ID > Security > Authentication methods > User registration details (requires Microsoft Entra ID Premium P1 or P2 licenses). [Go to User registration details](https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/UserRegistrationDetails). 6. Use registration campaign to nudge users to set up specific authentication methods by going to Microsoft Entra ID > Protection > Authentication methods > Registration campaign. [Go to registration campaign](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/RegistrationCampaign/fromNav/Identity). **Impact:** After registering, users are prompted to authenticate with a second factor when accessing applications or other resources. #### Related links: * [Ensure all users can complete multifactor authentication - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.1", "title": "Phishing-resistant MFA SHALL be enforced for all users.", "description": "Phishing-resistant MFA SHALL be enforced for all users. Rationale: Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized. #### Remediation action: Create a conditional access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new conditional access policy, per the values below: * Users > Include > **All users** * Target resources > Cloud apps > **All cloud apps** * Access controls > Grant > Grant Access > Require authentication strength > **Phishing-resistant MFA** #### Related links * [CISA Strong Authentication & Secure Registration - MS.AAD.3.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad31v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L181)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.signinRiskPolicy", "title": "Protect all users with a sign-in risk policy.", "description": "Turning on the sign-in risk policy ensures that suspicious sign-ins are challenged for multifactor authentication (MFA). #### Remediation action: 1. To implement this recommendation, you need Microsoft Entra ID Premium P2 licenses. Check what Microsoft Entra ID license you have under “Prerequisites” in Microsoft Secure Score or [see your license type under \"Basic information\" in the Microsoft Entra ID Overview.](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview). 2. If you’ve invested in Microsoft Entra ID Premium P2 licenses, you can create a Conditional Access policy from scratch or by using a template. [Follow these steps to create a Conditional Access policy from scratch or by using a template](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-risk-user). 3. If you’re not using Microsoft Entra ID Premium P2 licenses, we recommend you set this action to “Dismissed” or “Risk accepted”. **Impact:** When the policy triggers, the user will need MFA to access the account. If a user hasn't registered for MFA, they’re blocked from accessing their account. If account access is blocked, an admin would need to recover the account. #### Related links: * [Protect all users with a sign-in risk policy - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.userRiskPolicy", "title": "Protect all users with a user risk policy .", "description": "With the user risk policy turned on, Microsoft Entra ID detects the probability that a user account has been compromised. As an administrator, you can configure a user risk Conditional Access policy to automatically respond to a specific user risk level. For example, you can block access to your resources or require a password change to get a user account back into a clean state. #### Remediation action: 1. To implement this recommendation, you need Microsoft Entra ID Premium P2 licenses. Check what Microsoft Entra ID license you have under “Prerequisites” in Microsoft Secure Score or [see your license type under \"Basic information\" in the Microsoft Entra ID Overview.](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview). 2. If you’ve invested in Microsoft Entra ID Premium P2 licenses, you can create a Conditional Access policy from scratch or by using a template. Note: Classic Conditional Access policies aren’t scored. Use the recommended steps to receive credit. [Follow these steps to create a Conditional Access policy from scratch or by using a template](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-risk-user). 3. If you’re not using Microsoft Entra ID Premium P2 licenses, we recommend you set the status for this action to “Dismissed” or “Risk accepted”. **Impact:** When the policy triggers, access to the account will either be blocked or the user will be required to use multifactor authentication and change their password. Users who haven't registered multifactor authentication (MFA) on their account will be blocked from accessing it. If account access is blocked, an admin would need to recover the account. Thus, it is important to configure the MFA registration policy for all users who are a part of the user risk policy to ensure that they have registered for MFA. #### Related links: * [Protect all users with a user risk policy - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1025", "title": "No external user with permanent role assignment on Control Plane.", "description": "Take attention on B2B collaboration user with Entra ID directory role assignments on ControlPlane. Verify the affected external users, the user source (e.g., MSSP/partner or managing tenant) and if the privileged accounts pass your requirements for Conditional Access, Lifecycle Workflow and Identity Protection. Learn more about the best practices for privileges users: - [Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning#ensure-separate-user-accounts-and-mail-forwarding-for-global-administrator-accounts)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1027", "title": "No Service Principal with Client Secret and permanent role assignment on Control Plane.", "description": "Review your Service Principals with Client Secrets and ControlPlane privileges. It's recommended to use certificates for Service Principals. Review if you can replace client secrets by certificates or use managed identities instead of a Service Principal. Learn more about the best practices for issuing certificates for Service Principals: - [Securing service principals in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/architecture/service-accounts-principal#service-principal-authentication) - [Best practices for all isolation architectures - Service Principal Credentials](https://learn.microsoft.com/en-us/entra/architecture/secure-best-practices#service-principals-credentials)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1028", "title": "No user with mailbox and permanent role assignment on Control Plane.", "description": "Take attention on mail-enabled administrative accounts with ControlPlane privileges. It's recommended to use mail forwarding to regular work account which allows to avoid direct mail access and phishing attacks on privileged user. Learn more about the best practices for securing privileged user accounts: - [Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning#ensure-separate-user-accounts-and-mail-forwarding-for-global-administrator-accounts)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1030", "title": "Eligible role assignments on Control Plane are in use by administrators.", "description": "**Security Impact** Users that have been assigned privileged roles they don't need increases the chance of an attack. It is also easier for attackers to remain unnoticed in accounts that are not actively being used. **Mitigation steps** Review the users in the list and remove them from privileged roles they do not need. **How to prevent** ·Assign privileged roles to users that have a business justification. ·Schedule regular access reviews to verify that users still need their access.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1032", "title": "Limited number of Global Admins are assigned.", "description": "**Security Impact** Global administrator is the highest privileged role. If a Global Administrator is compromised, the attacker gains access to all of their permissions, which puts your whole system at risk. **Mitigation steps** ·Review the users in the list and remove any that do not absolutely need the Global Administrator role. ·Assign lower privileged roles to these users instead. **How to prevent** Assign users the least privileged role they need.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1056", "title": "Ensure that no person has permanent access to all Azure subscriptions at the root scope", "description": "Ensure that no person has permanent access to Azure Subscriptions. User Access Administrator is a role that allows an Administrator to perform everything on an Azure Subscription. Global Administrators can gain this permission on the Root Scope in Entra ID, in the properties of the Entra ID tenant. These permissions should only be used in case of emergency and should not be assigned permanently. Ensure that no User Access Administrator permissions at the Root Scope are applied. #### Remediation action: To remove all Admins with Root Scope permissions, as a Global Admin: 1. Navigate to Microsoft Azure Portal [https://portal.azure.com](https://portal.azure.com). 2. Search for **Microsoft Entra ID** and select **Microsoft Entra ID**. 3. Expand the **Manage** menu and select **Properties**. 3. On the **Properties** page, go to the **Access management for Azure resources** section. 4. In the information bar, click **Manage elevated access users**. 5. Select all User Access Administrators and click **Remove**. 6. Also check other role assignments, as they need to be removed to pass the tests. To remove the admins through CLI: ```powershell az role assignment delete --role \"User Access Administrator\" --assignee [redacted-email] --scope \"/\" ``` #### Related links * [Manage who can create Microsoft 365 Groups](https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1064", "title": "Ensure that write permissions are required to create new management groups", "description": "By default, all Entra ID security principals can create new management groups. This introduces governance and security risks, as it allows any user to create a new management group and link subscriptions to it without oversight. To prevent this, Azure provides a setting that enforces write permission requirements for the creation of new management groups. This ensures that only authorized users can manage the structure of your management group hierarchy. #### Remediation action: To enable the requirement for write permissions: 1. Navigate to the Microsoft Azure Portal: [https://portal.azure.com](https://portal.azure.com). 2. In the search bar, type **Management groups** and open the blade. 3. Select **Settings** in the left navigation menu. 4. Under **Permissions for creating new management groups**, enable the switch: **Require write permissions for creating new management groups**. #### Related links * [Organize your resources with management groups](https://learn.microsoft.com/en-us/azure/governance/management-groups/overview)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.5", "title": "The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.", "description": "The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled. Rationale: SMS, voice call, and email OTP are the weakest authenticators. This policy forces users to use stronger MFA methods. #### Remediation action: If phishing-resistant MFA has not been deployed yet and Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in. 1. In **Entra ID**, click **Security** > **[Authentication methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/Identity)** 2. Click on the **SMS**, **Voice Call**, and **Email OTP** authentication methods and disable each of them. Their statuses should be **Enabled** > **No** on the **Authentication methods** > **Policies** page. #### Related links * [Entra admin portal - Authentication methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/Identity) * [CISA Strong Authentication & Secure Registration - MS.AAD.3.5v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad35v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L307)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.6", "title": "Phishing-resistant MFA SHALL be required for highly privileged roles.", "description": "Phishing-resistant MFA SHALL be required for highly privileged roles. Rationale: This is a backup security policy to help protect privileged access to the tenant if the conditional access policy, which requires MFA for all users, is disabled or misconfigured. #### Remediation action: Create a conditional access policy enforcing phishing-resistant MFA for highly privileged roles. Configure the following policy settings in the new conditional access policy, per the values below: 1. In **Entra** under **Protection** and **Conditional Access**, select **[Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/)**. 2. Click on **New policy** 3. Under **New Conditional Access policy**, configure the following policy settings in the new conditional access policy, per the values below: * Users > Include > Select users and groups > Directory roles > select each of the roles listed in the **[Highly Privileged Roles](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#highly-privileged-roles)** listed. * Target resources > Cloud apps > **All cloud apps** * Access controls > Grant > Grant Access > Require authentication strength > **Phishing-resistant MFA** 4. Click **Save**. #### Related links * [Entra admin center - Conditional Access | Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/) * [CISA Strong Authentication & Secure Registration - MS.AAD.3.6v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad36v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L354) * [CISA ScubaGear Highly Privileged Roles](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#highly-privileged-roles)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.7", "title": "Managed devices SHOULD be required for authentication.", "description": "Managed devices SHOULD be required for authentication. Rationale: The security risk of an adversary authenticating to the tenant from their own device is reduced by requiring a managed device to authenticate. Managed devices are under the provisioning and control of the agency. [OMB-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf) states, \"When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user.\" #### Remediation action: Create a conditional access policy requiring a user's device to be either Microsoft Entra hybrid joined or compliant during authentication. Configure the following policy settings in the new conditional access policy, per the values below: 1. In **Entra** under **Protection** and **Conditional Access**, select **[Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/)**. 2. Click on **New policy** 3. Under **New Conditional Access policy**, configure the following policy settings in the new conditional access policy, per the values below: * Users > Include > **All users** * Target resources > Cloud apps > **All cloud apps** * Access controls > Grant > Grant Access > **Require device to be marked as compliant** and **Require Microsoft Entra hybrid joined device** > For multiple controls > **Require one of the selected controls** 4. Click **Save**. #### Related links * [Entra admin center - Conditional Access | Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/) * [CISA Strong Authentication & Secure Registration - MS.AAD.3.7v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad37v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L397)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.8", "title": "Managed Devices SHOULD be required to register MFA.", "description": "Managed Devices SHOULD be required to register MFA. Rationale: Reduce risk of an adversary using stolen user credentials and then registering their own MFA device to access the tenant by requiring a managed device provisioned and controlled by the agency to perform registration actions. This prevents the adversary from using their own unmanaged device to perform the registration. #### Remediation action: Create a conditional access policy requiring a user to be on a managed device when registering for MFA. 1. In **Entra** under **Protection** and **Conditional Access**, select **[Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/)**. 2. Click on **New policy** 3. Under **New Conditional Access policy**, configure the following policy settings in the new conditional access policy, per the values below: * Users > Include > **All users** * Target resources > User actions > **Register security information** * Access controls > Grant > Grant Access > **Require device to be marked as compliant** and **Require Microsoft Entra hybrid joined device** > For multiple controls > **Require one of the selected controls** 4. Click **Save**. #### Related links * [Entra admin center - Conditional Access | Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/) * [CISA Strong Authentication & Secure Registration - MS.AAD.3.8v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad38v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L431)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.4.1", "title": "Security logs SHALL be sent to the agency's security operations center for monitoring.", "description": "Security logs SHALL be sent to the agency's security operations center for monitoring. Rationale: The security risk of not having visibility into cyber attacks is reduced by collecting logs in the agency’s centralized security detection infrastructure. This makes security events available for auditing, query, and incident response. Note: The following logs (configured in Entra diagnostic settings), are required: `AuditLogs`, `SignInLogs`, `RiskyUsers`, `UserRiskEvents`, `NonInteractiveUserSignInLogs`, `ServicePrincipalSignInLogs`, `ADFSSignInLogs`, `RiskyServicePrincipals`, `ServicePrincipalRiskEvents`, `EnrichedOffice365AuditLogs`, `MicrosoftGraphActivityLogs`. If managed identities are used for Azure resources, also send the `ManagedIdentitySignInLogs` log type. If the Entra ID Provisioning Service is used to provision users to software-as-a-service (SaaS) apps or other systems, also send the `ProvisioningLogs` log type. Note: Agencies can benefit from security detection capabilities offered by the CISA Cloud Log Aggregation Warehouse (CLAW) system. Agencies are urged to send the logs to CLAW. Contact CISA at [redacted-email] to request integration instructions. #### Remediation action: Follow the configuration instructions unique to the products and integration patterns at your organization to send the security logs to the security operations center for monitoring. #### Related links * [CISA 4. Centralized Log Collection - MS.AAD.4.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad41v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L523)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.INV.001", "title": "Unusual sign-in activity detected for privileged accounts", "description": "This test checks for unusual sign-in patterns for accounts with privileged roles. Anomalies may indicate a potential compromise. #### Investigation steps: 1. Review the sign-in logs for the flagged accounts 2. Check if the sign-ins are from expected locations 3. Verify if the sign-in times match the user's normal working hours 4. Contact the user to confirm the activity #### Related links * [Microsoft Entra sign-in logs](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/SignIns) * [Investigate risk in Identity Protection](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-investigate-risk)", "severity": "high", "outcome": "warning", "resultType": "exposure_finding", "isIoe": false, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.5.2", "title": "Only administrators SHALL be allowed to consent to applications.", "description": "Only administrators SHALL be allowed to consent to applications. Rationale: Limiting applications consent to only specific privileged users reduces risk of users giving insecure applications access to their data via [consent grant attacks](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide). #### Remediation action: 1. In **Entra** under **Identity** and **Applications**, select **Enterprise applications**. 2. Under **Security**, select **Consent and permissions**. 3. Under **Manage**, select **[User consent settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/UserSettings)**. 4. Under **User consent for applications**, select **Do not allow user consent**. 5. Click **Save**. #### Related links * [Entra admin center - Consent and permissions | User consent settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/UserSettings) * [CISA Application Registration & Consent - MS.AAD.5.2v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad52v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L575)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.5.3", "title": "An admin consent workflow SHALL be configured for applications.", "description": "An admin consent workflow SHALL be configured for applications. Rationale: Configuring an admin consent workflow reduces the risk of the previous policy by setting up a process for users to securely request access to applications necessary for business purposes. Administrators have the opportunity to review the permissions requested by new applications and approve or deny access based on a risk assessment. #### Remediation action: 1. In **Entra** create a new **Group** that contains admin users responsible for reviewing and adjudicating application consent requests. Group members will be notified when users request consent for new applications. 2. Then in **Entra** under **Identity** and **Applications**, select **Enterprise applications**. 3. Under **Security**, select **Consent and permissions**. 3. Under **Manage**, select **[Admin consent settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/AdminConsentSettings)**. 5. Under **Admin consent requests** and **Users can request admin consent to apps they are unable to consent to** select **Yes**. 6. Under **Who can review admin consent requests**, select **+ Add groups** and select the **group** responsible for reviewing and adjudicating app requests **(created in step one above)**. 7. Click **Save**. #### Related links * [Entra admin center - Consent and permissions | Admin consent settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/AdminConsentSettings) * [CISA Application Registration & Consent - MS.AAD.5.3v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad53v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L613)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.7.1", "title": "A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.", "description": "A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. **Rationale:** The Global Administrator role provides unfettered access to the tenant (Azure and Microsoft 365). Limiting the number of users with this level of access makes tenant compromise more challenging. Microsoft recommends fewer than five users in the Global Administrator role. However, additional user accounts, up to eight, may be necessary to support emergency access and some operational scenarios. #### Remediation action: When counting the number of users assigned to the Global Administrator role, **count each user only once**. 1. In **Entra** under **Roles & adminis** and **[All roles](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles)**, search for **Global Administrator** and click on it to go to the role and see who is assiged. Count users that are assigned directly to the role and users assigned via group membership. If you have **Entra ID PIM**, count both the **Eligible assignments** and **Active assignments**. If any of the groups assigned to Global Administrator are enrolled in **PIM for Groups**, also count the number of group members from the PIM for Groups portal **Eligible** assignments. 2. Validate that there are a total of two to eight users assigned to the Global Administrator role. #### Related links * [Entra admin center - Roles and administrators | All roles](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles) * [CISA 7.1 Highly Privileged User Access - MS.AAD.7.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad71v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L761)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1084", "title": "Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.", "description": "## Description Executes KQL function over IdentityLogonEvents data to retrieve information about domains with Seamless SSO usage. It enriches the data with device insights. ## Why This Matters Seamless Single Sign-On in Entra ID Connect should be disabled because: - **Lateral movement**: Allows for lateral movement between an on-premise domain and Entra ID when an Entra ID Connect server is compromised. - **Brute force**: Can be used for brute force attacks against Entra ID. Seamless Single Sign-On is used for passwordless access for domain-joined devices, end-user devices, or device versions that do not support Primary Refresh Tokens (Windows versions prior to Windows 10 for example). This scenario is becoming less common, meaning most organizations should be able to disable SSSO in Entra ID Connect. The output of the query should help you in identifying of SSSO usage is expected for the specific source device, based on device enrichment with MDE data. #### Remediation action There are two steps to disabling Seamless SSO, the first is to disable the configuration in Microsoft Entra Connect and the second is to tidy up Active Directory. To disable the feature from Microsoft Entra connect, follow these steps: 1. Log-in to the computer running Microsoft Entra Connect Sync. 2. Click **Configure**. 3. Select **Change User Sign In** and click Next. 4. On the User **Sign-In section**, uncheck the **Enable single sign-on** box, click **Next**, then **Configure**. Then to tidy up Active Directory you need to install and run the AzureADSSO PowerShell module, follow the steps below: 1. On an Active Directory management server, open PowerShell and run the following commands to install the AzureADSSO PowerShell module: ```powershell #Install the AzureAD Module install-module AzureAD #Import the AzureAD SSO module Import-Module \"C:\\program files\\Microsoft Azure Active Directory Connect\\AzureADSSO.psd1\" ``` 2. Then use the following commands to list all forests in your environment which have had Seamless SSO enabled: (if you have a single forest, you can move on to the next step). ```powershell #Create an authentication context object for Azure AD New-AzureADSSOAuthenticationContext #Get the SSO status and domains from Entra ID Get-AzureADSSOStatus ``` The output should contain `\"enable\":false` 3. Now you can tidy up your Active Directory by running the below commands to safely delete the AZUREADSSOACC if it is still present. ```powershell #Store domain admin credentials $creds = Get-Credential #Disable SSO in the forest Disable-AzureADSSOForest -OnPremCredentials $creds ``` To verify that Seamless SSO has been successfully disabled in your environment, start by signing in to the **Entra Admin portal** and expanding **Identity > Hybrid management** and select **Microsoft Entra Connect**. Then click **Connect Sync** and verify that Seamless single sign-on is set to Disabled. [You can also use this link to go to the Entra portal directly](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) #### Related links - [HybridBrothers hunting query](https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/blob/main/Entra%20ID/HuntDomainsWithSeamlessSsoEnabled.md) - [Finding Seamless SSO usage](https://nathanmcnulty.com/blog/2025/08/finding-seamless-sso-usage/#) - [Why you should disable Seamless SSO in Microsoft Entra Connect](https://ourcloudnetwork.com/why-you-should-disable-seamless-sso-in-microsoft-entra-connect/) - [Advanced Active Directory to Entra ID lateral movement techniques](https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Dirk-jan%20Mollema%20-%20Advanced%20Active%20Directory%20to%20Entra%20ID%20lateral%20movement%20techniques.pdf)", "severity": "high", "outcome": "execution_error", "resultType": "exposure_finding", "isIoe": false, "deviation": false, "tool": "maester" }, { "id": "CISA.MS.AAD.7.2", "title": "Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.", "description": "Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. Rationale: Many privileged administrative users do not need unfettered access to the tenant to perform their duties. By assigning them to roles based on least privilege, the risks associated with having their accounts compromised are reduced. #### Remediation action: This policy is based on the ratio below: `X = (Number of users assigned to the Global Administrator role) / (Number of users assigned to other highly privileged roles)` 1. Follow the instructions for policy MS.AAD.7.1v1 above to get a count of users assigned to the Global Administrator role. 2. Follow the instructions for policy MS.AAD.7.1v1 above but get a count of users assigned to the other highly privileged roles (not Global Administrator). If a user is assigned to both Global Administrator and other roles, only count that user for the Global Administrator assignment. 3. Divide the value from step 2 from the value from step 1 to calculate X. If X is less than or equal to 1 then the tenant is compliant with the policy. #### Related links * [CISA 7.2 Highly Privileged User Access - MS.AAD.7.2v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad72v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L792)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.7.3", "title": "Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.", "description": "Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. Rationale: Many privileged administrative users do not need unfettered access to the tenant to perform their duties. By assigning them to roles based on least privilege, the risks associated with having their accounts compromised are reduced. #### Remediation action: 1. Perform the steps below for each [highly privileged role](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles). 2. Review the users listed that have an **OnPremisesImmutableId** and have **OnPremisesSyncEnabled** set. 3. Create a cloud only user account for that individual and remove their hybrid identity from privileged roles. #### Related links * [Entra admin center - Roles and administrators | All roles](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles) * [CISA 7.3 Highly Privileged User Access - MS.AAD.7.3v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad73v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L833)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.7.4", "title": "Permanent active role assignments SHALL NOT be allowed for highly privileged roles.", "description": "Permanent active role assignments SHALL NOT be allowed for highly privileged roles. Rationale: Instead of giving users permanent assignments to privileged roles, provisioning access just in time lessens exposure if those accounts become compromised. In Azure AD PIM or an alternative PAM system, just in time access can be provisioned by assigning users to roles as eligible instead of perpetually active. Note: Exceptions to this policy are: * **Emergency access** accounts that need **perpetual access** to the tenant in the rare event of system degradation or other scenarios. * Some types of **service accounts** that require a user account with privileged roles; since these accounts are used by software programs, they **cannot** perform role activation. #### Remediation action: 1. In **Entra admin center** select **Show more** and **Roles & Admins** and then **[All roles](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles)**. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example. 2. Select the **Global administrator** role. 3. Under **Manage**, select **Assignments** and click the **Active assignments** tab. 4. Verify there are no users or groups with a value of **Permanent** in the **End time** column. If there are any, recreate those assignments to have an expiration date using Entra ID PIM or an alternative PAM system. If a group is identified and it is enrolled in PIM for Groups, see the exception cases below for details. #### Related links * [Entra admin center - Roles and administrators | All roles](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles) * [CISA 7.4 Highly Privileged User Access - MS.AAD.7.4v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad74v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L856)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.7.7", "title": "Eligible and Active highly privileged role assignments SHALL trigger an alert.", "description": "Eligible and Active highly privileged role assignments SHALL trigger an alert. Rationale: Closely monitor assignment of the highest privileged roles for signs of compromise. Send assignment alerts to enable the security monitoring team to detect compromise attempts. #### Remediation action: 1. In **Entra admin center** select **Identity governance** and **Privileged Identity Management**. 2. Under **Manage**, select **Microsoft Entra roles**. 3. Under **Manage**, select **[Roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)**. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example. 4. Click the **Global Administrator** role. 5. Click **Settings** and then click **Edit**. 6. Click the **Notifications** tab. 7. Under **Send notifications when members are assigned as eligible to this role**, in the **Role assignment alert** > **Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts. 8. Under **Send notifications when members are assigned as active to this role**, in the **Role assignment alert** > **Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts. 9. Click **Update**. 10. For each of the highly privileged roles, if they have any PIM groups actively assigned to them, then also apply the same configurations per the steps above to each PIM group's **Member** settings. #### Related links * [Entra admin center - Privileged Identity Management | Microsoft Entra roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles) * [CISA 7.7 Highly Privileged User Access - MS.AAD.7.7v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad77v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L974)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.7.9", "title": "User activation of other highly privileged roles SHOULD trigger an alert.", "description": "User activation of the Global Administrator role SHALL trigger an alert. Rationale: Closely monitor activation of the Global Administrator role for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts. User activation of other highly privileged roles SHOULD trigger an alert. Rationale: Closely monitor activation of high-risk roles for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts. In some environments, activating privileged roles can generate a significant number of alerts. #### Remediation action: 1. In **Entra admin center** select **Identity governance** and **Privileged Identity Management**. 2. Under **Manage**, select **Microsoft Entra roles**. 3. Under **Manage**, select **[Roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)**. 4. Search and click the **Global Administrator** role. For each of the highly privileged roles (other than Global Administrator), follow the same steps but enter a security monitoring mailbox different from the one used to monitor Global Administrator activations. 5. Click **Settings** and then click **Edit**. 6. Click the **Notifications** tab. 7. Under **Send notifications when eligible members activate this role**, in the **Role activation alert** > **Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive role activation alerts. 8. Click **Update**. 9. If the role has any PIM groups actively assigned to it, then also apply the same configurations per the steps above to each PIM group's **Member** settings. #### Related links * [Entra admin center - Privileged Identity Management | Microsoft Entra roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles) * [CISA 7.8 Highly Privileged User Access - MS.AAD.7.8v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad78v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L1022) * [CISA 7.9 Highly Privileged User Access - MS.AAD.7.9v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad78v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L1057)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.8.2", "title": "Only users with the Guest Inviter role SHOULD be able to invite guest users.", "description": "Only users with the Guest Inviter role SHOULD be able to invite guest users. Rationale: By only allowing an authorized group of individuals to invite external users to create accounts in the tenant, an agency can enforce a guest user account approval process, reducing the risk of unauthorized account creation. #### Remediation action: 1. In **Entra ID** and **External Identities**, select **[External collaboration settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/Settings)**. 2. Under **Guest invite settings**, select **Only users assigned to specific admin roles can invite guest users** or **No one in the organization can invite guest users including admins (most restrictive)**. 3. Click **Save**. #### Related links * [Entra admin center - External Identities | External collaboration settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/Settings) * [CISA Guest User Access - MS.AAD.8.2v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad82v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L1157)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.SHAREPOINT.1.3", "title": "External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.", "description": "External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. Rationale: By limiting sharing to domains or approved security groups used for interagency collaboration purposes, administrators help prevent sharing with unknown organizations and individuals. #### Remediation action: This policy is only applicable if the external sharing slider on the admin page is set to any value other than Only People in your organization. 1. Sign in to the [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219). 2. Select Policies > Sharing. 3. Expand More external sharing settings. 4. Select Limit external sharing by domain. 5. Select Add domains. 6. Add each approved external domain users are allowed to share files with. 7. Select Manage security groups 8. Add each approved security group. Members of these groups will be allowed to share files externally. 9. Select Save. #### Related links * [CISA 1 External Sharing - MS.SHAREPOINT.1.3v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md#mssharepoint13v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/SharepointConfig.rego#L130)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AF03", "title": "Authentication Method - FIDO2 security key - Enforce attestation.", "description": "Requires the FIDO security key metadata to be published and verified with the FIDO Alliance Metadata Service, and also pass Microsoft's additional set of validation testing. #### Test script ``` https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2') .isAttestationEnforced -eq 'true' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2')&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [fido2AuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AF04", "title": "Authentication Method - FIDO2 security key - Enforce key restrictions.", "description": "Manages if registration of FIDO2 keys should be restricted. Restrict usage of FIDO2 from unauthorized vendors or platforms #### Test script ``` https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2') .keyRestrictions.isEnforced -eq 'true' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2')&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [fido2AuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.CR01", "title": "Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.", "description": "Defines if admin consent request feature is enabled or disabled #### Test script ``` https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy .isEnabled -eq 'true' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/adminConsentRequestPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [adminConsentRequestPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/AdminConsentSettings)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.1.1", "title": "Legacy authentication SHALL be blocked.", "description": "Legacy authentication SHALL be blocked. Rationale: The security risk of allowing legacy authentication protocols is they do not support MFA. Blocking legacy protocols reduces the impact of user credential theft. #### Remediation action: Follow the guide below to create a conditional access policy that blocks legacy authentication. - [Block legacy authentication - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy#create-a-conditional-access-policy) #### Related links - [CISA Legacy Authentication - MS.AAD.1.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#1-legacy-authentication) - [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L47)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.PR01", "title": "Default Settings - Password Rule Settings - Password Protection - Mode.", "description": "If set to Enforce, users will be prevented from setting banned passwords and the attempt will be logged. If set to Audit, the attempt will only be logged. [Microsoft Entra Password Protection - Microsoft Entra ID - Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises) #### Test script ``` https://graph.microsoft.com/beta/settings .values | where-object name -eq 'BannedPasswordCheckOnPremisesMode' | select-object -expand value -eq 'Enforce' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=settings&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [directorySetting resource type - Microsoft Graph beta | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/directorysetting) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1005", "title": "All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.", "description": "It is recommended to have at least one emergency/break glass account or account group excluded from all conditional access policies. This allows for emergency access to the tenant in case of a misconfiguration or other issues. See [Manage emergency access accounts in Microsoft Entra ID - Microsoft Learn](https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1009", "title": "At least one Conditional Access policy is configured to block other legacy authentication.", "description": "Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one conditional access policy that blocks legacy authentication. See [Block legacy authentication - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1010", "title": "At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.", "description": "Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one conditional access policy that blocks legacy authentication. See [Block legacy authentication - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1011", "title": "At least one Conditional Access policy is configured to secure security info registration only from a trusted location.", "description": "Checks if the tenant has at least one conditional access policy securing security info registration. See [Securing security info registration - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-registration)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1012", "title": "At least one Conditional Access policy is configured to require MFA for risky sign-ins.", "description": "Checks if the tenant has at least one conditional access policy requiring multifactor authentication for risky sign-ins. See [Sign-in risk-based multifactor authentication - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-risk)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1014", "title": "At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.", "description": "Microsoft recommends requiring device compliance for administrators that are members of the following roles: * Global administrator * Application administrator * Authentication Administrator * Billing administrator * Cloud application administrator * Conditional Access administrator * Exchange administrator * Helpdesk administrator * Password administrator * Privileged authentication administrator * Privileged Role Administrator * Security administrator * SharePoint administrator * User administrator See [Require compliant or Microsoft Entra hybrid joined device for administrators - Microsoft Learn](https://aka.ms/CATemplatesAdminDevices)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1017", "title": "At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.", "description": "Microsoft recommends disabling browser persistence for users accessing the tenant from a unmanaged device. See [Require reauthentication and disable browser persistence - Microsoft Learn](https://aka.ms/CATemplatesBrowserSession)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1020", "title": "All Conditional Access policies are configured to exclude directory synchronization accounts or do not scope them.", "description": "It is recommended to exclude directory synchronization accounts from all conditional access policies scoped to all cloud apps.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.adminMFAV2", "title": "Require multifactor authentication for administrative roles.", "description": "Requiring multifactor authentication (MFA) for administrative roles makes it harder for attackers to access accounts. Administrative roles have higher permissions than typical users. If any of those accounts are compromised, your entire organization is exposed. At a minimum, protect the following roles: Global administrator, Authentication administrator, Billing administrator, Conditional Access administrator, Exchange administrator, Helpdesk administrator, Security administrator, SharePoint administrator, User administrator. #### Remediation action: 1. We provide step-by-step guidance to select and enable the right MFA method for your organization in the Microsoft 365 admin center. [Go to the Microsoft 365 MFA wizard](https://admin.microsoft.com/adminportal/home?Q=SecureScore#/featureexplorer/security/ConditionalAccess). 2. If you would like to perform the implementation yourself, first check what Microsoft Entra ID license you have under “Prerequisites” in Microsoft Secure Score or [see your license type under \"Basic information\" in the Microsoft Entra ID Overview.](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview). 3. If you’ve invested in Microsoft Entra ID Premium P1 or P2 licenses, you can create a Conditional Access policy from scratch or by using a template. [Follow these steps to create a Conditional Access policy from scratch or by using a template](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa). 4. If you would like to perform the implementation yourself and you’re using Microsoft Entra ID Free, turn on security defaults. Note: Security defaults and Conditional Access can’t be used side by side. [Enable security defaults](https://docs.microsoft.com/azure/active-directory/fundamentals/concept-fundamentals-security-defaults). 5. Keep track of your admin’s progress of registering authentication methods by going to Microsoft Entra ID > Security > Authentication methods > User registration details (requires Microsoft Entra ID Premium P1 or P2 licenses). [Go to User registration details](https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/UserRegistrationDetails). **Impact:** First, users with administrative roles need to register for MFA. After each admin is registered, your policies then determine when they’re prompted for the additional authentication factors. #### Related links: * [Require multifactor authentication for administrative roles - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "SI000079", "title": "Write access to RBCD on DC", "description": "This indicator looks for Write access on RBCD for Domain Controllers to users who are not in Domain Admins, Enterprise Admins and Built-in Admins groups.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000080", "title": "Write access to RBCD on krbtgt account", "description": "This indicator looks for Write access on RBCD for the krbtgt account to users who are not in Domain Admins, Enterprise Admins and Built-in Admins groups.", "recommendation": "Review the list and ensure that there are no unnecessary principals who can set resource-based constrained delegation on krbtgt.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000151", "title": "RC4 or DES encryption type are supported by Domain Controllers", "description": "This indicator checks if RC4 or DES encryption is supported by Domain Controllers", "recommendation": "It is best practice to disable support for RC4 and DES on domain controllers. Proceed with caution, as this can cause clients that request RC4 encrypted kerberos tickets by default to fail.\n Disable it by adding the group policy Network security: Configure encryption types allowed for Kerberos and select only AES-128, AES-256 encryption types, to a GPO that affects the Domain Controllers container.\n The group policy path is Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000351", "title": "Shadow Credentials on privileged objects", "description": "This indicator looks for users with write access to the msDS-KeyCredentialLink attribute of privileged users and DCs.", "recommendation": "Make sure these users should have this write access and that it is necessary, if it's not remove them.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000067", "title": "Privileged accounts with a password that never expires", "description": "This indicator identifies privileged accounts (adminCount attribute set to 1) where the Password Never Expires flag is set.", "recommendation": "Enforce that users with privileged access must change their passwords on a regular basis and ensure that those passwords are complex and ideally require MFA to authenticate.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000156", "title": "Certificate templates with 3 or more insecure configurations", "description": "This indicator checks if certificate templates in the forest have a minimum of three insecure configurations - Manager approval is disabled, No authorized signatures are required, SAN enabled, Authentication EKU present.", "recommendation": "Multiple actions can be taken to ensure certificate templates will be less vulnerable:\n
    \n
  1. Enable manager approval - make sure manager approval is enabled and required on the certificate, and approve each request manually after inspecting it.
    2. \n
  2. No authorized signatures are required - it is recommended to set it to 1 so that each request will have to be signed by an authorized certificate.
    3. \n
  3. SAN Enabled - evaluate if the certificate needs to specify a subjectAltName, if not disable this option.
    4. \n
  4. Authentication EKU present - make sure the certificate template is being used for authentication only.
    For example, a certificate that is solely used for code signing should not also be used for authentication.
    5. \n
", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000302", "title": "Dangerous user rights granted by GPO", "description": "Group Policy Objects (GPOs) are used to define security settings that apply to a group of users or computers in an Active Directory environment. GPOs can be used to grant dangerous user rights, such as the ability to bypass file system security, log on as a service, or even perform actions with elevated privileges. This indicator looks for non-privileged users who are granted elevated permissions through GPO.", "severity": "high", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "MT.1024.insiderRiskPolicy", "title": "Protect your tenant with Insider Risk condition in Conditional Access policy.", "description": "Enabling an Insider Risk-based Conditional Access policy offers crucial benefits, including early detection of anomalies, adaptive access controls, and real-time responses to insider threats. It prevents unauthorized access, enforces compliance, and reduces the impact of insider incidents. By fostering a security-aware culture, the policy integrates with the broader security ecosystem, providing a comprehensive approach to mitigate risks originating from within the organization, safeguarding sensitive data, and enhancing overall security posture.​ #### Remediation action: 1. Enable Adaptive Protection in Microsoft Purview. You must be a member of the Insider Risk Management or Insider Risk Management Admins role group in Microsoft Purview to configure Adaptive Protection. [Go to Adaptive Protection.](https://go.microsoft.com/fwlink/?linkid=2261736). 2. Create a Conditional Access policy that includes the Insider Risk condition. [Use this risk policy template](https://go.microsoft.com/fwlink/?linkid=2261903). 3. For more information about this recommendation and the associated features, see [Adaptive Protection and Insider Risk Conditional Access recommendation.](https://go.microsoft.com/fwlink/?linkid=2260505). **Impact:** Upon policy activation, user actions will align with administrator configurations. Potential actions encompass the user being \"Blocked\" from application usage or activation of \"Terms of Use\" conditions. #### Related links: * [Protect your tenant with Insider Risk condition in Conditional Access policy - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.passwordHashSync", "title": "Enable password hash sync if hybrid.", "description": "Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Microsoft Entra Connect synchronizes a hash of the hash of a user's password from an on-premises Microsoft Entra Connect instance to a cloud-based Microsoft Entra Connect cloud sync instance. Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one. Enabling password hash synchronization also allows for leaked credential reporting. #### Remediation action: 1. To use password hash synchronization in your organization, you need to install Microsoft Entra Connect and configure directory synchronization between your on-premises Microsoft Entra Connect instance and your Microsoft Entra Connect cloud sync instance. [Follow these steps to enable password hash synchronization](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#enable-password-hash-synchronization). **Impact:** When a user changes their on-premises password, the updated password is synchronized to Microsoft Entra ID. When a cloud service requires the user to authenticate, they’ll need to provide the newly synchronized password. Microsoft Entra ID will also detect leaked credentials for the users with synced passwords. #### Related links: * [Enable password hash sync if hybrid - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.staleAppCreds", "title": "Remove unused credentials from applications.", "description": "Removing unused application credentials helps reduce the attack surface area and helps declutter the app portfolio of a tenant. #### Remediation action: 1. From the ‘Impacted resources’ table, select ‘More details’ to identify the Credential ID and the Origin of the credential. 2. Select ‘Update credential’ to go directly to the Application or Service principal area. 3. If the Origin of the credential is an application, select ‘Certificates & secrets’ then locate the unused credential and remove it. 4. If the Origin of the credential is a service principal, go to ‘Identity’ > ‘Enterprise applications’ > ‘Single sign-on’ > ‘SAML certificates’ then locate the unused credential and remove it. 5. In the instance where the origin of the credential in the recommendation is marked as service principal but there are no SAML certificates, you can use the Microsoft Graph API to query specific properties and remove the credential from the Service Principal. For more information, see [Recommendation to remove unused credentials from apps](https://learn.microsoft.com/entra/identity/monitoring-health/recommendation-remove-unused-credential-from-apps?tabs=microsoft-entra-admin-center). **Impact:** #### Related links: * [Remove unused credentials from applications - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1024.staleApps", "title": "Remove unused applications.", "description": "Removing unused applications helps reduce the attack surface area and helps declutter the app portfolio of a tenant. #### Remediation action: 1. From the Impacted resources table, select More details to identify the impacted resources. 2. Select the Resource link to go directly to the associated App registration page. 3. Determine if the identified application is needed based on the application usage scenario. For example, an application could have usage gaps due to being deprecated or intentional long intermittent use through the year. 4. If the application is no longer needed, remove it from your tenant by first soft deleting it, wait 15 days, and then remove it permanently. Find more details on how to soft or permanently delete applications, see [How to: Restore or remove a recently deleted application with the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/howto-restore-app). 5. If the application is needed, you have the option to update the status of the recommendation for that application as Dismissed or Postponed. For more information, see [How to update a recommendation.](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-use-recommendations#how-to-update-a-recommendation&tabs=http). 6. For more information, see [Recommendation to remove unused apps.](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/recommendation-remove-unused-apps). **Impact:** #### Related links: * [Remove unused applications - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1036", "title": "All excluded objects should have a fallback include in another policy.", "description": "All excluded objects should have a fallback include in another policy", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1038", "title": "Conditional Access policies should not include or exclude deleted groups.", "description": "This test checks if there are any Conditional Access policies that target deleted security groups. This usually happens when a group is deleted but is still referenced in a Conditional Access policy. Deleted groups in your policy can lead to unexpected gaps. This may result in Conditional Access policies not being applied to the users you intended or the policy not being applied at all. To fix this issue: * Open the impacted Conditional access policy. * If the group is no longer needed, click Save to remove the referenced group from the policy. * If the group is still needed, update the policy to target a valid group.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1045", "title": "Only invited users should be automatically admitted to Teams meetings", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.3.3", "title": "If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.", "description": "If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. Rationale: This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises. #### Remediation action: If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in. 1. In Entra ID, click Security > [Authentication Methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/Identity) > **Microsoft Authenticator**. 2. Click the **Configure tab**. 3. For **Allow use of Microsoft Authenticator OTP** select **No**. 4. Under Show application name in push and passwordless notifications select Status > **Enabled** and Target > Include > **All users**. 5. Under Show geographic location in push and passwordless notifications select Status > **Enabled** and Target > Include > **All users**. 6. Select **Save**. #### Related links * [CISA Strong Authentication & Secure Registration - MS.AAD.3.3v2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad33v2) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L254)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1053", "title": "Ensure intune device clean-up rule is configured", "description": "Ensure device clean-up rule is configured This test checks if the device clean-up rule is configured. Set your Intune device cleanup rules to delete Intune MDM enrolled devices that appear inactive, stale, or unresponsive. Intune applies cleanup rules immediately and continuously so that your device records remain current. #### Remediation action: To enable device clean-up rules: - Open [Microsoft Intune - Device clean-up rules](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/deviceCleanUp) - Or navigate to [Microsoft Intune admin center](https://intune.microsoft.com) > **Devices** > **Organize devices** > **Device clean-up rules**. - Select **Create**. - Set **Name** and **Platform**. - Enter **30 days or more** depending on your organizational needs. - Click **Next**. - Click **Create**. #### Related links - [Automatically hide devices with cleanup rules](https://learn.microsoft.com/en-us/intune/intune-service/remote-actions/devices-wipe#automatically-hide-devices-with-cleanup-rules)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1054", "title": "Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'", "description": "Ensure the built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'. Set your Intune built-in Device Compliance Policy to mark devices with no compliance policy assigned as 'Not compliant'. This ensures that new devices that do not have any policies assigned are not compliant per default. #### Remediation action: To change the built-in device compliance policy: 1. Navigate to [Microsoft Intune admin center](https://intune.microsoft.com). 2. Click **Devices** scroll down to **Manage devices**. 3. Select **Compliance** and Select **Compliance settings**. 4. Set **Mark devices with no compliance policy assigned as** to **Not compliant** 5. Click **Save**. #### Related links * [Microsoft 365 Admin Center](https://admin.microsoft.com) * [Microsoft Intune - Compliance](https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/compliance) * [Compliance policy settings](https://learn.microsoft.com/de-de/mem/intune/protect/device-compliance-get-started#compliance-policy-settings)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1066", "title": "Conditional Access policies should not reference non-existent users, groups, or roles.", "description": "# Conditional Access policies should not reference non-existent users, groups, or roles This test checks if there are any Conditional Access policies that reference non-existent users, groups, or roles. This usually happens when a user, group, or role is deleted but is still referenced in a Conditional Access policy. Non-existent objects in your policy can lead to unexpected gaps or behavior. This may result in Conditional Access policies not being applied to the intended users or the policy not functioning as expected. ## How to fix To fix this issue: * Open the impacted Conditional Access policy. * Remove the non-existent user, group, or role from the policy. * If the object is still needed, recreate it or replace it with a valid alternative. * Click Save to apply the changes. ## Learn more * [Conditional Access: Users and groups](https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-users-groups) * [Manage Conditional Access policies](https://learn.microsoft.com/entra/identity/conditional-access/manage-conditional-access-policies)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1071", "title": "At least one Conditional Access policy explicitly includes Azure DevOps.", "description": "Checks if any conditional access policy explicitly includes Azure DevOps ## Description If your organization has Conditional Access policies targeting the Windows Azure Service Management API (App ID: 797f4846-ba00-4fd7-ba43-dac1f8f63013), those policies will no longer apply to Azure DevOps sign-ins. This may result in unprotected access unless these policies are updated to include Azure DevOps (App ID: 499b84ac-1321-427f-aa17-267ca6975798). Access controls such as MFA or compliant device requirements may not be enforced unless policies are updated. If you already have a policy that targets all users and all cloud apps and does not explicitly exclude Azure DevOps, no action is required—Azure DevOps sign-ins will continue to be protected. This change does not introduce any new user-facing experience or UI changes. Sign-in activity can be monitored using Microsoft Entra ID sign-in logs. Licensing requirement: Microsoft Entra ID P1 or P2 is required. There are no functional differences by license type. This is a feature change, not a new feature, so trial or preview options are not applicable. Unlicensed users may also be impacted. Existing Conditional Access policies will be affected, specifically those targeting the Windows Azure Service Management API. A small subset of tenants may see the app name as \"Microsoft Visual Studio Team Services\" instead of \"Azure DevOps\"—the App ID remains the same. ## Remediate To ensure continued protection of Azure DevOps sign-ins, administrators should: Update policies to include Azure DevOps: 1. Review existing Conditional Access policies - Identify any policies that target the Windows Azure Service Management API. 2. Go to the Entra admin center. 3. Navigate to Entra ID > Conditional Access > Policies. 4. Select the relevant policy. 5. Under Target resources, choose Select resources and add Azure DevOps (App ID: 499b84ac-1321-427f-aa17-267ca6975798). - If Azure DevOps is missing from available resources: ``` Connect-MgGraph -Scopes \"Directory.ReadWrite.All\", \"Application.ReadWrite.All\" $params = @{ appId = \"499b84ac-1321-427f-aa17-267ca6975798\" } Invoke-MgGraphRequest -Uri \"https://graph.microsoft.com/v1.0/servicePrincipals\" -Method POST -Body $params ``` 6. Save the policy. ## Learn more - [Removing Azure Resource Manager reliance on Azure DevOps sign-ins | Azure DevOps Blog](https://devblogs.microsoft.com/devops/removing-azure-resource-manager-reliance-on-azure-devops-sign-ins/) - [What is Conditional Access? | Conditional Access | Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1073", "title": "Soft- and hard-matching of synchronized objects should be blocked.", "description": "Ensure soft and hard matching for on-premises synchronization objects is blocked When you start synchronizing with Microsoft Entra Connect, the Microsoft Entra service API checks every new incoming object and tries to find an existing object to match. There are three attributes used for this process: userPrincipalName, proxyAddresses, and sourceAnchor/immutableID. A match on userPrincipalName or proxyAddresses is known as a \"soft-match.\" A match on sourceAnchor is known as \"hard-match.\" For the proxyAddresses attribute, only the value with SMTP:, that is the primary email address, is used for the evaluation. Both, the hard-match and soft-match, tries to match objects already present and managed in Microsoft Entra ID with the new incoming objects being added that represent the same on-premises entity. If Microsoft Entra ID isn't able to find a hard-match or soft-match for the incoming object, it provisions a new object in Microsoft Entra ID directory. The match is only evaluated for new objects coming from on-premises AD. If you change an existing object so it matches any of these attributes, then you see an error instead. If Microsoft Entra ID finds an object where the attribute values are the same as the new incoming object from Microsoft Entra Connect, then it takes over the object in Microsoft Entra ID and the previously cloud-managed object is converted to on-premises managed. All attributes in Microsoft Entra ID with a value in on-premises AD are overwritten with the respective on-premises value. Matching existing Entra objects with newly synchronized on-premises active directory objects can lead to unintended consequences, such as mismatching user data or allowing users to access data, of for example colleagues with the same name, they should not have access to. #### Remediation action: To block soft- and hard-match from on-premises directory synchronization using Graph PowerShell: 1. Connect to Graph using **Connect-MgGraph -Scopes \"OnPremDirectorySynchronization.ReadWrite.All\"**. 2. Run following PowerShell Command: ``` $onPremisesSynchronization = Invoke-MgGraphRequest -Uri \"https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization\" -OutputType PSObject | Select-Object -ExpandProperty value $params = @{ features = @{ BlockCloudObjectTakeoverThroughHardMatchEnabled = $true BlockSoftMatchEnabled = $true } } Invoke-MgGraphRequest -Method PATCH -Uri \"https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization/$($onPremisesSynchronization.id)\" -Body $params ``` #### Related links * [Microsoft Entra Connect: When you have an existing tenant | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-existing-tenant) * [Update-MgDirectoryOnPremiseSynchronization | Microsoft Learn - Graph PowerShell v1.0](https://learn.microsoft.com/de-de/powershell/module/microsoft.graph.identity.directorymanagement/update-mgdirectoryonpremisesynchronization?view=graph-powershell-1.0)", "severity": "medium", "outcome": "execution_error", "resultType": "exposure_finding", "isIoe": false, "deviation": false, "tool": "maester" }, { "id": "MT.INV.002", "title": "Service principal credentials nearing expiration", "description": "This test identifies service principals and applications with credentials that will expire within the next 30 days. Expired credentials can cause service outages. #### Investigation steps: 1. Identify the business owner of the application 2. Schedule credential rotation before expiration 3. Update any systems using these credentials #### Related links * [Microsoft Entra App Registrations](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps)", "severity": "medium", "outcome": "warning", "resultType": "exposure_finding", "isIoe": false, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.AAD.8.3", "title": "Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.", "description": "Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. Rationale: Limiting which domains can be invited to create guest accounts in the tenant helps reduce the risk of users from unauthorized external organizations getting access. > ⚠️ WARNING: This test utilizes a technical mechanism that differs from CISA's, though the outcome is the same. #### Remediation action: 1. In **Entra admin center** select **External Identities** and **Cross-tenant access settings**. 2. Under **Default settings**, select [**Edit inbound defaults**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/InboundAccessSettings.ReactView/isDefault~/true/name//id/). 3. Under **B2B collaboration**, and **External users and groups**, ensure **Access status** is set to **Block access**. 4. Under **B2B collaboration**, and **Applications**, ensure **Access status** is set to **Block access**. > This configuration will **only** allow B2B collaboration with other Entra tenants. #### Related links * [Entra admin center - External Identities | Cross-tenant access settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/InboundAccessSettings.ReactView/isDefault~/true/name//id/) * [CISA 8 Guest User Access - MS.AAD.8.3v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad83v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L1190)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CISA.MS.SHAREPOINT.1.1", "title": "External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.", "description": "External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. Rationale: Sharing information outside the organization via SharePoint increases the risk of unauthorized access. By limiting external sharing, administrators decrease the risk of access to information. #### Remediation action: 1. Sign in to the [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219). 2. Select Policies > Sharing. 3. Adjust external sharing slider for SharePoint to Existing guests or Only people in your organization. > ⚠️ WARNING: This will break existing sharing. 4. Select Save. #### Related links * [CISA 1 External Sharing - MS.SHAREPOINT.1.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md#mssharepoint11v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/SharepointConfig.rego#L68)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.INV.003", "title": "Inactive privileged accounts detected", "description": "This test identifies privileged accounts that have not signed in for more than 90 days. Inactive privileged accounts pose a security risk. #### Investigation steps: 1. Contact the account owner to verify if the account is still needed 2. If not needed, disable or delete the account 3. If needed, investigate why there is no recent activity #### Related links * [Microsoft Entra Privileged Identity Management](https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart)", "severity": "medium", "outcome": "warning", "resultType": "exposure_finding", "isIoe": false, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AG02", "title": "Authentication Method - General Settings - Report suspicious activity - State.", "description": "Allows users to report suspicious activities if they receive an authentication request that they did not initiate. This control is available when using the Microsoft Authenticator app and voice calls. Reporting suspicious activity will set the user's risk to high. If the user is subject to risk-based Conditional Access policies, they may be blocked. Allows to integrate report of fraud attempt by users to identity protection: Users who report an MFA prompt as suspicious are set to High User Risk. Administrators can use risk-based policies to limit access for these users, or enable self-service password reset (SSPR) for users to remediate problems on their own. #### Test script ``` https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy .reportSuspiciousActivitySettings.state -eq 'enabled' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [Get authenticationMethodsPolicy - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/authenticationmethodspolicy-get) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsSettings)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AM02", "title": "Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.", "description": "Defines if users can use the OTP code generated by the Authenticator App. CISA MS.AAD.3.3v2 recommends disabling Microsoft Authenticator OTP. We recommend using this method only if no stronger MFA option is available, or if it is needed for specific restore scenarios. Make sure you have configured authentication strength to require stronger and phishing-resistant authentication methods, in order to enforce stronger authentication than OTP in all other scenarios. #### Test script ``` https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator') .isSoftwareOathEnabled -eq 'false' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator')&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [microsoftAuthenticatorAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "CIS.M365.1.2.1", "title": "Ensure that only organizationally managed/approved public groups exist", "description": "1.2.1 (L2) Ensure that only organizationally managed/approved public groups exist Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. While there are several different group types this recommendation concerns Microsoft 365 Groups. Ensure that only organizationally managed and approved public groups exist. #### Remediation action: To enable only organizationally managed/approved public groups exist: 1. Navigate to Microsoft 365 admin center [https://admin.microsoft.com](https://admin.microsoft.com). 2. Click to expand **Teams & groups** select **Active teams & groups**. 3. On the **Active teams and groups** page, select the group's name that is public. 4. On the popup groups name page, **Select Settings**. 5. Under Privacy, select **Private**. #### Related links * [Microsoft 365 Admin Center](https://admin.microsoft.com) * [CIS Microsoft 365 Foundations Benchmark v5.0.0 - Page 36](https://www.cisecurity.org/benchmark/microsoft_365)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AP04", "title": "Default Authorization Settings - Guest invite restrictions.", "description": "Manages controls who can invite guests to your directory to collaborate on resources secured by your Entra ID (Azure AD), such as SharePoint sites or Azure resources. CISA SCuBA 2.18: Only users with the Guest Inviter role SHOULD be able to invite guest users #### Test script ``` https://graph.microsoft.com/beta/policies/authorizationPolicy .allowInvitesFrom -in @('adminsAndGuestInviters','none') ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authorizationPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [authorizationPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/authorizationpolicy) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AllowlistPolicyBlade)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AP05", "title": "Default Authorization Settings - Sign-up for email based subscription.", "description": "Indicates whether users can sign up for email based subscriptions. #### Test script ``` https://graph.microsoft.com/beta/policies/authorizationPolicy .allowedToSignUpEmailBasedSubscriptions -eq 'false' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authorizationPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [authorizationPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/authorizationpolicy)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.AP06", "title": "Default Authorization Settings - User can join the tenant by email validation.", "description": "Controls whether users can join the tenant by email validation. To join, the user must have an email address in a domain which matches one of the verified domains in the tenant. [Self-service sign up for email-verified users - Microsoft Entra ID - Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-self-service-signup) #### Test script ``` https://graph.microsoft.com/beta/policies/authorizationPolicy .allowEmailVerifiedUsersToJoinOrganization -eq 'false' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authorizationPolicy&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [authorizationPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/authorizationpolicy)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.CP04", "title": "Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.", "description": "If this option is set to enabled, then users request admin consent to any app that requires access to data they do not have the permission to grant. If this option is set to disabled, then users must contact their admin to request to consent in order to use the apps they need. CISA SCuBA 2.7: Non-Admin Users SHALL Be Prevented From Providing Consent To Third-Party Applications. #### Test script ``` https://graph.microsoft.com/beta/settings .values | where-object name -eq 'EnableAdminConsentRequests' | select-object -expand value -eq 'true' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=settings&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [directorySetting resource type - Microsoft Graph beta | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/directorysetting) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/AdminConsentSettings)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "EIDSCA.PR06", "title": "Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.", "description": "How many failed sign-ins are allowed on an account before its first lockout. If the first sign-in after a lockout also fails, the account locks out again. [Prevent attacks using smart lockout - Microsoft Entra ID - Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout) #### Test script ``` https://graph.microsoft.com/beta/settings .values | where-object name -eq 'LockoutThreshold' | select-object -expand value -le '10' ``` #### Related links - [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=settings&method=GET&version=beta&GraphUrl=https://graph.microsoft.com) - [directorySetting resource type - Microsoft Graph beta | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/directorysetting) - [View in Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1015", "title": "At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.", "description": "Microsoft recommends blocking access for unknown or unsupported device platforms. See [Block access for unknown or unsupported device platform - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-policy-unknown-unsupported-device)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1018", "title": "At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.", "description": "Microsoft recommends disabling browser persistence for users accessing the tenant from a unmanaged device. See [Require reauthentication and disable browser persistence - Microsoft Learn](https://aka.ms/CATemplatesBrowserSession)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "MT.1019", "title": "At least one Conditional Access policy is configured to enable application enforced restrictions.", "description": "Microsoft recommends blocking or limiting access to SharePoint, OneDrive, and Exchange content from unmanaged devices. See [Use application enforced restrictions for unmanaged devices - Microsoft Learn](https://aka.ms/CATemplatesAppRestrictions)", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "SI000028", "title": "Built-in domain Administrator account used within the last two weeks", "description": "The Domain Administrator account should only be used for initial build activities and, when necessary, disaster recovery. This indicator checks to see if the lastLogonTimestamp for the built-in Domain Administrator account has been updated within the last two weeks. If so, it could indicate that the user has been compromised.", "recommendation": "Ensure that the built-in domain Administrator account is not used regularly and has a complex password known only to highly privileged admins.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000104", "title": "Changes to Pre-Windows 2000 Compatible Access Group membership", "description": "This indicator looks for changes to the built-in group \"Pre-Windows 2000 Compatible Access\". This group grants read-only access to Active Directory.", "recommendation": "Confirm that any addition or removals from Pre-Windows 2000 Compatible Access group are valid and properly accounted for.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000084", "title": "gMSA not in use", "description": "This indicator checks if there are enabled group Managed Service Account (gMSA) objects in the domain.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "S-OldNtlm", "title": "The LAN Manager Authentication Level allows the use of NTLMv1 or LM.", "description": "The purpose is to check if NTLMv1 or LM can be used by DC", "recommendation": "After an audit of NTLMv1 usage (see the links below), you need to raise the LAN Manager Authentication Level to \"Send NTLMv2 response only. Refuse LM & NTLM\". This can be done by editing the policy \"Network security: LAN Manager authentication level\" which can be accessed in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options The policy will be applied after a computer reboot. Beware that you may break software which is not compatible with Ntlmv2 such as very old Linux stacks or very old Windows before Windows Vista. But please note that Ntlmv2 can be activited on all Windows starting Windows 95 and other operating systems.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-Delegated", "title": "Presence of Admin accounts which do not have the flag \"This account is sensitive and cannot be delegated\": 4", "description": "The purpose is to ensure that all Administrator Accounts have the configuration flag \"this account is sensitive and cannot be delegated\" (or are members of the built-in group \"Protected Users\" when your domain functional level is at least Windows Server 2012 R2).", "recommendation": "To correct the situation, you should make sure that all your Administrator Accounts have the check-box \"This account is sensitive and cannot be delegated\" active or add your Administrator Accounts to the built-in group \"Protected Users\" if your domain functional level is at least Windows Server 2012 R2 (some functionalities may not work properly afterwards, you should check the official documentation ). If you want to enable the check-box \"This account is sensitive and cannot be delegated\" but this is not possible because the box is not present (typically for GMSA accounts), you can add the flag manually by adding the number 1048576 to the attribute useraccountcontrol of the account. Please note that there is a section below in this report named \"Admin Groups\" which gives more information.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-AdminLogin", "title": "The native administrator account has been used recently: 0 day(s) ago", "description": "The purpose is to verify if the Native Administrator account is used.", "recommendation": "To mitigate security risks effectively, it is advisable to reserve the Native Administrator account solely for emergency situations, with daily tasks being carried out using separate accounts. It is strongly recommended not to employ this account routinely, opting instead for individualized accounts for administrators and dedicated accounts for services. It's worth noting that any anomalies related to this practice will be automatically addressed and resolved within 35 days following the last login by a native administrator. To monitor the most recent use of the administrator account, we recommend extracting the LastLogon attribute of the administrator account from ALL domain controllers. This task can be accomplished using tools such as ADSIEdit or ADExplorer. Subsequently, for each domain controller, extract the event ID 4624 corresponding to the LastLogon date. This will enable you to pinpoint the computer and process responsible for the logon event. It's worth mentioning that prior to version 3.2 of PingCastle, this information was obtained through the LastLogonTimestamp attribute, which could have been altered by the Kerberos S4u2Self mechanism. While this approach offered the advantage of gathering data from domain controllers that were otherwise inaccessible via the network, it often resulted in a high number of false positives.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-ServiceDomainAdmin", "title": "Presence of accounts with non-expiring passwords in the domain admin group (at least 2 accounts): 3", "description": "The purpose is to check for accounts with non-expiring passwords in the \"Domain Administrator\" group", "recommendation": "Remove identified accounts from the Domain Administrators group, or configure their passwords to expire and establish a regular rotation schedule. If the account is a service account that requires a non-expiring password, consider using a Group Managed Service Account (gMSA) instead, which handles automatic password rotation.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-AdminSDHolder", "title": "Suspicious admin activities detected on 1 user(s)", "description": "The purpose is to ensure that there are no rogue admin accounts in the Active Directory", "recommendation": "These accounts should be reviewed, especially in regards with their past activities and have the admincount attribute removed. In order to identify which accounts are detected by this rule, we advise to run a PowerShell command that will show you all users having this flag set: get-adobject -ldapfilter \"(admincount=1)\" Do not forget to look at the section AdminSDHolder below.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-LAPS-Not-Installed", "title": "LAPS doesn't seem to be installed", "description": "The purpose is to make sure that there is a proper password policy in place for the native local administrator account.", "recommendation": "If you don't have any provisioning process or password solution to manage local administrators, you should install the LAPS solution. If you address the risk through alternative measures, you can disregard this finding. Customers using Netwrix PingCastle Pro or Enterprise versions can add this item as an exception.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-CertTempCustomSubject", "title": "At least one certificate template used for authentication can have its subject modified when being used [1]", "description": "This check verifies if certificate templates in Active Directory Certificate Services (AD CS) allow user-controlled subject information and meet other common criteria associated with the ESC1 vulnerability.", "recommendation": "To mitigate ESC1, use one or more of the options below: Option 1: Modify Certificate Template Settings in ADCS Open Certificate Authority (certsrv.msc) on the CA server. Right-click on Certificate Templates and select Manage. Navigate to and right-click the vulnerable template and select Properties. Go to the Subject Name tab: Ensure \"Supply in the request\" is unchecked. Click OK to save changes. Option 2: Restrict Enrollment Permissions Note: Restricting enrollment permissions mitigates some of the risk but all users with enrollment permissions can still impersonate any account. As such, accounts with enrollment permissions for these certificates should be closely monitored and not be on non-privileged accounts. Open Certificate Authority (certsrv.msc) on the CA server. Right-click on Certificate Templates and select Manage. Navigate to and right-click the vulnerable template and select Properties. Go to the Security tab: Remove well-known low-privileged groups such as Authenticated Users, Everyone from enrollment permissions. Assign only the required accounts and groups permission to request these certificates. Click OK to save changes. Option 3: Remove the CA Certificate from NTAuthCertificates Note: Only do this if you are sure you do not use and do not want to use certificate-based authentication. NTAuthCertificates CaCertificate attribute stores the certificate authority certificates that are authorized to be used for authentication. Removing the Certificate Authorities certificate from here stops all authentication-based attacks. If you're not using certificate-based authentication for this CA: Open Active Directory Sites and Services (dssite.msc). From the top menu, click View and select Show Services Node. Navigate to Services > Public Key Services > NTAuthCertificates. Right-click the CACertificate attribute and select Properties. Review the listed certificates. Remove the entry for the affected CA by selecting it and clicking Remove. Click OK to apply the changes.", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-BackupMetadata", "title": "Last AD backup has been performed 55 day(s) ago", "description": "The purpose is to check if the backups are actually up to date in case they are needed. The alert can be triggered when a domain is backed up using non-recommended methods", "recommendation": "Plan AD backups based on Microsoft standards. These standards depend on the Operating System. For example with the wbadmin utility: wbadmin start systemstatebackup -backuptarget:d:", "severity": "medium", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "MT.1024.DefenderForIdentityIsNotInstalled", "title": "Start your Defender for Identity deployment, installing Sensors on Domain Controllers and other eligible servers..", "description": "#### Remediation action: Go to the [activation page](https://security.microsoft.com/settings/identities?tabid=onboarding) in Settings, where you can view the discovered servers recommended for onboarding to the Defender for Identity new sensor. To see the sensors already installed in your environment, go to the [sensor page](https://security.microsoft.com/settings/identities?tabid=sensor). You will be scored as a percentage of your deployment progress. [Get Started](https://security.microsoft.com/settings/identities?tabid=sensor). **Impact:** Unknown #### Related links: * [Start your Defender for Identity deployment, installing Sensors on Domain Controllers and other eligible servers. - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RecommendationDetails.ReactView/recommendationId/)", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "maester" }, { "id": "SI000011", "title": "Unprivileged users can add computer accounts to the domain", "description": "This indicator checks for an AD configuration that allows unprivileged domain members to add computer accounts to the domain. By default, members of the Authenticated Users group can add up to 10 machine accounts to a domain. If the ms-DS-MachineAccountQuota attribute on the domain naming context head is not set to 0, regular users have this ability.The ability to do this confers certain rights on those created machine accounts that can be abused by a variety of Kerberos-based attacks. Note: This configuration may be enabled but be already mitigated by GPO settings (User Right: \"Add workstations to domain\" configured with only high-privileged group(s)/account(s)) linked to Domain Controllers OU that are not checked by this indicator.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000034", "title": "Unprivileged accounts with adminCount=1", "description": "This indicator looks for any users or groups that may have been under the control of SDProp (adminCount=1) but are no longer members of privileged groups and should not be considered privileged.", "recommendation": "Remove the adminCount = 1 attribute from these users. Investigate unknown users with this attribute.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "S-ADRegistration", "title": "Non-admin users can add up to 10 computer(s) to a domain", "description": "The purpose is to ensure that basic users cannot register extra computers in the domain", "recommendation": "To solve the issue, limit the number of extra computers that can be registered by a basic user. It can be reduced by modifying the value of ms-DS-MachineAccountQuota to zero (0). Another solution can be to remove the \"Authenticated Users\" group in the domain controllers policy altogether. Do note, that if you need to set delegation to an account, so it can add computers to the domain, it can be done through 2 methods: Delegation in the OU or by assigning the SeMachineAccountPrivilege to a special group", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-SchemaAdmin", "title": "The group Schema Admins is not empty: 1 account(s)", "description": "The purpose is to ensure that no account can make unexpected modifications to the schema", "recommendation": "Remove the accounts or groups belonging to the \"schema administrators\" group.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-RecycleBin", "title": "The Recycle Bin is not enabled", "description": "The purpose is to ensure that the Recycle Bin feature is enabled", "recommendation": "First, be sure that the forest level is at least Windows Server 2008 R2. You can check it with Get-ADForest or in the Domain Information section. Then you can enable it using the PowerShell command: Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'test.mysmartlogon.com'", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "P-ProtectedUsers", "title": "Number of admins not in Protected Users: 4", "description": "The purpose is to ensure that all privileged accounts are in the Protected User security group", "recommendation": "After having reviewed the potential impact on adding users to this group, add the missing privileged accounts to this group.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-DC-SubnetMissing", "title": "The subnet declaration is incomplete [1 IP of DC not found in declared subnets]", "description": "The purpose is to ensure that the minimum set of subnet(s) has been configured in the domain", "recommendation": "Locate the IP address which was found as not being part of declared subnet, then add this subnet to the \"Active Directory Sites\" tool. If you have found IPv6 addresses and it was not expected, you should disable the IPv6 protocol on the network card.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-AuditDC", "title": "The audit policy on domain controllers does not collect key events.", "description": "The purpose is to ensure that the audit policy on domain controllers collects the right set of events.", "recommendation": "Identify the Audit settings to apply and fix them. Be aware that there are two places for audit settings. For \"Simple\" audit configuration: in Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies For \"Advanced\" audit configuration: in Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration Also be sure that the audit GPO is applied to all domain controllers, as the underlying object may be in a OU where the GPO is not applied.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-MinPwdLen", "title": "Policy where the password length is less than 8 characters: 1", "description": "The purpose is to verify if the password policy of the domain enforces users to have at least 8 characters in their password", "recommendation": "To solve the issue, the best way is to either remove the GPO enabling short password, or to modify it in order to increase the password length to at least 8 characters", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-DC-Spooler", "title": "The spooler service is remotely accessible from 1 DC", "description": "The purpose is to ensure that credentials cannot be extracted from the DC via its Print Spooler service", "recommendation": "The Print Spooler service should be deactivated on domain controllers. Please note as a consequence that the Printer Pruning functionality (rarely used) will be unavailable.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-HardenedPaths", "title": "Hardened Paths have been modified to lower the security level", "description": "The purpose is to ensure that there is no weakness related to hardened paths", "recommendation": "You have to edit the Hardened Path section in the GPO. This section is located in Computer Configuration/Policies/Administrative Templates/Network/Network Provider. Check each value reported here and make sure that entries containing SYSVOL or NETLOGON have RequireIntegrity and RequireMutualAuthentication set to 1. In addition to that, check entries having the pattern \\\\DCName\\* and apply the same solution.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-NotEnoughDC", "title": "The number of DCs is too small to provide redundancy: 1 DC", "description": "The purpose is to ensure the failure of one domain controller will not stop the domain.", "recommendation": "Increase the number of domain controllers by installing new ones.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-PreWin2000Other", "title": "At least one user, computer or group has been added as a member to the PreWin2000 compatible group", "description": "The purpose is checking that no additional account has been added to the \"Pre-Windows 2000 Compatible Access\" group", "recommendation": "Remove the members from the PreWin2000 group while making sure that the group \"Authenticated Users\" is present. Then reboot each DC.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-WeakRSARootCert2", "title": "At least one trusted certificate found has a relatively weak RSA key [1]", "description": "The purpose is to ensure that there is no use of a certificate using a relatively weak RSA key", "recommendation": "To solve the matter, the certificate should be removed from the GPO and if needed, certificates depending on it should be reissued. Please note that this rule is the companion of the rule A-WeakRSARootCert which checks for unsecured certificates (key lower than 1024 bits).", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-PwdNeverExpires", "title": "Number of accounts which have never expiring passwords: 15", "description": "The purpose is to ensure that every account has a password which is compliant with password expiration policies", "recommendation": "In order to make Active Directory enforce periodic password change, accounts must not have the \"Password never expires\" flag set in the \"Account\" tab of the user properties. Their passwords should then be rolled immediately. For service accounts, Windows provides the \"managed service accounts\" and \"group managed service accounts\" features to facilitate the automatic change of passwords. Please note that there is a document in the section below which references solutions for service accounts of well known products. Also Linux servers should be configured with automatic machine account change.", "severity": "low", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "SI000020", "title": "Protected Users group not in use", "description": "This indicator checks if privileged users are in the Protected Users security group.", "recommendation": "Ensure that all privileged users are members of the Protected Users group. If using a pre 2012-R2 schema, then the protected users group does not exist. This is an exposure, but the remediation is to upgrade the schema.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "SI000029", "title": "Users with Password Never Expires flag set", "description": "This indicator identifies user accounts where the Password Never Expires flag is set. These accounts can be targets for brute force password attacks, given that their passwords may not be strong when they were set. These accounts also tend to be service accounts with privileged access to applications and services, including Kerberos-based services.", "recommendation": "

Move any user accounts away from Password Never Expires by having a good password rotation scheme and ensure any accounts that require this flag have the least privileges required. If this is a service account, considering using Group Managed Service Accounts (gMSA).

", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "purple-knight" }, { "id": "P-UnprotectedOU", "title": "OU without the accidental deletion protection have been found", "description": "The purpose is to ensure that Organizational Units (OUs) and Containers in Active Directory are protected to prevent accidental deletion, which could lead to data loss and disruptions in the network infrastructure.", "recommendation": "To safeguard against accidental deletions, it is essential to enable the \"Protect object from accidental deletion\" option for critical OUs and Containers. When this option is enabled, it adds an additional layer of security, preventing unintended deletions. To implement this protection: * Open the Active Directory Users and Computers management console. * Locate the OU or Container that requires protection. * Right-click on the OU or Container, select \"Properties.\" * In the \"Object\" tab, check the \"Protect object from accidental deletion\" option. * Click \"Apply\" and then \"OK\" to save the changes. You can list unprotected OU using the PowerShell command: Get-ADOrganizationalUnit -filter {name -like \"*\"} -Properties ProtectedFromAccidentalDeletion | format-table Name,ProtectedFromAccidentalDeletion and protect them using the command: Get-ADOrganizationalUnit -filter {name -like \"*\"} -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true Note: only 10 will be listed below. Checkout the Delegations section for the complete list.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-RootDseAnonBinding", "title": "Anonymous Binding to the rootDse is enabled", "description": "The purpose is to ensure that Anonymous Binding on RootDse is not enabled", "recommendation": "Edit the attribute msDS-Other-Settings of the object CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration. Add a new line with the content: DenyUnauthenticatedBind=1", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-PreWin2000AuthenticatedUsers", "title": "The PreWin2000 compatible group contains \"Authenticated Users\"", "description": "The purpose is checking if the \"Pre-Windows 2000 Compatible Access\" group contains \"Authenticated Users\"", "recommendation": "Remove \"Authenticated Users\" from the PreWin2000 group.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-NoNetSessionHardening", "title": "No GPO has been found which implements NetCease", "description": "The purpose is to ensure that mitigations are in place against the Bloodhound tool", "recommendation": "If this mitigation is not part of the computer image, apply the following recommendations: Run the NetCease PowerShell script (referenced below) on a reference workstation. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit . In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Windows Settings folder. Right-click the Registry node, point to New, and select Registry Wizard. Select the reference workstation on which the desired registry settings exist, then click Next . Browse to HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity\\ and select the check box for “SrvsvcSessionInfo” from which you want to create a Registry preference item. Select the check box for a key only if you want to create a Registry item for the key rather than for a value within the key. Click Finish. The settings that you selected appear as preference items in the Registry Wizard Values collection", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-NoGPOLLMNR", "title": "No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly", "description": "The purpose is to ensure that local name resolution protocol (LLMNR) cannot be used to collect credentials by performing a network attack", "recommendation": "Enable the GPO Turn off multicast name resolution and check that no GPO overrides this setting. (if it is the case, the policy involved will be displayed below)", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-DsHeuristicsLDAPSecurity", "title": "DsHeuristics has not been set to enable the mitigation for CVE-2021-42291", "description": "The purpose is to identify domains having mitigation for CVE-2021-42291 not set to enabled", "recommendation": "The easiest and fastest way to correct this issue is to replace the 28th and 29th character of the DsHeuristics attribute . The value of LDAPAddAutZVerifications and LDAPOwnerModify should be set to 1. Open the procedure embedded into the KB5008383 to apply this mitigation and change the DsHeuristics value. Note: You have to pay attention that there are control characters at the 10th and 20th position to avoid undesired changes of the DsHeuristics attribute. Typically if the DsHeuristics is empty, the expected new value is 00000000010000000002000000011", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-DnsZoneAUCreateChild", "title": "Authenticated Users can create DNS records", "description": "The purpose is to check if Authenticated Users has the right to create DNS records", "recommendation": "As of today, this rule is considered \"informative\" because the default configuration where Authenticated Users can create DNS records is considered safe. The reason for this classification is that no exploitation of that vulnerability has been reported. The proposed enhancement is to replace the identity who has been granted the right to create DNS Records (permission CreateChild) from Authenticated Users to Domain Computers. To perform this change, you have to edit the permission of the DNSZone whose object is located in the container CN=MicrosoftDNS,DC=DomainDnsZones. It should be noticed that if there is a privilege escalation on a computer, an attacker can impersonate the computer account and bypass this mitigation. The best mitigation is to create the DNS records manually as part as the domain join process and to revoke the permission granted to Authenticated Users.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-DCLdapsProtocolAdvanced", "title": "At least one DC is using Tls1.0 or Tls1.1.", "description": "The purpose is to ensure that all DC are using the most advanced protocols when acting as server.", "recommendation": "Apply Windows updates and registry tweaks described in the documentation section to use Tls 1.2 and later.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-AuditPowershell", "title": "The PowerShell audit configuration is not fully enabled.", "description": "The purpose is to ensure that PowerShell logging is enabled.", "recommendation": "Go to Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell And enable \"Turn on Module logging\" and \"Turn on PowerShell Script Block logging\" We recommend to set \"*\" as the module list.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "A-NoServicePolicy", "title": "No password policy for service accounts found (MinimumPasswordLength>=20)", "description": "The purpose is to give information regarding a best practice for the Service Account password policy. Indeed, having a 20+ characters password for this account greatly helps reducing the risk of Kerberoasting attacks (offline cracking of the TGS tickets) Note: PSO (Password Settings Objects) will be visible only if the user, which collected the information, has the permission to view it.", "recommendation": "The recommended way to handle service accounts is to use \"Managed service accounts\" introduced since Windows Server 2008 R2 (search for \"msDS-ManagedServiceAccount\"). To solve the anomaly, you should implement a PSO or GPO password guarantying a 20+ length password.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-FolderOptions", "title": "Some script extensions, used in phishing, can be directly run by double clicking on it", "description": "The objective is to ensure scripts do not automatically execute upon opening by default.", "recommendation": "Navigate to Computer Configuration > Preferences > Control Panel Settings > Folder Options. Create a new File Type with the \"Replace\" action for the extension you wish to secure. In \"Configure class settings\", add a new \"open\" action with Notepad as the default application: C:\\Windows\\System32\\notepad.exe.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-DefenderASR", "title": "Not all possible Defender ASR mitigations are in Block or Warn mode", "description": "This rule confirms the activation of Defender ASR (Attack Surface Reduction) mitigations within a Group Policy Object (GPO).", "recommendation": "To apply an ASR mitigation, navigate to the GPO setting \"Configure Attack Surface Reduction rules\" found under Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus (formerly Windows Defender Antivirus) > Microsoft (Windows) Defender Exploit Guard > Attack Surface Reduction. Upon enabling this setting, select \"Set the state for each ASR rule\". Then, input the mitigation’s GUID as the Value name and assign 1 as the Value to enforce the rule in Block mode. Other configurable values include 2 for Audit mode and 6 for Warn mode. For instance, to block JavaScript or VBScript from executing downloaded executable content, use the GUID: d3e037e1-3eb8-44c8-a917-57927947596d. It is recommended to set Defender ASR rules as recommended in the article below. Prior to implementation, conduct an impact analysis to anticipate any potential disruptions, and utilize Audit mode to identify possible issues.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-KerberosArmoring", "title": "Verify Kerberos Armoring is enabled on clients and the domain functional level is at least Windows Server 2012", "description": "The purpose is to ensure that clients support Kerberos armoring when domain functional level is at least Windows Server 2012", "recommendation": "To enable Kerberos armoring for client, edit the GPO and go to Computer Configuration > Administrative Templates > System > Kerberos then enable the policy \"Kerberos client support for claims, compound authentication and Kerberos armoring\".", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-KerberosArmoringDC", "title": "Verify Kerberos Armoring is enabled on DCs and the domain functional level is at least Windows Server 2012", "description": "The purpose is to ensure that DC supports Kerberos armoring when functional level is at least Windows Server 2012", "recommendation": "To enable Kerberos armoring for domain controllers, edit the GPO and go to Computer Configuration > Administrative Templates > System > KDC then enable the policy \"KDC support for claims, compound authentication and Kerberos armoring\". The policy should be set to at least \"Supported\". The safest settings is \"Fail authentication requests when Kerberos armoring is not available\" but it should be enabled only if the clients support Kerberos armoring.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-FirewallScript", "title": "It is possible for scripts engine used by hackers to connect directly to the Internet", "description": "This rule verifies whether programs, such as script engines, are allowed to connect to the internet by default.", "recommendation": "1) Create Firewall Rules via GPO Configure the firewall rules under Computer Configuration / Policies / Windows Settings / Security Settings / Windows Defender Firewall with Advanced Security. Ensure the rules are applied on the Outbound side. Activate the rules. 2) Network Restrictions: We recommend setting the rules as active for the following IP address ranges to allow local network access: 0.0.0.0 to 9.255.255.255 11.0.0.0 to 126.255.255.255 128.0.0.1 to 172.15.255.255 172.32.0.0 to 192.167.255.255 192.169.0.0 to 255.255.255.255 Alternatively, you can choose to apply the rules to ALL IP addresses or add your internal proxy IP.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "S-TerminalServicesGPO", "title": "The GPO are not pushing recommended configuration for Terminal Services", "description": "This rule verifies the recommended configuration for Terminal Services.", "recommendation": "The Terminal Services configuration can be found in Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Session Host The details of this rule is located in Printer Redirection and Session Time Limits. PingCastle recommends to set the following Policy: Set time limit for disconnected sessions: 2h (aka MaxDisconnectionTime) Set time limit for active but idle Remote Desktop Services sessions: 8h (aka MaxIdleTime) Do not allow client printer redirection: Enabled (aka fDisableCpm) This rule is active if nothing is set or if the time limit is set to NEVER.", "severity": "info", "outcome": "fail", "resultType": "exposure_finding", "isIoe": true, "deviation": true, "tool": "pingcastle" }, { "id": "2.2.2", "title": "2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS' (DC only)", "description": "This policy setting allows other users on the network to connect to the computer and is required by various network protocols that include Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model\nPlus (COM+).\n\nThe recommended state for this setting on Domain Controllers is: Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to\nAdministrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Access this computer from the network\n```\n\n### Impact\n\nIf you remove the\nAccess this computer from the network user right on Domain Controllers for all users, no one will be able to log on to the domain or use network resources. If you remove this user right on Member Servers, users will not be able to connect to those servers through the network. Successful negotiation of IPsec connections requires that the initiating machine has this right, therefore if using IPsec, it is recommended that it is assigned to the\nAuthenticated Users group. If you have installed optional components such as ASP.NET or Internet Information\nServices (IIS), you may need to assign this user right to additional accounts that are required by those components. It is important to verify that authorized users are assigned this user right for the computers they need to access the network.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.17.1", "title": "2.3.17.1 Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled'", "description": "This policy setting controls the behavior of Admin Approval Mode for the built-in\nAdministrator account.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Admin Approval Mode for the Built-in Administrator account\n```\n\n### Impact\n\nThe built-in Administrator account uses Admin Approval Mode. Users that log on using the local Administrator account will be prompted for consent whenever a program requests an elevation in privilege, just like any other user would.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.17.2", "title": "2.3.17.2 Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop' or higher", "description": "This policy setting controls the behavior of the elevation prompt for administrators.\n\nThe recommended state for this setting is:\nPrompt for consent on the secure desktop. Configuring this setting to\nPrompt for credentials on the secure desktop also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nPrompt for consent on the secure desktop or\nPrompt for credentials on the secure desktop:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode\n```\n\n### Impact\n\nWhen an operation (including execution of a Windows binary) requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny.\nIf the user selects Permit, the operation continues with the user's highest available privilege.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.17.3", "title": "2.3.17.3 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests'", "description": "This policy setting controls the behavior of the elevation prompt for standard users.\n\nThe recommended state for this setting is:\nAutomatically deny elevation requests.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAutomatically deny elevation requests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Behavior of the elevation prompt for standard users\n```\n\n### Impact\n\nWhen an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls.\n\nNote:\n\nWith this setting configured as recommended, the default error message displayed when a user attempts to perform an operation or run a program requiring privilege elevation\n(without Administrator rights) is \"\nThis program will not run. This program is blocked by group policy. For more information, contact your system administrator.\n\n\" Some users who are not used to seeing this message may believe that the operation or program they attempted to run is specifically blocked by group policy, as that is what the message seems to imply. This message may therefore result in user questions as to why that specific operation/program is blocked, when in fact, the problem is that they need to perform the operation or run the program with an Administrative account (or \"Run as Administrator\" if it is already an Administrator account), and they are not doing that.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "5.1", "title": "5.1 Ensure 'Print Spooler (Spooler)' is set to 'Disabled' (DC only)", "description": "This service spools print jobs and handles interaction with printers.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to:\nDisabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\System Services\\Print Spooler\n```\n\n### Impact\n\nDomain Controllers will not be able to prune published printers from Active Directory.\nBy default, Domain Controllers prune printer objects from Active Directory if the computer that published them doesn't respond to contact requests.\n\nDomain Controllers will not be able to act as a print server, sharing printers for clients.\n\nApplications on and users logged in at Domain Controllers will not be able to print, including printing to files (such as Adobe Portable Document Format (PDF)) which uses the Print Spooler service.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.1", "title": "9.1.1 Ensure 'Windows Firewall: Domain: Firewall state' is set to 'On (recommended)'", "description": "This policy setting controls whether the built-in Domain Firewall state is enabled or disabled.\n\nThe recommended state for this setting is:\nOn (recommended).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nOn (recommended):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Firewall state\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.2", "title": "9.1.2 Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)'", "description": "This policy setting determines the behavior for inbound connections that do not match an inbound firewall rule.\n\nThe recommended state for this setting is:\nBlock (default).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nBlock (default):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Inbound connections\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.3", "title": "9.1.3 Ensure 'Windows Firewall: Domain: Settings: Display a notification' is set to 'No'", "description": "Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.\n\nThe recommended state for this setting is:\nNo.\n\nNote:\n\nWhen the\nApply local firewall rules setting is configured to\nNo, it's recommended to also configure the\nDisplay a notification setting to No. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nNo:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Settings Customize\\Display a notification\n```\n\n### Impact\n\nWindows Firewall will not display a notification when a program is blocked from receiving inbound connections.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.4", "title": "9.1.4 Ensure 'Windows Firewall: Domain: Logging: Name' is configured", "description": "This policy setting is used to specify the path and name of the file in which Windows\nFirewall will write its log information.\n\nThe recommended state for this setting is: configured.\n\nExample: %SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n\\.log:\n\nWhere\n is the location and\n is the log name specified by the organization.\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Logging Customize\\Name\n```\n\n### Impact\n\nThe log file will be stored in the location and file specified by the organization.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.5", "title": "9.1.5 Ensure 'Windows Firewall: Domain: Logging: Size limit (KB)' is set to '16,384 KB or greater'", "description": "Use this option to specify the size limit of the file in which Windows Firewall will write its log information.\n\nThe recommended state for this setting is:\n16,384 KB or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n16,384 KB or greater:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Logging Customize\\Size limit (KB)\n```\n\n### Impact\n\nThe log file size will be limited to the specified size, old events will be overwritten by newer ones when the limit is reached.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.6", "title": "9.1.6 Ensure 'Windows Firewall: Domain: Logging: Log dropped packets' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word\nDROP in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Logging Customize\\Log dropped packets\n```\n\n### Impact\n\nInformation about dropped packets will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.1.7", "title": "9.1.7 Ensure 'Windows Firewall: Domain: Logging: Log successful connections' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word\nALLOW in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Domain Profile\\Logging Customize\\Log successful connections\n```\n\n### Impact\n\nInformation about successful connections will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.1", "title": "9.2.1 Ensure 'Windows Firewall: Private: Firewall state' is set to 'On (recommended)'", "description": "This policy setting controls whether the built-in Private Firewall state is enabled or disabled.\n\nThe recommended state for this setting is:\nOn (recommended).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nOn (recommended):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Firewall state\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.2", "title": "9.2.2 Ensure 'Windows Firewall: Private: Inbound connections' is set to 'Block (default)'", "description": "This policy setting determines the behavior for inbound connections that do not match an inbound firewall rule.\n\nThe recommended state for this setting is:\nBlock (default).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nBlock (default):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Inbound connections\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.5", "title": "2.2.5 Ensure 'Add workstations to domain' is set to 'Administrators' (DC only)", "description": "This policy setting specifies which users can add computer workstations to the domain.\nFor this policy setting to take effect, it must be assigned to the user as part of the Default Domain Controller Policy for the domain. A user who has been assigned this right can add up to 10 workstations to the domain. Users who have been assigned the\nCreate Computer Objects permission for an OU or the Computers container in Active Directory can add an unlimited number of computers to the domain, regardless of whether or not they have been assigned the Add workstations to domain user right.\n\nIn Windows-based networks, the term security principal is defined as a user, group, or computer that is automatically assigned a security identifier to control access to resources. In an Active Directory domain, each computer account is a full security principal with the ability to authenticate and access domain resources. However, some organizations may want to limit the number of computers in an Active Directory environment so that they can consistently track, build, and manage the computers. If users are allowed to add computers to the domain, tracking and management efforts would be hampered.\nAlso, users could perform activities that are more difficult to trace because of their ability to create additional unauthorized domain computers.\n\nThe recommended state for this setting is:\nAdministrators.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Add workstations to domain\n```\n\n### Impact\n\nFor organizations that have never allowed users to set up their own computers and add them to the domain, this countermeasure will have no impact. For those that have allowed some or all users to configure their own computers, this countermeasure will force the organization to establish a formal process for these procedures going forward.\nIt will not affect existing domain computers unless they are removed from and re-added to the domain.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.3", "title": "9.2.3 Ensure 'Windows Firewall: Private: Settings: Display a notification' is set to 'No'", "description": "Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.\n\nThe recommended state for this setting is:\nNo.\n\nNote:\n\nWhen the\nApply local firewall rules setting is configured to\nNo, it's recommended to also configure the\nDisplay a notification setting to\nNo. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nNo:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Settings Customize\\Display a notification\n```\n\n### Impact\n\nWindows Firewall will not display a notification when a program is blocked from receiving inbound connections.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.4", "title": "9.2.4 Ensure 'Windows Firewall: Private: Logging: Name' is configured", "description": "This policy setting is used to specify the path and name of the file in which Windows\nFirewall will write its log information.\n\nThe recommended state for this setting is: configured.\n\nExample: %SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n\\.log:\n\nWhere\n is the location and\n is the log name specified by the organization.\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Logging Customize\\Name\n```\n\n### Impact\n\nThe log file will be stored in the location and file specified by the organization.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.5", "title": "9.2.5 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater'", "description": "Use this option to specify the size limit of the file in which Windows Firewall will write its log information.\n\nThe recommended state for this setting is:\n16,384 KB or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n16,384 KB or greater:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Logging Customize\\Size limit (KB)\n```\n\n### Impact\n\nThe log file size will be limited to the specified size, old events will be overwritten by newer ones when the limit is reached.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.6", "title": "9.2.6 Ensure 'Windows Firewall: Private: Logging: Log dropped packets' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word\nDROP in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Logging Customize\\Log dropped packets\n```\n\n### Impact\n\nInformation about dropped packets will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.2.7", "title": "9.2.7 Ensure 'Windows Firewall: Private: Logging: Log successful connections' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word\nALLOW in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Private Profile\\Logging Customize\\Log successful connections\n```\n\n### Impact\n\nInformation about successful connections will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.1", "title": "9.3.1 Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)'", "description": "This policy setting controls whether the built-in Public Firewall state is enabled or disabled.\n\nThe recommended state for this setting is:\nOn (recommended).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nOn (recommended):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Firewall state\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.2", "title": "9.3.2 Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)'", "description": "This setting determines the behavior for inbound connections that do not match an inbound firewall rule.\n\nThe recommended state for this setting is:\nBlock (default).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nBlock (default):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Inbound connections\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.3", "title": "9.3.3 Ensure 'Windows Firewall: Public: Settings: Display a notification' is set to 'No'", "description": "Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.\n\nThe recommended state for this setting is:\nNo.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to 'No':\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Settings Customize\\Display a notification\n```\n\n### Impact\n\nWindows Firewall will not display a notification when a program is blocked from receiving inbound connections.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.4", "title": "9.3.4 Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'", "description": "This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy.\n\nThe recommended state for this setting is:\nNo.\n\nNote:\n\nWhen the\nApply local firewall rules setting is configured to\nNo, it's recommended to also configure the\nDisplay a notification setting to\nNo. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nNo:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Settings Customize\\Apply local firewall rules\n```\n\n### Impact\n\nAdministrators can still create firewall rules, but the rules will not be applied.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.5", "title": "9.3.5 Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No'", "description": "This setting controls whether local administrators are allowed to create connection security rules that apply together with connection security rules configured by Group\nPolicy.\n\nThe recommended state for this setting is:\nNo.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nNo:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Settings Customize\\Apply local connection security rules\n```\n\n### Impact\n\nAdministrators can still create local connection security rules, but the rules will not be applied.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.6", "title": "9.3.6 Ensure 'Windows Firewall: Public: Logging: Name' is configured", "description": "This policy setting is used to specify the path and name of the file in which Windows\nFirewall will write its log information.\n\nThe recommended state for this setting is: configured.\n\nExample: %SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n\\.log:\n\nWhere\n is the location and\n is the log name specified by the organization.\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Logging Customize\\Name\n```\n\n### Impact\n\nThe log file will be stored in the location and file specified by the organization.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.7", "title": "9.3.7 Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater'", "description": "Use this option to specify the size limit of the file in which Windows Firewall will write its log information.\n\nThe recommended state for this setting is:\n16,384 KB or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n16,384 KB or greater:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Logging Customize\\Size limit (KB)\n```\n\n### Impact\n\nThe log file size will be limited to the specified size, old events will be overwritten by newer ones when the limit is reached.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.8", "title": "9.3.8 Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word\nDROP in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Logging Customize\\Log dropped packets\n```\n\n### Impact\n\nInformation about dropped packets will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "9.3.9", "title": "9.3.9 Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'", "description": "Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word\nALLOW in the action column of the log.\n\nThe recommended state for this setting is:\nYes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nYes:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall with Advanced Security\\Windows Defender Firewall Properties\\Public Profile\\Logging Customize\\Log successful connections\n```\n\n### Impact\n\nInformation about successful connections will be recorded in the firewall log file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.1.1", "title": "17.1.1 Ensure 'Audit Credential Validation' is set to 'Success and Failure'", "description": "This subcategory reports the results of validation tests on credentials submitted for a user account logon request. These events occur on the computer that is authoritative for the credentials. For domain accounts, the Domain Controller is authoritative, whereas for local accounts, the local computer is authoritative. In domain environments, most of the Account Logon events occur in the Security log of the Domain Controllers that are authoritative for the domain accounts. However, these events can occur on other computers in the organization when local accounts are used to log on. Events for this subcategory include:\n\n- 4774: An account was mapped for logon.\n\n- 4775: An account could not be mapped for logon.\n\n- 4776: The Domain Controller attempted to validate the credentials for an account.\n\n- 4777: The Domain Controller failed to validate the credentials for an account.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Logon\\Audit Credential Validation\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.1.2", "title": "17.1.2 Ensure 'Audit Kerberos Authentication Service' is set to 'Success and Failure' (DC Only)", "description": "This subcategory reports the results of events generated after a Kerberos authentication\nTGT request. Kerberos is a distributed authentication service that allows a client running on behalf of a user to prove its identity to a server without sending data across the network.\n\n- 4768: A Kerberos authentication ticket (TGT) was requested.\n\n- 4771: Kerberos pre-authentication failed.\n\n- 4772: A Kerberos authentication ticket request failed.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Logon\\Audit Kerberos Authentication Service\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.1.3", "title": "17.1.3 Ensure 'Audit Kerberos Service Ticket Operations' is set to 'Success and Failure' (DC Only)", "description": "This subcategory reports the results of events generated by Kerberos authentication ticket-granting ticket (TGT) requests. Kerberos Service Ticket requests (TGS requests) occur as part of service use and access requests by specific accounts. Auditing these events will record the IP address from which the account requested TGS, when TGS was requested, and which encryption type was used.\n\n- 4769: A Kerberos service ticket was requested.\n\n- 4770: A Kerberos service ticket was renewed.\n\n- 4773: A Kerberos service ticket request failed.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Logon\\Audit Kerberos Service Ticket Operations\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.2.1", "title": "17.2.1 Ensure 'Audit Application Group Management' is set to 'Success and Failure'", "description": "This policy setting allows you to audit events generated by changes to application groups such as the following:\n\n- Application group is created, changed, or deleted.\n\n- Member is added or removed from an application group.\n\nApplication groups are utilized by Windows Authorization Manager, which is a flexible framework created by Microsoft for integrating role-based access control (RBAC) into applications. More information on Windows Authorization Manager is available at\n[MSDN - Windows Authorization Manager](https://msdn.microsoft.com/en-us/library/bb897401.aspx).\n\nThe recommended state for this setting is:\nSuccess and Failure.\n\nNote:\n\nAlthough Microsoft \"\n[Deprecated](https://learn.microsoft.com/en-us/windows/whats-new/feature-lifecycle#terminology)\n\n\" Windows Authorization Manager (AzMan) in Windows Server 2012 and 2012 R2, this feature still exists in the OS (unimproved), and therefore should still be audited.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit Application Group Management\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.2.3", "title": "17.2.3 Ensure 'Audit Distribution Group Management' is set to include 'Success' (DC only)", "description": "This subcategory reports each event of distribution group management, such as when a distribution group is created, changed, or deleted or when a member is added to or removed from a distribution group. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of group accounts. Events for this subcategory include:\n\n- 4744: A security-disabled local group was created.\n\n- 4745: A security-disabled local group was changed.\n\n- 4746: A member was added to a security-disabled local group.\n\n- 4747: A member was removed from a security-disabled local group.\n\n- 4748: A security-disabled local group was deleted.\n\n- 4749: A security-disabled global group was created.\n\n- 4750: A security-disabled global group was changed.\n\n- 4751: A member was added to a security-disabled global group.\n\n- 4752: A member was removed from a security-disabled global group.\n\n- 4753: A security-disabled global group was deleted.\n\n- 4759: A security-disabled universal group was created.\n\n- 4760: A security-disabled universal group was changed.\n\n- 4761: A member was added to a security-disabled universal group.\n\n- 4762: A member was removed from a security-disabled universal group.\n\n- 4763: A security-disabled universal group was deleted.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit Distribution Group Management\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.7", "title": "2.2.7 Ensure 'Allow log on locally' is set to 'Administrators, ENTERPRISE DOMAIN CONTROLLERS' (DC only)", "description": "This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Services / Remote Desktop Services or IIS also require this user right.\n\nThe recommended state for this setting on Domain Controllers is: Administrators, ENTERPRISE DOMAIN CONTROLLERS.\n\nNote:\n\nThis user right should generally be restricted to the\nAdministrators group. Assign this user right to the\nBackup Operators group if your organization requires that they have this capability.\n\nNote #2:\n\nWhen a server is promoted to a Domain Controller\nENTERPRISE DOMAIN CONTROLLERS is granted this user right by default.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to\nAdministrators, ENTERPRISE DOMAIN CONTROLLERS:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Allow log on locally\n```\n\n### Impact\n\nIf you remove these default groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected by any changes that you make to the\nAllow log on locally user right.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.2.4", "title": "17.2.4 Ensure 'Audit Other Account Management Events' is set to include 'Success' (DC only)", "description": "This subcategory reports other account management events. Events for this subcategory include:\n\n- 4782: The password hash an account was accessed.\n\n- 4793: The Password Policy Checking API was called.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit Other Account Management Events\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.2.6", "title": "17.2.6 Ensure 'Audit User Account Management' is set to 'Success and Failure'", "description": "This subcategory reports each event of user account management, such as when a user account is created, changed, or deleted; a user account is renamed, disabled, or enabled; or a password is set or changed. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of user accounts. Events for this subcategory include:\n\n- 4720: A user account was created.\n\n- 4722: A user account was enabled.\n\n- 4723: An attempt was made to change an account's password.\n\n- 4724: An attempt was made to reset an account's password.\n\n- 4725: A user account was disabled.\n\n- 4726: A user account was deleted.\n\n- 4738: A user account was changed.\n\n- 4740: A user account was locked out.\n\n- 4765: SID History was added to an account.\n\n- 4766: An attempt to add SID History to an account failed.\n\n- 4767: A user account was unlocked.\n\n- 4780: The ACL was set on accounts which are members of administrators groups.\n\n- 4781: The name of an account was changed:\n\n- 4794: An attempt was made to set the Directory Services Restore Mode.\n\n- 5376: Credential Manager credentials were backed up.\n\n- 5377: Credential Manager credentials were restored from a backup.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.3.1", "title": "17.3.1 Ensure 'Audit PNP Activity' is set to include 'Success'", "description": "This policy setting allows you to audit when plug and play detects an external device.\n\nThe recommended state for this setting is to include:\nSuccess.\n\nNote:\n\nA Windows 10, Server 2016 or newer OS is required to access and set this value in\nGroup Policy.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Detailed Tracking\\Audit PNP Activity\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.3.2", "title": "17.3.2 Ensure 'Audit Process Creation' is set to include 'Success'", "description": "This subcategory reports the creation of a process and the name of the program or user that created it. Events for this subcategory include:\n\n- 4688: A new process has been created.\n\n- 4696: A primary token was assigned to process.\n\nRefer to Microsoft Knowledge Base article 947226:\n[Description of security events in Windows Vista and in Windows Server 2008](https://support.microsoft.com/en-us/kb/947226) for the most recent information about this setting.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Detailed Tracking\\Audit Process Creation\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.4.1", "title": "17.4.1 Ensure 'Audit Directory Service Access' is set to include 'Failure' (DC only)", "description": "This subcategory reports when an AD DS object is accessed. Only objects with SACLs cause audit events to be generated, and only when they are accessed in a manner that matches their SACL. These events are similar to the directory service access events in previous versions of Windows Server. This subcategory applies only to Domain Controllers.\nEvents for this subcategory include:\n\n- 4662: An operation was performed on an object.\n\nThe recommended state for this setting is to include:\nFailure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nFailure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Access\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.4.2", "title": "17.4.2 Ensure 'Audit Directory Service Changes' is set to include 'Success' (DC only)", "description": "This subcategory reports changes to objects in Active Directory Domain Services (AD\nDS). The types of changes that are reported are create, modify, move, and undelete operations that are performed on an object. DS Change auditing, where appropriate, indicates the old and new values of the changed properties of the objects that were changed. Only objects with SACLs cause audit events to be generated, and only when they are accessed in a manner that matches their SACL. Some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. This subcategory applies only to Domain Controllers. Events for this subcategory include:\n\n- 5136: A directory service object was modified.\n\n- 5137: A directory service object was created.\n\n- 5138: A directory service object was undeleted.\n\n- 5139: A directory service object was moved.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.5.1", "title": "17.5.1 Ensure 'Audit Account Lockout' is set to include 'Failure'", "description": "This subcategory reports when a user's account is locked out as a result of too many failed logon attempts. Events for this subcategory include:\n\n- 4625: An account failed to log on.\n\nThe recommended state for this setting is to include:\nFailure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nFailure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Logon/Logoff\\Audit Account Lockout\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.5.2", "title": "17.5.2 Ensure 'Audit Group Membership' is set to include 'Success'", "description": "This policy allows you to audit the group membership information in the user’s logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource.\n\nThe recommended state for this setting is to include:\nSuccess.\n\nNote:\n\nA Windows 10, Server 2016 or newer OS is required to access and set this value in\nGroup Policy.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Logon/Logoff\\Audit Group Membership\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.5.5", "title": "17.5.5 Ensure 'Audit Other Logon/Logoff Events' is set to 'Success and Failure'", "description": "This subcategory reports other logon/logoff-related events, such as Remote Desktop\nServices session disconnects and reconnects, using RunAs to run processes under a different account, and locking and unlocking a workstation. Events for this subcategory include:\n\n- 4649: A replay attack was detected.\n\n- 4778: A session was reconnected to a Window Station.\n\n- 4779: A session was disconnected from a Window Station.\n\n- 4800: The workstation was locked.\n\n- 4801: The workstation was unlocked.\n\n- 4802: The screen saver was invoked.\n\n- 4803: The screen saver was dismissed.\n\n- 5378: The requested credentials delegation was disallowed by policy.\n\n- 5632: A request was made to authenticate to a wireless network.\n\n- 5633: A request was made to authenticate to a wired network.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Logon/Logoff\\Audit Other Logon/Logoff Events\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.6.1", "title": "17.6.1 Ensure 'Audit Detailed File Share' is set to include 'Failure'", "description": "This subcategory allows you to audit attempts to access files and folders on a shared folder. Events for this subcategory include:\n\n- 5145: network share object was checked to see whether client can be granted desired access.\n\nThe recommended state for this setting is to include:\nFailure", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nFailure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Object Access\\Audit Detailed File Share\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.6.2", "title": "17.6.2 Ensure 'Audit File Share' is set to 'Success and Failure'", "description": "This policy setting allows you to audit attempts to access a shared folder.\n\nThe recommended state for this setting is:\nSuccess and Failure.\n\nNote:\n\nThere are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Object Access\\Audit File Share\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.6.3", "title": "17.6.3 Ensure 'Audit Other Object Access Events' is set to 'Success and Failure'", "description": "This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects.\n\nFor scheduler jobs, the following are audited:\n\n- Job created.\n\n- Job deleted.\n\n- Job enabled.\n\n- Job disabled.\n\n- Job updated.\n\nFor COM+ objects, the following are audited:\n\n- Catalog object added.\n\n- Catalog object updated.\n\n- Catalog object deleted.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Object Access\\Audit Other Object Access Events\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.6.4", "title": "17.6.4 Ensure 'Audit Removable Storage' is set to 'Success and Failure'", "description": "This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage.\n\nThe recommended state for this setting is:\nSuccess and Failure.\n\nNote:\n\nA Windows 8.0, Server 2012 (non-R2) or newer OS is required to access and set this value in Group Policy.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Object Access\\Audit Removable Storage\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.7.3", "title": "17.7.3 Ensure 'Audit Authorization Policy Change' is set to include 'Success'", "description": "This subcategory reports changes in authorization policy. Events for this subcategory include:\n\n- 4703: A user right was adjusted.\n\n- 4704: A user right was assigned.\n\n- 4705: A user right was removed.\n\n- 4670: Permissions on an object were changed.\n\n- 4911: Resource attributes of the object were changed.\n\n- 4913: Central Access Policy on the object was changed.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.11", "title": "2.2.11 Ensure 'Back up files and directories' is set to 'Administrators'", "description": "This policy setting allows users to circumvent file and directory permissions to back up the system. This user right is enabled only when an application (such as\nNTBACKUP) attempts to access a file or directory through the NTFS file system backup application programming interface (API). Otherwise, the assigned file and directory permissions apply.\n\nThe recommended state for this setting is:\nAdministrators.\n\nNote:\n\nThis user right is considered a \"sensitive privilege\" for the purposes of auditing.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators.\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Back up files and directories\n```\n\n### Impact\n\nChanges in the membership of the groups that have the\nBack up files and directories user right could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that authorized backup administrators are still able to perform backup operations.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.7.4", "title": "17.7.4 Ensure 'Audit MPSSVC Rule-Level Policy Change' is set to 'Success and Failure'", "description": "This subcategory determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe).\nEvents for this subcategory include:\n\n- 4944: The following policy was active when the Windows Firewall started.\n\n- 4945: A rule was listed when the Windows Firewall started.\n\n- 4946: A change has been made to Windows Firewall exception list. A rule was added.\n\n- 4947: A change has been made to Windows Firewall exception list. A rule was modified.\n\n- 4948: A change has been made to Windows Firewall exception list. A rule was deleted.\n\n- 4949: Windows Firewall settings were restored to the default values.\n\n- 4950: A Windows Firewall setting has changed.\n\n- 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall.\n\n- 4952: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.\n\n- 4953: A rule has been ignored by Windows Firewall because it could not parse the rule.\n\n- 4954: Windows Firewall Group Policy settings have changed. The new settings have been applied.\n\n- 4956: Windows Firewall has changed the active profile.\n\n- 4957: Windows Firewall did not apply the following rule.\n\n- 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.\n\nThe recommended state for this setting is:\nSuccess and Failure", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit MPSSVC Rule-Level Policy Change\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.7.5", "title": "17.7.5 Ensure 'Audit Other Policy Change Events' is set to include 'Failure'", "description": "This subcategory contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\n\n- 5063: A cryptographic provider operation was attempted.\n\n- 5064: A cryptographic context operation was attempted.\n\n- 5065: A cryptographic context modification was attempted.\n\n- 5066: A cryptographic function operation was attempted.\n\n- 5067: A cryptographic function modification was attempted.\n\n- 5068: A cryptographic function provider operation was attempted.\n\n- 5069: A cryptographic function property operation was attempted.\n\n- 5070: A cryptographic function property modification was attempted.\n\n- 6145: One or more errors occurred while processing security policy in the group policy objects.\n\nThe recommended state for this setting is to include:\nFailure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nFailure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Other Policy Change Events\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.8.1", "title": "17.8.1 Ensure 'Audit Sensitive Privilege Use' is set to 'Success'", "description": "This subcategory reports when a user account or service uses a sensitive privilege.\nA sensitive privilege includes the following user rights:\n\n- Act as part of the operating system\n\n- Back up files and directories\n\n- Create a token object\n\n- Debug programs\n\n- Enable computer and user accounts to be trusted for delegation\n\n- Generate security audits\n\n- Impersonate a client after authentication\n\n- Load and unload device drivers\n\n- Manage auditing and security log\n\n- Modify firmware environment values\n\n- Replace a process-level token\n\n- Restore files and directories\n\n- Take ownership of files or other objects\n\nAuditing this subcategory will create a high volume of events. Events for this subcategory include:\n\n- 4672: Special privileges assigned to new logon.\n\n- 4673: A privileged service was called.\n\n- 4674: An operation was attempted on a privileged object.\n\nThe recommended state for this setting is:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Privilege Use\\Audit Sensitive Privilege Use\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.9.1", "title": "17.9.1 Ensure 'Audit IPsec Driver' is set to 'Success and Failure'", "description": "This subcategory reports on the activities of the Internet Protocol security (IPsec) driver. Events for this subcategory include:\n\n- 4960: IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.\n\n- 4961: IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.\n\n- 4962: IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay.\n\n- 4963: IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.\n\n- 4965: IPsec received a packet from a remote computer with an incorrect Security Parameter\nIndex (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.\n\n- 5478: IPsec Services has started successfully.\n\n- 5479: IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.\n\n- 5480: IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security\nMonitor snap-in to diagnose the problem.\n\n- 5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started.\n\n- 5484: IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.\n\n- 5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the\nIP Security Monitor snap-in to diagnose the problem.\n\nThe recommended state for this setting is:\nSuccess and Failure.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nSuccess and Failure:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\System\\Audit IPsec Driver\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "17.9.4", "title": "17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success'", "description": "This subcategory reports the loading of extension code such as authentication packages by the security subsystem. Events for this subcategory include:\n\n- 4610: An authentication package has been loaded by the Local Security Authority.\n\n- 4611: A trusted logon process has been registered with the Local Security Authority.\n\n- 4614: A notification package has been loaded by the Security Account Manager.\n\n- 4622: A security package has been loaded by the Local Security Authority.\n\n- 4697: A service was installed in the system.\n\nThe recommended state for this setting is to include:\nSuccess.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nSuccess:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\System\\Audit Security System Extension\n```\n\n### Impact\n\nAdvanced audit logging will generate additional events when this feature is enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.1.1.1", "title": "18.1.1.1 Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'", "description": "Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Control Panel\\Personalization\\Prevent enabling lock screen camera\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nControlPanelDisplay.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.1.1.2", "title": "18.1.1.2 Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled'", "description": "Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Control Panel\\Personalization\\Prevent enabling lock screen slide show\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nControlPanelDisplay.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.12", "title": "2.2.12 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'", "description": "This policy setting determines which users and groups can change the time and date on the internal clock of the computers in your environment. Users who are assigned this user right can affect the appearance of event logs. When a computer's time setting is changed, logged events reflect the new time, not the actual time that the events occurred.\n\nThe recommended state for this setting is:\nAdministrators, LOCAL SERVICE.\n\nNote:\n\nDiscrepancies between the time on the local computer and on the Domain Controllers in your environment may cause problems for the Kerberos authentication protocol, which could make it impossible for users to log on to the domain or obtain authorization to access domain resources after they are logged on. Also, problems will occur when\nGroup Policy is applied to client computers if the system time is not synchronized with the Domain Controllers.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators, LOCAL SERVICE:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Change the system time\n```\n\n### Impact\n\nThere should be no impact, because time synchronization for most organizations should be fully automated for all computers that belong to the domain. Computers that do not belong to the domain should be configured to synchronize with an external source.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.1.2.2", "title": "18.1.2.2 Ensure 'Allow users to enable online speech recognition services' is set to 'Disabled'", "description": "This policy enables the automatic learning component of input personalization that includes speech, inking, and typing. Automatic learning enables the collection of speech and handwriting patterns, typing history, contacts, and recent calendar information.\nIt is required for the use of Cortana. Some of this collected information may be stored on the user's OneDrive, in the case of inking and typing; some of the information will be uploaded to Microsoft to personalize speech.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Control Panel\\Regional and Language Options\\Allow users to enable online speech recognition services\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nGlobalization.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nAllow input personalization. It was renamed to\nAllow users to enable online speech recognition services starting with the Windows 10 R1809 & Server 2019 Administrative Templates.\n\n### Impact\n\nAutomatic learning of speech, inking, and typing stops and users cannot change its value via PC Settings.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.1.3", "title": "18.1.3 Ensure 'Allow Online Tips' is set to 'Disabled'", "description": "This policy setting configures the retrieval of online tips and help for the Settings app.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Control Panel\\Allow Online Tips\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nControlPanel.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nSettings will not contact Microsoft content services to retrieve tips and help content.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.4.2", "title": "18.4.2 Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'", "description": "This setting configures the start type for the Server Message Block version 1 (SMBv1) client driver service (\nMRxSmb10), which is recommended to be disabled.\n\nThe recommended state for this setting is:\nEnabled: Disable driver (recommended).\n\nNote:\n\nDo not, under any circumstances, configure this overall setting as\nDisabled, as doing so will delete the underlying registry entry altogether, which will cause serious problems.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Disable driver (recommended):\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MS Security Guide\\Configure SMB v1 client driver\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nSecGuide.admx/adml) is required - it is available from Microsoft at\n[this link](https://www.microsoft.com/en-us/download/details.aspx?id=55319).\n\n### Impact\n\nSome legacy OSes (e.g. Windows XP, Server 2003 or older), applications and appliances may no longer be able to communicate with the system once SMBv1 is disabled. We recommend careful testing be performed to determine the impact prior to configuring this as a widespread control, and where possible, remediate any incompatibilities found with the vendor of the incompatible system. Microsoft is also maintaining a thorough (although not comprehensive) list of known SMBv1 incompatibilities at this link:\n[SMB1 Product Clearinghouse | Storage at Microsoft](https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/)", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.4.3", "title": "18.4.3 Ensure 'Configure SMB v1 server' is set to 'Disabled'", "description": "This setting configures the server-side processing of the Server Message Block version\n1 (SMBv1) protocol.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MS Security Guide\\Configure SMB v1 server\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nSecGuide.admx/adml) is required - it is available from Microsoft at\n[this link](https://www.microsoft.com/en-us/download/details.aspx?id=55319).\n\n### Impact\n\nSome legacy OSes (e.g. Windows XP, Server 2003 or older), applications and appliances may no longer be able to communicate with the system once SMBv1 is disabled. We recommend careful testing be performed to determine the impact prior to configuring this as a widespread control, and where possible, remediate any incompatibilities found with the vendor of the incompatible system. Microsoft is also maintaining a thorough (although not comprehensive) list of known SMBv1 incompatibilities at this link:\n[SMB1 Product Clearinghouse | Storage at Microsoft](https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/)", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.4.4", "title": "18.4.4 Ensure 'Enable Certificate Padding' is set to 'Enabled'", "description": "This policy setting configures whether the\n[WinVerifyTrust](https://learn.microsoft.com/en-us/windows/win32/api/wintrust/nf-wintrust-winverifytrust) function performs strict Windows Authenticode signature verification for Portable\nExecutable files (PE files). If enabled, PE files will be considered \"unsigned\" if\nWindows identifies content in them that does not conform to the Authenticode specification.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MS Security Guide\\Enable Certificate Padding\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nSecGuide.admx/adml) is required - it is available from Microsoft at\n[this link](https://www.microsoft.com/en-us/download/details.aspx?id=55319).\n\n### Impact\n\nMicrosoft recommends that installers are built to only extract content from validated portions of signed files. Some installers do not follow this guidance and therefore may be negatively impacted by this setting.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.4.6", "title": "18.4.6 Ensure 'NetBT NodeType configuration' is set to 'Enabled: P-node (recommended)'", "description": "This setting determines which method NetBIOS over TCP/IP (NetBT) uses to register and resolve names. The available methods are:\n\n- The B-node (broadcast) method only uses broadcasts.\n\n- The P-node (point-to-point) method only uses name queries to a name server (WINS).\n\n- The M-node (mixed) method broadcasts first, then queries a name server (WINS) if broadcast failed.\n\n- The H-node (hybrid) method queries a name server (WINS) first, then broadcasts if the query failed.\n\nThe recommended state for this setting is:\nEnabled: P-node (recommended)\n\n(point-to-point).\n\nNote:\n\nResolution through LMHOSTS or DNS follows these methods. If the\nNodeType registry value is present, it overrides any\nDhcpNodeType registry value. If neither\nNodeType nor DhcpNodeType is present, the computer uses B-node (broadcast) if there are no WINS servers configured for the network, or H-node (hybrid) if there is at least one WINS server configured.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: P-node (recommended):\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MS Security Guide\\NetBT NodeType configuration\n```\n\nNote:\n\nThis change does not take effect until the computer has been restarted.\n\nNote #2:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nSecGuide.admx/adml) is required - it is available from Microsoft at\n[this link](https://www.microsoft.com/en-us/download/details.aspx?id=55319). Please note that this setting is only available in the\nSecurity baseline (FINAL) for Windows 10 v1903 and Windows Server v1903\n\n(or newer) release of\nSecGuide.admx/adml, so if you previously downloaded this template, you may need to update it from a newer Microsoft baseline to get this new\nNetBT NodeType configuration setting.\n\n### Impact\n\nNetBIOS name resolution queries will require a defined and available WINS server for external NetBIOS name resolution. If a WINS server is not defined or not reachable, and the desired hostname is not defined in the local cache, local LMHOSTS or HOSTS files, NetBIOS name resolution will fail.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.1", "title": "18.5.1 Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon' is set to 'Disabled'", "description": "This setting is separate from the Welcome screen feature in Windows XP and Windows\nVista; if that feature is disabled, this setting is not disabled. If you configure a computer for automatic logon, anyone who can physically gain access to the computer can also gain access to everything that is on the computer, including any network or networks to which the computer is connected. Also, if you enable automatic logon, the password is stored in the registry in plaintext, and the specific registry key that stores this value is remotely readable by the Authenticated Users group.\n\nFor additional information, see Microsoft Knowledge Base article 324737:\n[How to turn on automatic logon in Windows](https://support.microsoft.com/en-us/kb/324737).\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (AutoAdminLogon) Enable Automatic Logon\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.2", "title": "18.5.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled'", "description": "IP source routing is a mechanism that allows the sender to determine the IP route that a datagram should follow through the network.\n\nThe recommended state for this setting is:\nEnabled: Highest protection, source routing is completely disabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Highest protection, source routing is completely disabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (DisableIPSourceRouting IPv6) IP source routing protection level\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nAll incoming source routed packets will be dropped.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.3", "title": "18.5.3 Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled'", "description": "IP source routing is a mechanism that allows the sender to determine the IP route that a datagram should take through the network. It is recommended to configure this setting to Not Defined for enterprise environments and to Highest Protection for high security environments to completely disable source routing.\n\nThe recommended state for this setting is:\nEnabled: Highest protection, source routing is completely disabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Highest protection, source routing is completely disabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (DisableIPSourceRouting) IP source routing protection level\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nAll incoming source routed packets will be dropped.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.4", "title": "18.5.4 Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'", "description": "Internet Control Message Protocol (ICMP) redirects cause the IPv4 stack to plumb host routes. These routes override the Open Shortest Path First (OSPF) generated routes.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nWhen Routing and Remote Access Service (RRAS) is configured as an autonomous system boundary router (ASBR), it does not correctly import connected interface subnet routes.\nInstead, this router injects host routes into the OSPF routes. However, the OSPF router cannot be used as an ASBR router, and when connected interface subnet routes are imported into OSPF the result is confusing routing tables with strange routing paths.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.5", "title": "18.5.5 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes'", "description": "This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet.\n\nThe recommended state for this setting is:\nEnabled: 300,000 or 5 minutes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 300,000 or 5 minutes:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nKeep-alive packets are not sent by default by Windows. However, some applications may configure the TCP stack flag that requests keep-alive packets. For such configurations, you can lower this value from the default setting of two hours to five minutes to disconnect inactive sessions more quickly.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.6", "title": "18.5.6 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'", "description": "NetBIOS over TCP/IP is a network protocol that among other things provides a way to easily resolve NetBIOS names that are registered on Windows-based systems to the IP addresses that are configured on those systems. This setting determines whether the computer releases its NetBIOS name when it receives a name-release request.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.7", "title": "18.5.7 Ensure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses' is set to 'Disabled'", "description": "This setting is used to enable or disable the Internet Router Discovery Protocol (IRDP), which allows the system to detect and configure default gateway addresses automatically as described in RFC 1256 on a per-interface basis.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nWindows will not automatically detect and configure default gateway addresses on the computer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.8", "title": "18.5.8 Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode' is set to 'Enabled'", "description": "The DLL search order can be configured to search for DLLs that are requested by running processes in one of two ways:\n\n- Search folders specified in the system path first, and then search the current working folder.\n\n- Search current working folder first, and then search the folders specified in the system path.\n\nWhen enabled, the registry value is set to 1. With a setting of 1, the system first searches the folders that are specified in the system path and then searches the current working folder. When disabled the registry value is set to 0 and the system first searches the current working folder and then searches the folders that are specified in the system path.\n\nApplications will be forced to search for DLLs in the system path first. For applications that require unique versions of these DLLs that are included with the application, this entry could cause performance or stability problems.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nMore information on how Safe DLL search mode works is available at this link:\n[Dynamic-Link Library Search Order - Windows applications | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (SafeDllSearchMode) Enable Safe DLL search mode\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.9", "title": "18.5.9 Ensure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'", "description": "This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted. The retransmission time-out is doubled with each successive retransmission on a connection. It is reset when responses resume. The base time-out value is dynamically determined by the measured round-trip time on the connection.\n\nThe recommended state for this setting is:\nEnabled: 3.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 3:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS:(TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nTCP starts a retransmission timer when each outbound segment is passed to the IP.\nIf no acknowledgment is received for the data in a given segment before the timer expires, then the segment is retransmitted up to three times.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.10", "title": "18.5.10 Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'", "description": "This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted. The retransmission time-out is doubled with each successive retransmission on a connection. It is reset when responses resume. The base time-out value is dynamically determined by the measured round-trip time on the connection.\n\nThe recommended state for this setting is:\nEnabled: 3.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 3:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS:(TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nTCP starts a retransmission timer when each outbound segment is passed to the IP.\nIf no acknowledgment is received for the data in a given segment before the timer expires, then the segment is retransmitted up to three times.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.5.11", "title": "18.5.11 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less'", "description": "This setting can generate a security audit in the Security event log when the log reaches a user-defined threshold.\n\nThe recommended state for this setting is:\nEnabled: 90% or less.\n\nNote:\n\nIf log settings are configured to Overwrite events as needed or Overwrite events older than x days, this event will not be generated.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 90% or less:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MSS (Legacy)\\MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nMSS-legacy.admx/adml) is required - it is available from this TechNet blog post:\n[The MSS settings – Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)\n\n### Impact\n\nAn audit event will be generated when the Security log reaches the 90% percent full threshold (or whatever lower value may be set) unless the log is configured to overwrite events as needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.4.1", "title": "18.6.4.1 Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled'", "description": "This policy setting determines if the DNS client will perform name resolution over\nMulticast DNS (mDNS). mDNS performs local network name and service discoveries without the need for central DNS.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\DNS Client\\Configure multicast DNS (mDNS) protocol\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDnsClient.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIn the event DNS is unavailable a system will be unable to request it from other systems on the same subnet.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.4.2", "title": "18.6.4.2 Ensure 'Configure NetBIOS settings' is set to 'Enabled: Disable NetBIOS name resolution on public networks'", "description": "This policy setting specifies if the Domain Name System (DNS) client will perform name resolution over Network Basic Input/Output System (NetBIOS). NetBIOS is a legacy name resolution method for internal Microsoft networking that predates the use of\nDNS for that purpose (pre–Active Directory). Some legacy applications still require the use of NetBIOS for full functionality.\n\nThe recommended state for this setting is:\nEnabled: Disable NetBIOS name resolution on public networks. Configuring this setting to\nEnabled: Disable NetBIOS name resolution also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Disable NetBIOS name resolution on public networks:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\DNS Client\\Configure NetBIOS settings\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDnsClient.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.4.3", "title": "18.6.4.3 Ensure 'Turn off default IPv6 DNS Servers' is set to 'Enabled'", "description": "This policy setting controls whether the DNS client will use the default IPv6 DNS server addresses provided by Windows.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\DNS Client\\Turn off default IPv6 DNS Servers\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDnsClient.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nDefault IPv6 DNS server addresses will not be utilized by Windows.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.4.4", "title": "18.6.4.4 Ensure 'Turn off multicast name resolution' is set to 'Enabled'", "description": "Link-Local Multicast Name Resolution (LLMNR) is a secondary name resolution protocol.\nWith LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration and provides name resolution in scenarios in which conventional DNS name resolution is not possible.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\DNS Client\\Turn off multicast name resolution\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDnsClient.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nIn the event DNS is unavailable a system will be unable to request it from other systems on the same subnet.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.5.1", "title": "18.6.5.1 Ensure 'Enable Font Providers' is set to 'Disabled'", "description": "This policy setting determines whether Windows is allowed to download fonts and font catalog data from an online font provider.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Fonts\\Enable Font Providers\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nGroupPolicy.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nWindows will not connect to an online font provider and will only enumerate locally-installed fonts.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.1", "title": "18.6.7.1 Ensure 'Audit client does not support encryption' is set to 'Enabled'", "description": "This policy setting determines whether the Server Message Block (SMB) server will log events when the SMB client doesn't support encryption.\n\nEnabling this will create event log entries in\nApplications and Services Logs\\Microsoft\\Windows\\SMBClient\\Audit, with Event ID\n31998.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Audit client does not support encryption\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll SMB traffic that is unencrypted will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.2", "title": "18.6.7.2 Ensure 'Audit client does not support signing' is set to 'Enabled'", "description": "This policy setting determines whether the Server Message Block (SMB) server will log events when the SMB client doesn't support signing.\n\nEnabling this will create event log entries in\nApplications and Services Logs\\Microsoft\\Windows\\SMBClient\\Audit, with Event ID\n31999.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Audit client does not support signing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll SMB traffic that is unsigned will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.3", "title": "18.6.7.3 Ensure 'Audit insecure guest logon' is set to 'Enabled'", "description": "This policy determines whether the Server Message Block (SMB) server will log events when the client is logged on as guest account.\n\nEnabling this will create event log entries in\nApplications and Service Logs\\Microsoft\\Windows\\SMBServer\\Security, with Event IDs\n3023,\n31017,\n31018, and\n31022.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Audit insecure guest logon\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll insecure guest logons will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.4", "title": "18.6.7.4 Ensure 'Enable authentication rate limiter' is set to 'Enabled'", "description": "This policy settings configures the Server Message Block (SMB) server authentication rate limiter. The authentication rate limiter is a feature of SMB that is designed to address brute force attacks.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThis setting should be used in conjunction with the setting\nSet authentication rate limiter delay (milliseconds).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Enable authentication rate limiter\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.5", "title": "18.6.7.5 Ensure 'Enable remote mailslots' is set to 'Disabled'", "description": "This policy settings controls whether the SMB server will use remote mailslots over the computer browser service. The remote mailslots protocol is an old, simple, unreliable, and insecure inter-process communication method.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Enable remote mailslots\n```\n\nNote:\n\nA reboot is required after the setting is applied.\n\nNote #2:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf the remote mailslots feature was in operation, it will no longer function.\n\nWarning:\n\nThis setting may interfere with Windows Clustering.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.6", "title": "18.6.7.6 Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1'", "description": "This policy settings controls the minimum version of Server Message Block (SMB) protocol that can be used on the system.\n\nThe recommended state for this setting is:\nEnabled: 3.1.1.\n\nNote:\n\nThis group policy setting does not prevent the use of SMBv1 if it is installed and enabled on the system. If the following recommendations are configured as prescribed in this benchmark, SMBv1 will be disabled on the system:\nConfigure SMB v1 client driver and\nConfigure SMB v1 server.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 3.1.1:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Mandate the minimum version of SMB\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf older legacy (unsupported) Windows OSes that do not support SMB v3.1.1 are present in the environment, this setting may affect backward compatibility with them. For example, Windows 8.1 and Windows Server 2012 R2 and older. This setting may also prevent third-party clients that do not support SMB v3.1.1 from connecting.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.7.7", "title": "18.6.7.7 Ensure 'Set authentication rate limiter delay (milliseconds)' is set to 'Enabled: 2000' or more", "description": "This policy settings configures the SMB server invalid authentication delay value in milliseconds.\n\nThe recommended state for this setting is:\nEnabled: 2000 or more.\n\nNote:\n\nThis setting should be used in conjunction with the setting\nEnable authentication rate limiter.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 2000 or more:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Server\\Set authentication rate limiter delay (milliseconds)\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanServer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - 2,000 milliseconds (2 seconds) is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.1", "title": "18.6.8.1 Ensure 'Audit insecure guest logon' is set to 'Enabled'", "description": "This policy determines whether the Server Message Block (SMB) client will log events when the client is logged on as guest account.\n\nEnabling this will create event log entries in\nApplications and Service Logs\\Microsoft\\Windows\\SMBClient\\Security, with Event IDs\n3023,\n31017,\n31018, and\n31022.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Audit insecure guest logon\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll insecure guest logons will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.2", "title": "18.6.8.2 Ensure 'Audit server does not support encryption' is set to 'Enabled'", "description": "This policy setting determines whether the Server Message Block (SMB) client will log events when the SMB server doesn't support encryption.\n\nEnabling this will create event log entries in\nApplications and Services Logs\\Microsoft\\Windows\\SMBServer\\Audit, with Event ID\n3021.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Audit server does not support encryption\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll SMB traffic that is unencrypted will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.3", "title": "18.6.8.3 Ensure 'Audit server does not support signing' is set to 'Enabled'", "description": "This policy setting determines whether the Server Message Block (SMB) client will log events when the SMB server doesn't support signing.\n\nEnabling this will create event log entries in\nApplications and Services Logs\\Microsoft\\Windows\\SMBServer\\Audit, with Event ID\n3022.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Audit server does not support signing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nAll SMB traffic that is unsigned will be logged as an event.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.4", "title": "18.6.8.4 Ensure 'Enable insecure guest logons' is set to 'Disabled'", "description": "This policy setting determines if the SMB client will allow insecure guest logons to an SMB server.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Enable insecure guest logons\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 10 Release 1511 Administrative Templates\n(or newer).\n\n### Impact\n\nThe SMB client will reject insecure guest logons. This was not originally the default behavior in older versions of Windows, but Microsoft changed the default behavior starting with Windows Server 2016 R1709:\n[Guest access in SMB2 disabled by default in Windows 10 and Windows Server 2016](https://support.microsoft.com/en-us/help/4046019/guest-access-in-smb2-disabled-by-default-in-windows-10-and-windows-ser)", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.5", "title": "18.6.8.5 Ensure 'Enable remote mailslots' is set to 'Disabled'", "description": "This policy settings controls whether the SMB client will use remote mailslots over\nMultiple UNC Provider (MUP). The remote mailslots protocol is an old, simple, unreliable, and insecure inter-process communication method.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Enable remote mailslots\n```\n\nNote:\n\nA reboot is required after the setting is applied.\n\nNote #2:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf the remote mailslots feature was in operation, it will no longer function.\n\nWarning:\n\nThis setting may interfere with Windows Clustering.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.6", "title": "18.6.8.6 Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1'", "description": "This policy settings controls the minimum version of Server Message Block (SMB) protocol that can be used on the system.\n\nThe recommended state for this setting is:\nEnabled: 3.1.1.\n\nNote:\n\nThis group policy setting does not prevent the use of SMBv1 if it is installed and enabled on the system. If the following recommendations are configured as prescribed in this benchmark, SMBv1 will be disabled on the system:\nConfigure SMB v1 client driver and\nConfigure SMB v1 server.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 3.1.1:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Mandate the minimum version of SMB\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf older legacy (unsupported) Windows OSes that do not support SMB v3.1.1 are present in the environment, this setting may affect backward compatibility with them. For example, Windows 8.1 and Windows Server 2012 R2 and older. This setting may also affect connecting to third-party devices and appliances that do not support SMB v3.1.1.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.8.7", "title": "18.6.8.7 Ensure 'Require Encryption' is set to 'Enabled'", "description": "This policy setting controls whether the SMB client will require encryption.\n\nThe recommended state for this setting is:\nEnabled.\n\nWarning:\n\nThe SMB server must support and have SMB encryption enabled (requires SMB v3.0 or later).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Lanman Workstation\\Require Encryption\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLanmanWorkstation.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf older legacy (unsupported) Windows OSes that do not support encryption are present in the environment, this setting may affect backward compatibility with them. For example, Windows 7 and Windows Server 2008 R2 and older. This setting may also affect connecting to third-party devices and appliances that do not support SMB v3.0.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.9.1", "title": "18.6.9.1 Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled'", "description": "This policy setting changes the operational behavior of the Mapper I/O network protocol driver.\n\nLLTDIO allows a computer to discover the topology of a network it's connected to.\nIt also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Link-Layer Topology Discovery\\Turn on Mapper I/O (LLTDIO) driver\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nLinkLayerTopologyDiscovery.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nSome real-time applications could have issues with short network disconnections. For more information visit:\n[Network disconnection after configuring the LLTDIO and RSPNDR group policy objects - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/network-disconnection-after-configuring-lltdio-rspndr-gpos).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.9.2", "title": "18.6.9.2 Ensure 'Turn on Responder (RSPNDR) driver' is set to 'Disabled'", "description": "This policy setting changes the operational behavior of the Responder network protocol driver.\n\nThe Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Link-Layer Topology Discovery\\Turn on Responder (RSPNDR) driver\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nLinkLayerTopologyDiscovery.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nSome real-time applications could have issues with short network disconnections. For more information visit:\n[Network disconnection after configuring the LLTDIO and RSPNDR group policy objects - Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/network-disconnection-after-configuring-lltdio-rspndr-gpos).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.10.2", "title": "18.6.10.2 Ensure 'Turn off Microsoft Peer-to-Peer Networking Services' is set to 'Enabled'", "description": "The Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPv6 address and port number. The protocol operates in the context of clouds. A cloud is a set of peer computers that can communicate with each other by using the same IPv6 scope.\n\nPeer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution and distributed processing.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Microsoft Peer-to-Peer Networking Services\\Turn off Microsoft Peer-to-Peer Networking Services\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nP2P-pnrp.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nMicrosoft Peer-to-Peer Networking Services are turned off in their entirety, and all applications dependent on them will stop working.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.11.2", "title": "18.6.11.2 Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled'", "description": "You can use this procedure to control a user's ability to install and configure a\nNetwork Bridge.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Network Connections\\Prohibit installation and configuration of Network Bridge on your DNS domain network\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nNetworkConnections.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers cannot create or configure a Network Bridge.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.11.3", "title": "18.6.11.3 Ensure 'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'", "description": "Although this \"legacy\" setting traditionally applied to the use of Internet Connection\nSharing (ICS) in Windows 2000, Windows XP & Server 2003, this setting now freshly applies to the Mobile Hotspot feature in Windows 10 & Server 2016.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Network Connections\\Prohibit use of Internet Connection Sharing on your DNS domain network\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nNetworkConnections.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nMobile Hotspot cannot be enabled or configured by Administrators and non-Administrators alike.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.11.4", "title": "18.6.11.4 Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled'", "description": "This policy setting determines whether to require domain users to elevate when setting a network's location.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Network Connections\\Require domain users to elevate when setting a network's location\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nNetworkConnections.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nDomain users must elevate when setting a network's location.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.14.1", "title": "18.6.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with \"Require Mutual Authentication\", \"Require Integrity\", and \"Require Privacy\" set for all NETLOGON and SYSVOL shares'", "description": "This policy setting configures secure access to Universal Naming Convention (UNC) paths. UNC paths identify network resources using a specific notation. These names consist of three parts: a host device name, a share name, and an optional file path.\n\nThe recommended state for this setting is:\nEnabled, with \"Require Mutual Authentication\", \"Require Integrity\", and \"Require Privacy\" set for all NETLOGON and SYSVOL shares.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled with the following paths configured, at a minimum:\n\n\\\\*\\NETLOGON RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1 \\\\*\\SYSVOL RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Network Provider\\Hardened UNC Paths\n```\n\nNote:\n\nThis Group Policy path does not exist by default. An additional Group Policy template\n(\nNetworkProvider.admx/adml) is required - it is included with the\n[MS15-011](https://technet.microsoft.com/library/security/MS15-011)\n\n/\n[MSKB 3000483](https://support.microsoft.com/en-us/kb/3000483) security update or with the Microsoft Windows 10 RTM (Release 1507) Administrative\nTemplates (or newer).\n\n### Impact\n\nWindows only allows access to the specified UNC paths after fulfilling additional security requirements.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.19.2.1", "title": "18.6.19.2.1 Disable IPv6 (Ensure TCPIP6 Parameter 'DisabledComponents' is set to '0xff (255)')", "description": "Internet Protocol version 6 (IPv6) is a set of protocols that computers use to exchange information over the Internet and over home and business networks. IPv6 allows for many more IP addresses to be assigned than IPv4 did. Older networking, hosts and operating systems may not support IPv6 natively.\n\nThe recommended state for this setting is:\nDisabledComponents - 0xff (255).", "recommendation": "To establish the recommended configuration, set the following Registry value to\n0xff (255) (DWORD):\n\n```\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\TCPIP6\\Parameters:DisabledComponents\n```\n\nNote:\n\nThis change does not take effect until the computer has been restarted.\n\nNote #2:\n\nAlthough Microsoft does not provide ADMX/ADML templates to configure this registry value, custom templates (\nConfigure-IPv6-Components-KB929852.ADMX/ADML) are provided in the CIS Benchmark Build Kit to facilitate its configuration. Be aware though that simply turning off (not configured) the group policy setting with the template will not \"undo\" the change once applied. Instead, the opposite setting must be applied to change the registry value to the opposite state.\n\n### Impact\n\nConnectivity to other systems using IPv6 will no longer operate, and software that depends on IPv6 will cease to function. Examples of Microsoft applications that may use IPv6 include: Remote Assistance, HomeGroup, DirectAccess, Windows Mail.\n\nThis registry change is documented in Microsoft Knowledge Base article 929852:\n[How to disable IPv6 or its components in Windows](https://support.microsoft.com/en-us/kb/929852).\n\nNote:\n\nThis registry change does not take effect until the next reboot.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.20.1", "title": "18.6.20.1 Ensure 'Configuration of wireless settings using Windows Connect Now' is set to 'Disabled'", "description": "This policy setting allows the configuration of wireless settings using Windows Connect\nNow (WCN). The WCN Registrar enables the discovery and configuration of devices over\nEthernet (UPnP) over in-band 802.11 Wi-Fi through the Windows Portable Device API\n(WPD) and via USB Flash drives. Additional options are available to allow discovery and configuration over a specific medium.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Windows Connect Now\\Configuration of wireless settings using Windows Connect Now\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsConnectNow.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nWCN operations are disabled over all media.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.20.2", "title": "18.6.20.2 Ensure 'Prohibit access of the Windows Connect Now wizards' is set to 'Enabled'", "description": "This policy setting prohibits access to Windows Connect Now (WCN) wizards.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Windows Connect Now\\Prohibit access of the Windows Connect Now wizards\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsConnectNow.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nThe WCN wizards are turned off and users have no access to any of the wizard tasks.\nAll the configuration related tasks including \"Set up a wireless router or access point\" and \"Add a wireless device\" are disabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.6.21.1", "title": "18.6.21.1 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet'", "description": "This policy setting prevents computers from establishing multiple simultaneous connections to either the Internet or to a Windows domain.\n\nThe recommended state for this setting is:\nEnabled: 3 = Prevent Wi-Fi when on Ethernet.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 3 = Prevent Wi-Fi when on Ethernet:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Network\\Windows Connection Manager\\Minimize the number of simultaneous connections to the Internet or a Windows Domain\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWCM.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates. It was updated with a new\nMinimize Policy Options sub-setting starting with the Windows 10 Release 1903 Administrative Templates.\n\n### Impact\n\nWhile connected to an Ethernet connection, Windows won't allow use of a WLAN (automatically or manually) until Ethernet is disconnected. However, if a cellular data connection is available, it will always stay connected for services that require it, but no Internet traffic will be routed over cellular if an Ethernet or WLAN connection is present.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.1", "title": "18.7.1 Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled'", "description": "This policy setting controls whether the Print Spooler service will accept client connections.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nThe Print Spooler service must be restarted for changes to this policy to take effect.\n\nWarning:\n\nAn exception to this recommendation must be made for print servers in order for them to function properly. Users will not be able to print to the server when client connections are disabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers:Allow Print Spooler to accept client connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting2.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nProvided that the Print Spooler service is not disabled, applications on and users logged in to servers will continue to be able to print from the server. However, the Print Spooler service will not accept client connections or allow users to share printers. Note that all printers that were already shared will continue to be shared.\n\nWarning:\n\nAn exception to this recommendation must be made for print servers in order for them to function properly. Users will not be able to print to the server when client connections are disabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.2", "title": "18.7.2 Ensure 'Configure Redirection Guard' is set to 'Enabled: Redirection Guard Enabled'", "description": "This policy setting determines whether Redirection Guard is enabled for the print spooler. Redirection Guard can prevent file redirections from being used within the print spooler.\n\nThe recommended state for this setting is:\nEnabled: Redirection Guard Enabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Redirection Guard Enabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure Redirection Guard\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nNone - this is default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.3", "title": "18.7.3 Ensure 'Configure RPC connection settings: Protocol to use for outgoing RPC connections' is set to 'Enabled: RPC over TCP'", "description": "This policy setting controls which protocol and protocol settings to use for outgoing\nRemote Procedure Call (RPC) connections to a remote print spooler.\n\nThe recommended state for this setting is:\nEnabled: RPC over TCP", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: RPC over TCP:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure RPC connection settings: Protocol to use for outgoing RPC connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nWarning:\n\nMany existing print configurations may be using the older named pipes protocol and therefore will cease to function.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.4", "title": "18.7.4 Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default'", "description": "This policy setting controls which protocol and protocol settings to use for outgoing\nRemote Procedure Call (RPC) connections to a remote print spooler.\n\nThe recommended state for this setting is:\nEnabled: Default", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Default:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure RPC connection settings: Use authentication for outgoing RPC connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nWarning:\n\nMany existing print configurations may be using the older named pipes protocol and therefore will cease to function.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.5", "title": "18.7.5 Ensure 'Configure RPC listener settings: Protocols to allow for incoming RPC connections' is set to 'Enabled: RPC over TCP'", "description": "This policy setting controls which protocols incoming Remote Procedure Call (RPC) connections to the print spooler are allowed to use.\n\nThe recommended state for this setting is:\nEnabled: RPC over TCP.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: RCP over TCP:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure RPC listener settings: Configure protocol options for incoming RPC connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nWarning:\n\nMany existing print configurations may be using the older named pipes protocol and therefore will cease to function.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.6", "title": "18.7.6 Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher", "description": "This policy setting controls which protocols incoming Remote Procedure Call (RPC) connections to the print spooler are allowed to use.\n\nThe recommended state for this setting is:\nEnabled: Negotiate or Enabled: Kerberos.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Negotiate or\nEnabled: Kerberos:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure RPC listener settings: Configure protocol options for incoming RPC connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nWarning:\n\nMany existing print configurations may be using the older named pipes protocol and therefore will cease to function.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.7", "title": "18.7.7 Ensure 'Configure RPC over TCP port' is set to 'Enabled: 0'", "description": "This policy setting controls which port is used for RPC over TCP for incoming connections to the print spooler and outgoing connections to remote print spoolers.\n\nThe recommended state for this setting is:\nEnabled: 0.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 0:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure RPC over TCP port\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nIf your current print environment is configured for a specific TCP port, this setting may require a firewall change (if applicable) for continued printing.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.8", "title": "18.7.8 Ensure 'Configure RPC packet level privacy setting for incoming connections' is set to 'Enabled'", "description": "This policy setting controls packet level privacy for Remote Procedure Call (RPC) incoming connections.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\MS Security Guide\\Configure RPC packet level privacy setting for incoming connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.9", "title": "18.7.9 Ensure 'Configure Windows protected print' is set to 'Enabled'", "description": "This policy setting controls whether Windows protected print is enabled on the system.\nWindows protected print uses the modern print platform and Windows protected print mode. Modern print is designed to work only with Mopria-certified printers. Mopria is a collection of printer manufacturers and software vendors that define standards for IPP printing and eSCL scanning.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nWindows protected print will not prohibit administrators or users from installing third-party print drivers through an installation package provided by the print device manufacturer.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Configure Windows protected print\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe use of use any printer which does not support Mopra will be prohibited. In addition, only Mopria-certified print drivers will continue to be deployed via Windows Update.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.10", "title": "18.7.10 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled'", "description": "This policy setting controls whether users who aren't Administrators can install print drivers on the system.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nOn August 10, 2021, Microsoft announced a\n[Point and Print Default Behavior Change](https://msrc-blog.microsoft.com/2021/08/10/point-and-print-default-behavior-change/) which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in\n[KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481)](https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Limits print driver installation to Administrators\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 10 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.11", "title": "18.7.11 Ensure 'Manage processing of Queue-specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles'", "description": "This policy setting manages how queue-specific files are processed during printer installation. At printer installation time, a vendor-supplied installation application can specify a set of files, of any type, to be associated with a particular print queue. The files are downloaded to each client that connects to the print server.\n\nThe recommended state for this setting is:\nEnabled: Limit Queue-specific files to Color profiles.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Limit Queue-specific files to Color profiles:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Manage processing of Queue-specific files\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nNone - this is default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.12", "title": "18.7.12 Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt'", "description": "This policy setting controls whether computers will show a warning and a security elevation prompt when users create a new printer connection using Point and Print.\n\nThe recommended state for this setting is:\nEnabled: Show warning and elevation prompt.\n\nNote:\n\nOn August 10, 2021, Microsoft announced a\n[Point and Print Default Behavior Change](https://msrc-blog.microsoft.com/2021/08/10/point-and-print-default-behavior-change/) which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in\n[KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481)](https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872). This change overrides all Point and Print Group Policy settings and ensures that only Administrators can install printer drivers from a print server using Point and\nPrint.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Show warning and elevation prompt:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Point and Print Restrictions: When installing drivers for a new connection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.13", "title": "18.7.13 Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt'", "description": "This policy setting controls whether computers will show a warning and a security elevation prompt when users are updating drivers for an existing connection using\nPoint and Print.\n\nThe recommended state for this setting is:\nEnabled: Show warning and elevation prompt.\n\nNote:\n\nOn August 10, 2021, Microsoft announced a\n[Point and Print Default Behavior Change](https://msrc-blog.microsoft.com/2021/08/10/point-and-print-default-behavior-change/) which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in\n[KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481)](https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872). This change overrides all Point and Print Group Policy settings and ensures that only Administrators can install printer drivers from a print server using Point and\nPrint.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Show warning and elevation prompt:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Point and Print Restrictions: When updating drivers for an existing connection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.14", "title": "18.7.14 Ensure 'Require IPPS for IPP printers' is set to 'Enabled'", "description": "This policy setting determines whether communication with printers using the Microsoft\nInternet Printing Protocol (IPP) Class Driver uses IPPS. IPPS uses TLS for secure communication.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Require IPPS for IPP printers\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIPP printers which use self-signed or locally issued certificates will be affected and may not function properly. Any attempts to install non-compliant IPP printers will fail and generate an event in the Application log.\n\nWarning:\n\nIt is recommended that all printers are assessed, and if they meet the requirements, then enable this policy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.15", "title": "18.7.15 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority' is set to 'Enabled: Checked'", "description": "This policy setting determines the TLS/SSL security policy (WINHTTP_OPTION_SECURITY_FLAGS) for printers using the Microsoft Internet Printing Protocol (IPP) Class Driver.\n\nThe recommended state for this setting is:\nEnabled: Checked.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Checked.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Set TLS/SSL security policy for IPP printers: Disallow invalid certificate authority\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe system enforces certificate validation and blocks printing whenever certificate errors are detected.\n\nWarning:\n\nIt is recommended that all printers are assessed, and if they meet the requirements, then enable this policy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.16", "title": "18.7.16 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow non-server certificates' is set to 'Enabled: Checked'", "description": "This policy setting determines the TLS/SSL security policy (WINHTTP_OPTION_SECURITY_FLAGS) for printers using the Microsoft Internet Printing Protocol (IPP) Class Driver.\n\nThe recommended state for this setting is:\nEnabled: Checked.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Checked.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Set TLS/SSL security policy for IPP printers: Disallow non-server certificates\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe system enforces certificate validation and blocks printing whenever certificate errors are detected.\n\nWarning:\n\nIt is recommended that all printers are assessed, and if they meet the requirements, then enable this policy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.17", "title": "18.7.17 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name' is set to 'Enabled: Checked'", "description": "This policy setting determines the TLS/SSL security policy (WINHTTP_OPTION_SECURITY_FLAGS) for printers using the Microsoft Internet Printing Protocol (IPP) Class Driver.\n\nThe recommended state for this setting is:\nEnabled: Checked.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Checked.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Set TLS/SSL security policy for IPP printers: Disallow invalid certificate common name\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe system enforces certificate validation and blocks printing whenever certificate errors are detected.\n\nWarning:\n\nIt is recommended that all printers are assessed, and if they meet the requirements, then enable this policy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.7.18", "title": "18.7.18 Ensure 'Set TLS/SSL security policy for IPP printers: Disallow invalid certificate date' is set to 'Enabled: Checked'", "description": "This policy setting determines the TLS/SSL security policy (WINHTTP_OPTION_SECURITY_FLAGS) for printers using the Microsoft Internet Printing Protocol (IPP) Class Driver.\n\nThe recommended state for this setting is:\nEnabled: Checked.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Checked.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Printers\\Set TLS/SSL security policy for IPP printers: Disallow invalid certificate date\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nPrinting.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe system enforces certificate validation and blocks printing whenever certificate errors are detected.\n\nWarning:\n\nIt is recommended that all printers are assessed, and if they meet the requirements, then enable this policy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.8.1.1", "title": "18.8.1.1 Ensure 'Turn off notifications network usage' is set to 'Enabled'", "description": "This policy setting blocks applications from using the network to send notifications to update tiles, tile badges, toast, or raw notifications. This policy setting turns off the connection between Windows and the Windows Push Notification Service (WNS).\nThis policy setting also stops applications from being able to poll application services to update tiles.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Start Menu and Taskbar\\Turn off notifications network usage\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWPN.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nApplications and system features will not be able receive notifications from the network from WNS or via notification polling APIs.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.3.1", "title": "18.9.3.1 Ensure 'Include command line in process creation events' is set to 'Enabled'", "description": "This policy setting controls whether the process creation command line text is logged in security audit events when a new process has been created.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThis feature that this setting controls was not originally supported in server OSes older than Windows Server 2012 R2. However, in February 2015 Microsoft added support for the feature to Windows Server 2008 R2 and Windows Server 2012 (non-R2) via an update -\n[KB3004375](https://support.microsoft.com/en-us/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud). Therefore, this setting is also important to set on those older OSes.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAuditSettings.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nProcess command line information will be included in the event logs, which can contain sensitive or private information such as passwords or user data.\n\nWarning:\n\nThere are potential risks of capturing credentials and sensitive information which could be exposed to users who have read-access to event logs. Microsoft provides a feature called \"Protected Event Logging\" to better secure event log data. For assistance with protecting event logging, visit:\n[About Logging Windows - PowerShell | Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.2#protected-event-logging).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.4.1", "title": "18.9.4.1 Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients'", "description": "Some versions of the CredSSP protocol that is used by some applications (such as Remote\nDesktop Connection) are vulnerable to an encryption oracle attack against the client.\nThis policy controls compatibility with vulnerable clients and servers and allows you to set the level of protection desired for the encryption oracle vulnerability.\n\nThe recommended state for this setting is:\nEnabled: Force Updated Clients.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Force Updated Clients:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Credentials Delegation\\Encryption Oracle Remediation\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCredSsp.admx/adml that is included with the Microsoft Windows 10 Release 1803 Administrative Templates\n(or newer).\n\n### Impact\n\nClient applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. This setting should not be deployed until all remote hosts support the newest version, which is achieved by ensuring that all Microsoft security updates at least through May 2018 are installed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.4.2", "title": "18.9.4.2 Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled'", "description": "When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from threat actors on the remote host. The Restricted Admin Mode and Windows Defender Remote Credential\nGuard features are two options to help protect against this risk.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nMore detailed information on Windows Defender Remote Credential Guard and how it compares to Restricted Admin Mode can be found at this link:\n[Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10) | Microsoft Docs](https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guard)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Credentials Delegation\\Remote host allows delegation of non-exportable credentials\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCredSsp.admx/adml that is included with the Microsoft Windows 10 Release 1703 Administrative Templates\n(or newer).\n\n### Impact\n\nThe host will support the\nRestricted Admin Mode and\nWindows Defender Remote Credential Guard features.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.20", "title": "2.2.20 Ensure 'Deny access to this computer from the network' to include 'Guests' (DC only)", "description": "This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on a computer. Instead, file sharing should be accomplished through the use of network servers. This user right supersedes the\nAccess this computer from the network user right if an account is subject to both policies.\n\nThe recommended state for this setting on Domain Controllers is to include:\nGuests.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to include\nGuests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny access to this computer from the network\n```\n\n### Impact\n\nIf you configure the\nDeny access to this computer from the network user right for other groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should verify that delegated tasks will not be negatively affected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.7.2", "title": "18.9.7.2 Ensure 'Prevent automatic download of applications associated with device metadata' is set to 'Enabled'", "description": "This policy setting allows you to prevent Windows from retrieving device metadata from the Internet.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThis will not prevent the installation of basic hardware drivers, but does prevent associated third-party utility software from automatically being installed under the context of the\nSYSTEM account.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Device Installation\\Prevent automatic download of applications associated with device metadata\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDeviceInstallation.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates, or with the Group Policy template\nDeviceSetup.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nPrevent device metadata retrieval from the Internet. It was renamed to\nPrevent automatic download of applications associated with device metadata starting with the Windows 11 25H2 Administrative Templates.\n\n### Impact\n\nStandard users without administrator privileges will not be able to install associated third-party utility software for peripheral devices. This may limit the use of advanced features of those devices unless/until an administrator installs the associated utility software for the device.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.13.1", "title": "18.9.13.1 Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical'", "description": "This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver.\nThe Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:\n\n- Good: The driver has been signed and has not been tampered with.\n\n- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.\n\n- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.\n\n- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.\n\nIf you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.\n\nIf your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.\n\nThe recommended state for this setting is:\nEnabled: Good, unknown and bad but critical.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Good, unknown and bad but critical:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Early Launch Antimalware\\Boot-Start Driver Initialization Policy\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nEarlyLaunchAM.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.17.1", "title": "18.9.17.1 Ensure 'Enable / disable CLFS logfile authentication' is set to 'Enabled'", "description": "This policy setting configures Common Log File System (CLFS) logfile authentication.\nLogfile authentication provides the ability for the CLFS driver to detect malicious modifications made to logfiles.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Filesystem\\Enable / disable CLFS logfile authentication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nFileSys.admx/adml that is included with the Microsoft Windows 11 Release 25H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.\n\nWarning:\n\nLogfiles that were created on other systems will fail to open as these contain authentication codes created using a system-unique cryptographic key. To open a logfile that was created on another system an administrator must first use the fsutil.exe clfs authenticate command to correct the authentication codes.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.19.2", "title": "18.9.19.2 Ensure 'Configure security policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE'", "description": "The \"Do not apply during periodic background processing\" option prevents the system from updating affected security policies in the background while the computer is in use. When background updates are disabled, updates to security policies will not take effect until the next user logon or system restart.\n\nThis setting affects all policy settings that use the built-in security template of\nGroup Policy (e.g. Windows Settings\\Security Settings).\n\nThe recommended state for this setting is:\nEnabled: FALSE\n\n(unchecked).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled, then set the\nDo not apply during periodic background processing option to\nFALSE\n\n(unchecked):\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Group Policy\\Configure security policy processing\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nGroupPolicy.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nBuilt-in security template settings will be reapplied by Group Policy even when the system is in use, which may have a slight impact on performance.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.19.3", "title": "18.9.19.3 Ensure 'Configure security policy processing: Process even if the Group Policy objects have not changed' is set to 'Enabled: TRUE'", "description": "The \"Process even if the Group Policy objects have not changed\" option updates and reapplies security policies even if the security policies have not changed.\n\nThis setting affects all policy settings within the built-in security template of\nGroup Policy (e.g. Windows Settings\\Security Settings).\n\nThe recommended state for this setting is:\nEnabled: TRUE\n\n(checked).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled, then set the\nProcess even if the Group Policy objects have not changed option to\nTRUE\n\n(checked):\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Group Policy\\Configure security policy processing\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nGroupPolicy.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nBuilt-in security template settings will be reapplied even if they have not been changed, which may cause Group Policy refreshes to take longer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.19.4", "title": "18.9.19.4 Ensure 'Continue experiences on this device' is set to 'Disabled'", "description": "This policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences).\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Group Policy\\Continue experiences on this device\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nGroupPolicy.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nThe Windows device will not be discoverable by other devices, and cannot participate in cross-device experiences.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.1", "title": "18.9.20.1.1 Ensure 'Turn off downloading of print drivers over HTTP' is set to 'Enabled'", "description": "This policy setting controls whether the computer can download print driver packages over HTTP. To set up HTTP printing, printer drivers that are not available in the standard operating system installation might need to be downloaded over HTTP.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off downloading of print drivers over HTTP\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nPrint drivers cannot be downloaded over HTTP.\n\nNote:\n\nThis policy setting does not prevent the client computer from printing to printers on the intranet or the Internet over HTTP. It only prohibits downloading drivers that are not already installed locally.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.2", "title": "18.9.20.1.2 Ensure 'Turn off handwriting personalization data sharing' is set to 'Enabled'", "description": "This setting turns off data sharing from the handwriting recognition personalization tool.\n\nThe handwriting recognition personalization tool enables Tablet PC users to adapt handwriting recognition to their own writing style by providing writing samples. The tool can optionally share user writing samples with Microsoft to improve handwriting recognition in future versions of Windows. The tool generates reports and transmits them to Microsoft over a secure connection.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off handwriting personalization data sharing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nShapeCollector.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nTablet PC users cannot choose to share writing samples from the handwriting recognition personalization tool with Microsoft.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.3", "title": "18.9.20.1.3 Ensure 'Turn off handwriting recognition error reporting' is set to 'Enabled'", "description": "Turns off the handwriting recognition error reporting tool.\n\nThe handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off handwriting recognition error reporting\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nInkWatson.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers cannot start the handwriting recognition error reporting tool or send error reports to Microsoft.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.22", "title": "2.2.22 Ensure 'Deny log on as a batch job' to include 'Guests'", "description": "This policy setting determines which accounts will not be able to log on to the computer as a batch job. A batch job is not a batch (.bat) file, but rather a batch-queue facility.\nAccounts that use the Task Scheduler to schedule jobs need this user right.\n\nThis user right supersedes the\nLog on as a batch job user right, which could be used to allow accounts to schedule jobs that consume excessive system resources. Such an occurrence could cause a DoS condition. Failure to assign this user right to the recommended accounts can be a security risk.\n\nThe recommended state for this setting is to include:\nGuests.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nGuests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on as a batch job\n```\n\n### Impact\n\nIf you assign the\nDeny log on as a batch job user right to other accounts, you could deny users who are assigned to specific administrative roles the ability to perform their required job activities. You should confirm that delegated tasks will not be affected adversely.\n\nFor example, if you assign this user right to the\nIWAM_ (ComputerName) account, the MSM Management Point will fail. On a newly installed computer that runs\nWindows Server 2003 this account does not belong to the\nGuests group, but on a computer that was upgraded from Windows 2000 this account is a member of the\nGuests group. Therefore, it is important that you understand which accounts belong to any groups that you assign the\nDeny log on as a batch job user right.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.4", "title": "18.9.20.1.4 Ensure 'Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com' is set to 'Enabled'", "description": "This policy setting specifies whether the Internet Connection Wizard can connect to\nMicrosoft to download a list of Internet Service Providers (ISPs).\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe \"Choose a list of Internet Service Providers\" path in the Internet Connection\nWizard causes the wizard to exit. This prevents users from retrieving the list of\nISPs, which resides on Microsoft servers.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.5", "title": "18.9.20.1.5 Ensure 'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'", "description": "This policy setting controls whether Windows will download a list of providers for the Web publishing and online ordering wizards.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Internet download for Web publishing and online ordering wizards\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nWindows is prevented from downloading providers; only the service providers cached in the local registry are displayed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.6", "title": "18.9.20.1.6 Ensure 'Turn off printing over HTTP' is set to 'Enabled'", "description": "This policy setting allows you to disable the client computer's ability to print over\nHTTP, which allows the computer to print to printers on the intranet as well as the\nInternet.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThis control affects printing over both\n\nHTTP and HTTPS.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off printing over HTTP\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe client computer will not be able to print to Internet printers over HTTP or HTTPS.\n\nNote:\n\nThis policy setting affects the client side of Internet printing only. Regardless of how it is configured, a computer could act as an Internet Printing server and make its shared printers available through HTTP.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.7", "title": "18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled'", "description": "This policy setting specifies whether the Windows Registration Wizard connects to\nMicrosoft.com for online registration.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Registration if URL connection is referring to Microsoft.com\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers are blocked from connecting to Microsoft.com for online registration and they cannot register their copy of Windows online.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.8", "title": "18.9.20.1.8 Ensure 'Turn off Search Companion content file updates' is set to 'Enabled'", "description": "This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Search Companion content file updates\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nSearch Companion does not download content updates during searches.\n\nNote:\n\nInternet searches will still send the search text and information about the search to Microsoft and the chosen search provider. If you select Classic Search, the Search\nCompanion feature will be unavailable. You can select Classic Search by clicking Start,\nSearch, Change Preferences, and then Change Internet Search Behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.9", "title": "18.9.20.1.9 Ensure 'Turn off the \"Order Prints\" picture task' is set to 'Enabled'", "description": "This policy setting specifies whether the \"Order Prints Online\" task is available from Picture Tasks in Windows folders.\n\nThe Order Prints Online Wizard is used to download a list of providers and allow users to order prints online.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off the \"Order Prints\" picture task\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe task \"Order Prints Online\" is removed from Picture Tasks in File Explorer folders.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.10", "title": "18.9.20.1.10 Ensure 'Turn off the \"Publish to Web\" task for files and folders' is set to 'Enabled'", "description": "This policy setting specifies whether the tasks Publish this file to the Web, Publish this folder to the Web, and Publish the selected items to the Web are available from\nFile and Folder Tasks in Windows folders.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off the \"Publish to Web\" task for files and folders\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe \"Publish to Web\" task is removed from File and Folder tasks in Windows folders.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.11", "title": "18.9.20.1.11 Ensure 'Turn off the Windows Messenger Customer Experience Improvement Program' is set to 'Enabled'", "description": "This policy setting specifies whether Windows Messenger can collect anonymous information about how the Windows Messenger software and service is used. Microsoft uses information collected through the Customer Experience Improvement Program to detect software flaws so that they can be corrected more quickly, enabling this setting will reduce the amount of data Microsoft is able to gather for this purpose.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off the Windows Messenger Customer Experience Improvement Program\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nWindows Messenger will not collect usage information, and the user settings to enable the collection of usage information will not be shown.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.12", "title": "18.9.20.1.12 Ensure 'Turn off Windows Customer Experience Improvement Program' is set to 'Enabled'", "description": "This policy setting specifies whether the Windows Customer Experience Improvement\nProgram can collect anonymous information about how Windows is used.\n\nMicrosoft uses information collected through the Windows Customer Experience Improvement\nProgram to improve features that are most used and to detect flaws so that they can be corrected more quickly. Enabling this setting will reduce the amount of data Microsoft is able to gather for this purpose. The recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Windows Customer Experience Improvement Program\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nAll users are opted out of the Windows Customer Experience Improvement Program.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.20.1.13", "title": "18.9.20.1.13 Ensure 'Turn off Windows Error Reporting' is set to 'Enabled'", "description": "This policy setting controls whether or not errors are reported to Microsoft.\n\nError Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Internet Communication Management\\Internet Communication settings\\Turn off Windows Error Reporting\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers are not given the option to report errors to Microsoft.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.23", "title": "2.2.23 Ensure 'Deny log on as a service' to include 'Guests'", "description": "This security setting determines which service accounts are prevented from registering a process as a service. This user right supersedes the\nLog on as a service user right if an account is subject to both policies.\n\nThe recommended state for this setting is to include:\nGuests.\n\nNote:\n\nThis security setting does not apply to the\nSystem, Local Service, or Network Service accounts.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nGuests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on as a service\n```\n\n### Impact\n\nIf you assign the\nDeny log on as a service user right to specific accounts, services may not be able to start and a DoS condition could result.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.23.1", "title": "18.9.23.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic'", "description": "This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.\n\nSupport for device authentication using certificate will require connectivity to a\nDC in the device account domain which supports certificate authentication for computer accounts.\n\nThe recommended state for this setting is:\nEnabled: Automatic.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Automatic:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Kerberos\\Support device authentication using certificate\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nKerberos.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.24.1", "title": "18.9.24.1 Ensure 'Enumeration policy for external devices incompatible with Kernel DMA Protection' is set to 'Enabled: Block All'", "description": "This policy is intended to provide additional security against external DMA-capable devices. It allows for more control over the enumeration of external DMA-capable devices that are not compatible with DMA Remapping/device memory isolation and sandboxing.\n\nThe recommended state for this setting is:\nEnabled: Block All.\n\nNote: This policy does not apply to 1394, PCMCIA or ExpressCard devices. The protection also only applies to Windows 10 R1803 or higher, and also requires a UEFI BIOS to function.\n\nNote #2: More information on this feature is available at this link:\n[Kernel DMA Protection for Thunderbolt™ 3 (Windows 10) | Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Block All:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Kernel DMA Protection\\Enumeration policy for external devices incompatible with Kernel DMA Protection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDmaGuard.admx/adml that is included with the Microsoft Windows 10 Release 1809 & Server 2019 Administrative\nTemplates (or newer).\n\n### Impact\n\nExternal devices that are not compatible with DMA-remapping will not be enumerated and will not function unless/until the user has logged in successfully and has an unlocked user session. Once enumerated, these devices will continue to function, regardless of the state of the session. Devices that are compatible with DMA-remapping will be enumerated immediately, with their device memory isolated.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.27.1", "title": "18.9.27.1 Ensure 'Allow Custom SSPs and APs to be loaded into LSASS' is set to 'Disabled' (DC only)", "description": "This policy setting controls the configuration under which the Local Security Authority\nSubsystem Service (LSASS) will load custom Security Support Provider/Authentication\nPackage (SSP/AP).\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Local Security Authority\\Allow Custom SSPs and APs to be loaded into LSASS\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLocalSecurityAuthority.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nCustom Security Support Provider/Authentication Packages will not be permitted to load this may impact some legitimate third-party packages.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.28.1", "title": "18.9.28.1 Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled'", "description": "This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Locale Services\\Disallow copying of user input methods to the system account for sign-in\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nGlobalization.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nUsers will have input methods enabled for the system account on the sign-in page.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.29.1", "title": "18.9.29.1 Ensure 'Block user from showing account details on sign-in' is set to 'Enabled'", "description": "This policy prevents the user from showing account details (email address or user name) on the sign-in screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Logon\\Block user from showing account details on sign-in\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLogon.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nThe user cannot choose to show account details on the sign-in screen.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.29.2", "title": "18.9.29.2 Ensure 'Do not display network selection UI' is set to 'Enabled'", "description": "This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Logon\\Do not display network selection UI\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLogon.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe PC's network connectivity state cannot be changed without signing into Windows.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.29.3", "title": "18.9.29.3 Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled'", "description": "This policy setting prevents connected users from being enumerated on domain-joined computers.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Logon\\Do not enumerate connected users on domain-joined computers\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLogon.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nThe Logon UI will not enumerate any connected users on domain-joined computers.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.29.5", "title": "18.9.29.5 Ensure 'Turn off app notifications on the lock screen' is set to 'Enabled'", "description": "This policy setting allows you to prevent app notifications from appearing on the lock screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nLogon.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nNo app notifications are displayed on the lock screen.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.29.6", "title": "18.9.29.6 Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled'", "description": "This policy setting allows you to control whether a domain user can sign in using a convenience PIN. In Windows 10, convenience PIN was replaced with Passport, which has stronger security properties. To configure Passport for domain users, use the policies under Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft\nPassport for Work.\n\nNote:\n\nThe user's domain password will be cached in the system vault when using this feature.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Logon\\Turn on convenience PIN sign-in\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCredentialProviders.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nTurn on PIN sign-in, but it was renamed starting with the Windows 10 Release 1511 Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.31.1.1", "title": "18.9.31.1.1 Ensure 'Block NetBIOS-based discovery for domain controller location' is set to 'Enabled'", "description": "This policy setting determines whether the Domain Controller (DC) location algorithm uses NetBIOS-based discovery for the Domain Controller's location.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Net Logon\\DC Locator DNS Records\\Block NetBIOS-based discovery for domain controller location\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nNetlogon.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.24", "title": "2.2.24 Ensure 'Deny log on locally' to include 'Guests'", "description": "This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the\nAllow log on locally policy setting if an account is subject to both policies.\n\nThe recommended state for this setting is to include:\nGuests.\n\nImportant:\n\nIf you apply this security policy to the\nEveryone group, no one will be able to log on locally.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to include\nGuests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on locally\n```\n\n### Impact\n\nIf you assign the\nDeny log on locally user right to additional accounts, you could limit the abilities of users who are assigned to specific roles in your environment. However, this user right should explicitly be assigned to the\nASPNET account on computers that run IIS 6.0. You should confirm that delegated activities will not be adversely affected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.33.1", "title": "18.9.33.1 Ensure 'Allow Clipboard synchronization across devices' is set to 'Disabled'", "description": "This policy setting determines whether Clipboard contents can be synchronized across devices.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\OS Policies\\Allow Clipboard synchronization across devices\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nOSPolicy.admx/adml that is included with the Microsoft Windows 10 Release 1809 & Server 2019 Administrative\nTemplates (or newer).\n\n### Impact\n\nIf you disable this policy setting, Clipboard contents cannot be shared to other devices.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.33.2", "title": "18.9.33.2 Ensure 'Allow upload of User Activities' is set to 'Disabled'", "description": "This policy setting determines whether published User Activities can be uploaded to the cloud.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\OS Policies\\Allow upload of User Activities\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nOSPolicy.admx/adml that is included with the Microsoft Windows 10 Release 1803 Administrative Templates\n(or newer).\n\n### Impact\n\nActivities of type User Activity are not allowed to be uploaded to the cloud. The\nTimeline feature will not function across devices.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.35.6.1", "title": "18.9.35.6.1 Ensure 'Allow network connectivity during connected-standby (on battery)' is set to 'Disabled'", "description": "This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Power Management\\Sleep Settings\\Allow network connectivity during connected-standby (on battery)\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPower.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nNetwork connectivity in standby (while on battery) is not guaranteed. This connectivity restriction currently only applies to WLAN networks only, but is subject to change\n(according to Microsoft).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.35.6.2", "title": "18.9.35.6.2 Ensure 'Allow network connectivity during connected-standby (plugged in)' is set to 'Disabled'", "description": "This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Power Management\\Sleep Settings\\Allow network connectivity during connected-standby (plugged in)\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPower.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nNetwork connectivity in standby (while plugged in) is not guaranteed. This connectivity restriction currently only applies to WLAN networks only, but is subject to change\n(according to Microsoft).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.35.6.3", "title": "18.9.35.6.3 Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled'", "description": "Specifies whether or not the user is prompted for a password when the system resumes from sleep.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Power Management\\Sleep Settings\\Require a password when a computer wakes (on battery)\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPower.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.35.6.4", "title": "18.9.35.6.4 Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled'", "description": "Specifies whether or not the user is prompted for a password when the system resumes from sleep.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Power Management\\Sleep Settings\\Require a password when a computer wakes (plugged in)\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPower.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.37.1", "title": "18.9.37.1 Ensure 'Configure Offer Remote Assistance' is set to 'Disabled'", "description": "This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.\n\nHelp desk and support personnel will not be able to proactively offer assistance, although they can still respond to user assistance requests.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Remote Assistance\\Configure Offer Remote Assistance\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nRemoteAssistance.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.37.2", "title": "18.9.37.2 Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled'", "description": "This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Remote Assistance\\Configure Solicited Remote Assistance\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nRemoteAssistance.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nUsers on this computer cannot use e-mail or file transfer to ask someone for help.\nAlso, users cannot use instant messaging programs to allow connections to this computer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.41.1", "title": "18.9.41.1 Ensure 'Configure validation of ROCA-vulnerable WHfB keys during authentication' is set to 'Enabled: Block' (DC only)", "description": "This policy setting allows you to configure how Domain Controllers handle Windows\nHello for Business (WHfB) keys that are vulnerable to the \"Return of Coppersmith´s attack\" (ROCA) vulnerability.\n\nIf this policy setting is enabled the following options are supported:\n\n- Ignore: During authentication the Domain Controller will not probe any WHfB keys for the\nROCA vulnerability.\n\n- Audit: During authentication the Domain Controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed).\n\n- Block: During authentication the Domain Controller will block the use of WHfB keys that are subject to the ROCA vulnerability (vulnerable authentications will fail).\n\nThe recommended state for this setting is:\nEnabled: Block.\n\nNote:\n\nThis setting only takes effect on Domain Controllers running on Server 2022 (or newer).\n\nNote #2:\n\nA reboot is not required for changes to this setting to take effect.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Block:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Security Account Manager\\Configure validation of ROCA-vulnerable WHfB keys during authentication\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nSam.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThis setting may affect vulnerable Trusted Platform Module (TPMs). To avoid issues, this setting should not be set to\nBlock until appropriate mitigations have been performed, for example patching of vulnerable\nTPMs.\n\nWarning:\n\nIt is recommended that this setting is first set to\nAudit to ensure there are no audit events for WHfB keys that are subject to the ROCA vulnerability.\nIf these exist, remediate before configuring this to\nBlock.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.41.2", "title": "18.9.41.2 Ensure 'Configure SAM change password RPC methods policy' is set to 'Enabled: Allow strong encryption change password RPC method only' (DC only)", "description": "This policy setting determines which RPC methods can be used to change passwords stored in the Security Account Manager (SAM).\n\nThe recommended state for this setting is:\nEnabled: Allow strong encryption change password RPC method only.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Allow strong encryption change password RPC method only:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Security Account Manager\\Configure SAM change password RPC methods policy\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nSAM.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.25", "title": "2.2.25 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests' (DC only)", "description": "This policy setting determines whether users can log on as Remote Desktop clients.\nAfter the baseline Member Server is joined to a domain environment, there is no need to use local accounts to access the server from the network. Domain accounts can access the server for administration and end-user processing. This user right supersedes the Allow log on through Remote Desktop Services user right if an account is subject to both policies.\n\nThe recommended state for this setting is to include:\nGuests.\n\nNote:\n\nThe security identifier\nLocal account is not available in Server 2008 R2 and Server 2012 (non-R2) unless\n[MSKB 2871997](http://support.microsoft.com/kb/2871997) has been installed.\n\nNote #2:\n\nIn all versions of Windows Server prior to Server 2008 R2,\nRemote Desktop Services was known as\nTerminal Services, so you should substitute the older term if comparing against an older OS.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to include\nGuests:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on through Remote Desktop Services\n```\n\n### Impact\n\nIf you assign the\nDeny log on through Remote Desktop Services user right to other groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. Accounts that have this user right will be unable to connect to the computer through either Remote Desktop Services or Remote Assistance. You should confirm that delegated tasks will not be negatively impacted.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.49.5.1", "title": "18.9.49.5.1 Ensure 'Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider' is set to 'Disabled'", "description": "This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Troubleshooting and Diagnostics\\Microsoft Support Diagnostic Tool\\Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nMSDT.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nMSDT cannot run in support mode, and no data can be collected or sent to the support provider.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.49.11.1", "title": "18.9.49.11.1 Ensure 'Enable/Disable PerfTrack' is set to 'Disabled'", "description": "This policy setting specifies whether to enable or disable tracking of responsiveness events.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Troubleshooting and Diagnostics\\Windows Performance PerfTrack\\Enable/Disable PerfTrack\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPerformancePerftrack.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nResponsiveness events are not processed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.51.1", "title": "18.9.51.1 Ensure 'Turn off the advertising ID' is set to 'Enabled'", "description": "This policy setting turns off the advertising ID, preventing apps from using the ID for experiences across apps.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\User Profiles\\Turn off the advertising ID\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nUserProfiles.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe advertising ID is turned off. Apps can't use the ID for experiences across apps.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.9.53.1.1", "title": "18.9.53.1.1 Ensure 'Enable Windows NTP Client' is set to 'Enabled'", "description": "This policy setting specifies whether the Windows NTP Client is enabled. Enabling the Windows NTP Client allows synchronization from a systems computer clock to NTP server(s).\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nIf a third-party time provider is used in the environment, an exception to this recommendation will be needed.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\System\\Windows Time Service\\Time Providers\\Enable Windows NTP Client\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nW32Time.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nSystem time will be synced to the configured NTP server(s).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.4.1", "title": "18.10.4.1 Ensure 'Allow a Windows app to share application data between users' is set to 'Disabled'", "description": "Manages a Windows app's ability to share data between users who have installed the app. Data is shared through the\nSharedLocal folder. This folder is available through the\nWindows.Storage\n\nAPI.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\App Package Deployment\\Allow a Windows app to share application data between users\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAppxPackageManager.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.4.2", "title": "18.10.4.2 Ensure 'Not allow per-user unsigned packages to install by default (requires explicitly allow per install)' is set to 'Enabled'", "description": "This setting manages a user's ability to install unsigned Windows App packages.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nUnsigned Windows App packages will require an explicit allow per install if this setting is disabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\App Package Deployment\\Not allow per-user unsigned packages to install by default (requires explicitly allow per install)\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nAppxPackageManager.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nStandard users will not be able to install unsigned packaged Microsoft Store Apps, unless they are explicitly permitted by other policies.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.6.1", "title": "18.10.6.1 Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled'", "description": "This policy setting lets you control whether Microsoft accounts are optional for Windows\nStore apps that require an account to sign in. This policy only affects Windows Store apps that support it.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\App runtime\\Allow Microsoft accounts to be optional\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAppXRuntime.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nWindows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.8.1", "title": "18.10.8.1 Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'", "description": "This policy setting disallows AutoPlay for MTP devices like cameras or phones.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\AutoPlay Policies\\Disallow Autoplay for non-volume devices\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAutoPlay.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nAutoPlay will not be allowed for MTP devices like cameras or phones.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.8.2", "title": "18.10.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'", "description": "This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.\n\nThe recommended state for this setting is:\nEnabled: Do not execute any autorun commands.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Do not execute any autorun commands:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\AutoPlay Policies\\Set the default behavior for AutoRun\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAutoPlay.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nAutoRun commands will be completely disabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.8.3", "title": "18.10.8.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'", "description": "This policy setting controls Autoplay. Autoplay starts to read from a drive as soon as the media is inserted in the drive, which causes the setup file for programs or audio media to start immediately.\n\nThe recommended state for this setting is:\nEnabled: All drives.\n\nNote:\n\nThis policy setting cannot be used to enable Autoplay on computer drives in which it is disabled by default, such as floppy disk and network drives.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: All drives:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\AutoPlay Policies\\Turn off Autoplay\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nAutoPlay.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nAutoplay will be disabled - users will have to manually launch setup or installation programs that are provided on removable media.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.9.1.1", "title": "18.10.9.1.1 Ensure 'Configure enhanced anti-spoofing' is set to 'Enabled'", "description": "This policy setting determines whether enhanced anti-spoofing is configured for devices which support it.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Biometrics\\Facial Features\\Configure enhanced anti-spoofing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nBiometrics.admx/adml that is included with the Microsoft Windows 10 Release 1511 Administrative Templates\n(or newer).\n\nNote #2:\n\nIn the Windows 10 Release 1511 and Windows 10 Release 1607 & Server 2016 Administrative\nTemplates, this setting was initially named\nUse enhanced anti-spoofing when available. It was renamed to\nConfigure enhanced anti-spoofing starting with the Windows 10 Release 1703 Administrative Templates.\n\n### Impact\n\nWindows will require all users on the device to use anti-spoofing for facial features, on devices which support it.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.11.1", "title": "18.10.11.1 Ensure 'Allow Use of Camera' is set to 'Disabled'", "description": "This policy setting controls whether the use of Camera devices on the machine are permitted.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Camera\\Allow Use of Camera\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCamera.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nUsers will not be able to utilize the camera on a system.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.13.1", "title": "18.10.13.1 Ensure 'Turn off cloud consumer account state content' is set to 'Enabled'", "description": "This policy setting determines whether cloud consumer account state content is allowed in all Windows experiences.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Cloud Content\\Turn off cloud consumer account state content\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCloudContent.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not be able to use Microsoft consumer accounts on the system, and associated\nWindows experiences will instead present default fallback content.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.13.2", "title": "18.10.13.2 Ensure 'Turn off cloud optimized content' is set to 'Enabled'", "description": "This policy setting turns off cloud optimized content in all Windows experiences.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Cloud Content\\Turn off cloud optimized content\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCloudContent.admx/adml that is included with the Microsoft Windows 10 Release 20H2 Administrative Templates\n(or newer).\n\n### Impact\n\nWindows experiences that use the cloud optimized content client component, will present the default fallback content instead of customized content.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.14.1", "title": "18.10.14.1 Ensure 'Require pin for pairing' is set to 'Enabled: First Time' OR 'Enabled: Always'", "description": "This policy setting controls whether or not a PIN is required for pairing to a wireless display device.\n\nThe recommended state for this setting is:\nEnabled: First Time\n\nOR\nEnabled: Always.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: First Time\n\nOR\nEnabled: Always:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Connect\\Require pin for pairing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWirelessDisplay.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer). The new\nChoose one of the following actions sub-option was later added as of the Windows 10 Release 1809 Administrative Templates.\nChoosing\nEnabled in the older templates is the equivalent of choosing\nEnabled: First Time in the newer templates.\n\n### Impact\n\nThe pairing ceremony for connecting to new wireless display devices will always require a PIN.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.15.1", "title": "18.10.15.1 Ensure 'Do not display the password reveal button' is set to 'Enabled'", "description": "This policy setting allows you to configure the display of the password reveal button in password entry user experiences.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Credential User Interface\\Do not display the password reveal button\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nCredUI.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nThe password reveal button will not be displayed after a user types a password in the password entry text box.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.15.2", "title": "18.10.15.2 Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled'", "description": "This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Credential User Interface\\Enumerate administrator accounts on elevation\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nCredUI.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.1", "title": "18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data'", "description": "This policy setting determines the amount of diagnostic and usage data reported to\nMicrosoft:\n\n-\n\nA value of (0)\nDiagnostic data off (not recommended). Using this value, no diagnostic data is sent from the device. This value is only supported on Enterprise, Education, and Server editions. If you choose this setting, devices in your organization will still be secure.\n\n-\n\nA value of (1)\nSend required diagnostic data. This is the minimum diagnostic data necessary to keep Windows secure, up to date, and performing as expected. Using this value disables the\nOptional diagnostic data control in the Settings app.\n\n-\n\nA value of (3)\nSend optional diagnostic data. Additional diagnostic data is collected that helps us to detect, diagnose and fix issues, as well as make product improvements. Required diagnostic data will always be included when you choose to send optional diagnostic data. Optional diagnostic data can also include diagnostic log files and crash dumps. Use the\nLimit Dump Collection and the\nLimit Diagnostic Log Collection policies for more granular control of what optional diagnostic data is sent.\n\nWindows telemetry settings apply to the Windows operating system and some first party apps. This setting does not apply to third party apps running on Windows 10/11.\n\nThe recommended state for this setting is:\nEnabled: Diagnostic data off (not recommended) or\nEnabled: Send required diagnostic data.\n\nNote:\n\nIf your organization relies on Windows Update, the minimum recommended setting is\nRequired diagnostic data. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of updates.\n\nNote #2:\n\nThe\nConfigure diagnostic data opt-in settings user interface group policy can be used to prevent end users from changing their data collection settings.\n\nNote #3:\n\nEnhanced diagnostic data setting is not available on Windows 11 and Windows Server\n2022 and has been replaced with policies that can control the amount of optional diagnostic data that is sent. For more information on these settings visit\n[Manage diagnostic data using Group Policy and MDM](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization#manage-diagnostic-data-using-group-policy-and-mdm)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Diagnostic data off (not recommended) or\nEnabled: Send required diagnostic data:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Allow Diagnostic Data\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDataCollection.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nAllow Telemetry. It was renamed to\nAllow Diagnostic Data starting with the Windows 11 Release 21H2 Administrative Templates.\n\n### Impact\n\nNote that setting values of 0 or 1 will degrade certain experiences on the device.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.2", "title": "18.10.16.2 Ensure 'Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service' is set to 'Enabled: Disable Authenticated Proxy usage'", "description": "This policy setting controls whether the Connected User Experience and Telemetry service can automatically use an authenticated proxy to send data back to Microsoft.\n\nThe recommended state for this setting is:\nEnabled: Disable Authenticated Proxy usage.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Disable Authenticated Proxy usage:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDataCollection.admx/adml that is included with the Microsoft Windows 10 Release 1703 Administrative Templates\n(or newer).\n\n### Impact\n\nThe Connected User Experience and Telemetry service will be blocked from automatically using an authenticated proxy.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.3", "title": "18.10.16.3 Ensure 'Do not show feedback notifications' is set to 'Enabled'", "description": "This policy setting allows an organization to prevent its devices from showing feedback questions from Microsoft.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Do not show feedback notifications\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nFeedbackNotifications.admx/adml that is included with the Microsoft Windows 10 Release 1511 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will no longer see feedback notifications through the Windows Feedback app.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "1.1.4", "title": "1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)'", "description": "This policy setting determines the least number of characters that make up a password for a user account.\n\nThe recommended state for this setting is:\n14 or more character(s).\n\nNote:\n\nIn Windows Server 2016 and older versions of Windows Server, the GUI of the Local\nSecurity Policy (LSP), Local Group Policy Editor (LGPE) and Group Policy Management\nEditor (GPME) would not let you set this value higher than 14 characters. However, starting with Windows Server 2019, Microsoft changed the GUI to allow up to a 20 character minimum password length.\n\nNote #2:\n\nPassword Policy settings (section 1.1) and Account Lockout Policy settings (section\n1.2) must be applied via the\nDefault Domain Policy\n\nGPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another\nGPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative\nCenter.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n14 or more character(s):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Minimum password length\n```\n\n### Impact\n\nRequirements for extremely long passwords can decrease the security of an organization, because users might leave the information in an insecure location or lose it. If very long passwords are required, mistyped passwords could cause account lockouts and increase the volume of help desk calls. If your organization has issues with forgotten passwords due to password length requirements, consider teaching your users about passphrases, which are often easier to remember and, due to the larger number of character combinations, much harder to discover.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.29", "title": "2.2.29 Ensure 'Force shutdown from a remote system' is set to 'Administrators'", "description": "This policy setting allows users to shut down Windows Vista-based or newer computers from remote locations on the network. Anyone who has been assigned this user right can cause a denial-of-service (DoS) condition, which would make the computer unavailable to service user requests. Therefore, it is recommended that only highly trusted administrators be assigned this user right.\n\nThe recommended state for this setting is:\nAdministrators.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Force shutdown from a remote system\n```\n\n### Impact\n\nIf you remove the\nForce shutdown from a remote system user right from the Server Operators group you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.4", "title": "18.10.16.4 Ensure 'Enable OneSettings Auditing' is set to 'Enabled'", "description": "This policy setting controls whether Windows records attempts to connect with the\nOneSettings service to the Event Log.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Enable OneSettings Auditing\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDataCollection.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nWindows will record attempts to connect with the OneSettings service to the\nApplications and Services Logs\\Microsoft\\Windows\\Privacy-Auditing\\Operational\n\nEvent Log channel.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.5", "title": "18.10.16.5 Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'", "description": "This policy setting controls whether additional diagnostic logs are collected when more information is needed to troubleshoot a problem on the device.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nDiagnostic logs are only sent when the device has been configured to send optional diagnostic data. Diagnostic data is limited when recommendation\nAllow Diagnostic Data is set to\nEnabled: Diagnostic data off (not recommended) or\nEnabled: Send required diagnostic data to send only basic information.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Limit Diagnostic Log Collection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDataCollection.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nDiagnostic logs and information such as crash dumps will not be collected for transmission to Microsoft.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.16.6", "title": "18.10.16.6 Ensure 'Limit Dump Collection' is set to 'Enabled'", "description": "This policy setting limits the type of memory dumps that can be collected when more information is needed to troubleshoot a problem.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nMemory dumps are only sent when the device has been configured to send optional diagnostic data. Diagnostic data is limited when recommendation\nAllow Diagnostic Data is set to\nEnabled: Diagnostic data off (not recommended) or\nEnabled: Send required diagnostic data to send only basic information.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled.\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Limit Dump Collection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDataCollection.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nWindows Error Reporting will not send full and/or heap memory dumps to Microsoft - they will be limited to kernel mini and/or user mode triage memory dumps (if sending optional diagnostic data is permitted).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.1", "title": "18.10.18.1 Ensure 'Enable App Installer' is set to 'Disabled'", "description": "This policy setting controls whether user have access to the Windows Package Manager.\nWindows Package Manager is a package manager solution that consists of a command line tool and set of services for installing applications on Microsoft Windows Server 2019\n(or newer).\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nUsers will not have access to the command line tool, winget to discover, install, upgrade, remove, configure, or distribute applications.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.2", "title": "18.10.18.2 Ensure 'Enable App Installer Experimental Features' is set to 'Disabled'", "description": "This policy setting controls whether users can enable experimental features in the\nWindows Package Manager.\n\nThe recommended state for this setting is\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer Experimental Features\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nUsers will not have access to experimental features in the command line tool, winget to discover, install, upgrade, remove, configure, or distribute applications.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.3", "title": "18.10.18.3 Ensure 'Enable App Installer Hash Override' is set to 'Disabled'", "description": "This policy setting controls whether or not users can override the SHA256 security validation in the Windows Package Manager settings.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer Hash Override\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nUsers will not have the ability to override the SHA256 security validation.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.4", "title": "18.10.18.4 Ensure 'Enable App Installer Local Archive Malware Scan Override' is set to 'Disabled'", "description": "This policy setting controls the ability to override malware scans when the following conditions are true:\n\n- installing an archive file\n\n- using a local manifest\n\n- via command line arguments\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer Local Archive Malware Scan Override\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not have the ability to override malware scans when installing an archived file.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.5", "title": "18.10.18.5 Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled'", "description": "This policy setting controls whether users can install packages from a website that is using the ms-appinstaller protocol. The ms-appinstaller protocol allows users to install an application by clicking a link on a website.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer ms-appinstaller protocol\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nUsers will not have the ability to use the ms-appinstaller protocol to install applications by clicking a link on a website.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.6", "title": "18.10.18.6 Ensure 'Enable App Installer Microsoft Store Source Certificate Validation Bypass' is set to 'Disabled'", "description": "This policy setting controls whether Windows Package Manager validates the Microsoft\nStore certificate hash to match a known Microsoft Store certificate when it initiates a connection to the Microsoft Store source.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable App Installer Microsoft Store Source Certificate Validation Bypass\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nSource certificate validation by Windows Package Manager cannot be bypassed when a connection is initiated to the Microsoft Store.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.18.7", "title": "18.10.18.7 Ensure 'Enable Windows Package Manager command line interfaces' is set to 'Disabled'", "description": "This policy setting controls whether a user can perform actions using the Windows\nPackage Manager through a command line interface (Windows CLI or PowerShell).\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nThis policy does not override the\nEnable App Installer policy, which is set to\nDisabled in the L2 profile of the CIS Windows Operating System Benchmarks.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Desktop App Installer\\Enable Windows Package Manager command line interfaces\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nDesktopAppInstaller.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not have the ability to use Windows Package Manager with Windows CLI or\nPowerShell.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.1.1", "title": "18.10.26.1.1 Ensure 'Application: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'", "description": "This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nOld events may or may not be retained according to the\nBackup log automatically when full policy setting.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Application\\Control Event Log behavior when the log file reaches its maximum size\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nRetain old events, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.1.2", "title": "18.10.26.1.2 Ensure 'Application: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'", "description": "This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 2 terabytes\n(2,147,483,647 kilobytes) in kilobyte increments.\n\nThe recommended state for this setting is:\nEnabled: 32,768 or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 32,768 or greater:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Application\\Specify the maximum log file size (KB)\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nMaximum Log Size (KB), but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nWhen event logs fill to capacity, they will stop recording information unless the retention method for each is set so that the computer will overwrite the oldest entries with the most recent ones. To mitigate the risk of loss of recent data, you can configure the retention method so that older events are overwritten as needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.2.1", "title": "18.10.26.2.1 Ensure 'Security: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'", "description": "This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nOld events may or may not be retained according to the\nBackup log automatically when full policy setting.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Security\\Control Event Log behavior when the log file reaches its maximum size\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nRetain old events, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.2.2", "title": "18.10.26.2.2 Ensure 'Security: Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater'", "description": "This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 2 terabytes\n(2,147,483,647 kilobytes) in kilobyte increments.\n\nThe recommended state for this setting is:\nEnabled: 196,608 or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 196,608 or greater:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Security\\Specify the maximum log file size (KB)\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nMaximum Log Size (KB), but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nWhen event logs fill to capacity, they will stop recording information unless the retention method for each is set so that the computer will overwrite the oldest entries with the most recent ones. To mitigate the risk of loss of recent data, you can configure the retention method so that older events are overwritten as needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.3.1", "title": "18.10.26.3.1 Ensure 'Setup: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'", "description": "This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nOld events may or may not be retained according to the\nBackup log automatically when full policy setting.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Setup\\Control Event Log behavior when the log file reaches its maximum size\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nRetain old events, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.3.2", "title": "18.10.26.3.2 Ensure 'Setup: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'", "description": "This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 2 terabytes\n(2,147,483,647 kilobytes) in kilobyte increments.\n\nThe recommended state for this setting is:\nEnabled: 32,768 or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 32,768 or greater:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\Setup\\Specify the maximum log file size (KB)\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nMaximum Log Size (KB), but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nWhen event logs fill to capacity, they will stop recording information unless the retention method for each is set so that the computer will overwrite the oldest entries with the most recent ones. To mitigate the risk of loss of recent data, you can configure the retention method so that older events are overwritten as needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.4.1", "title": "18.10.26.4.1 Ensure 'System: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'", "description": "This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nOld events may or may not be retained according to the\nBackup log automatically when full policy setting.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\System\\Control Event Log behavior when the log file reaches its maximum size\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nRetain old events, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.26.4.2", "title": "18.10.26.4.2 Ensure 'System: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'", "description": "This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 2 terabytes\n(2,147,483,647 kilobytes) in kilobyte increments.\n\nThe recommended state for this setting is:\nEnabled: 32,768 or greater.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 32,768 or greater:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Event Log Service\\System\\Specify the maximum log file size (KB)\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nEventLog.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nMaximum Log Size (KB), but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nWhen event logs fill to capacity, they will stop recording information unless the retention method for each is set so that the computer will overwrite the oldest entries with the most recent ones. To mitigate the risk of loss of recent data, you can configure the retention method so that older events are overwritten as needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.29.2", "title": "18.10.29.2 Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled'", "description": "This policy setting determines whether files that are sourced from insecure locations are tagged with Mark of the Web (MOTW).\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Do not apply the Mark of the Web tag to files copied from insecure sources\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nExplorer.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.29.3", "title": "18.10.29.3 Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled'", "description": "Disabling Data Execution Prevention can allow certain legacy plug-in applications to function without terminating Explorer.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nSome legacy plug-in applications and other software may not function with Data Execution\nPrevention and will require an exception to be defined for that specific plug-in/software.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Turn off Data Execution Prevention for Explorer\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nExplorer.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.29.4", "title": "18.10.29.4 Ensure 'Turn off heap termination on corruption' is set to 'Disabled'", "description": "Without heap termination on corruption, legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Ensuring that heap termination on corruption is active will prevent this.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Turn off heap termination on corruption\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nExplorer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.29.5", "title": "18.10.29.5 Ensure 'Turn off shell protocol protected mode' is set to 'Disabled'", "description": "This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Turn off shell protocol protected mode\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsExplorer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.36.1", "title": "18.10.36.1 Ensure 'Turn off location' is set to 'Enabled'", "description": "This policy setting turns off the location feature for the computer.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Location and Sensors\\Turn off location\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nSensors.admx/adml that is included with the Microsoft Windows 7 & Server 2008 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nThe location feature is turned off, and all programs on the computer are prevented from using location information from the location feature.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.40.1", "title": "18.10.40.1 Ensure 'Allow Message Service Cloud Sync' is set to 'Disabled'", "description": "This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Messaging\\Allow Message Service Cloud Sync\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nMessaging.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nCellular text messages will not be backed up to (or restored from) Microsoft's cloud services.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.41.1", "title": "18.10.41.1 Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled'", "description": "This setting determines whether applications and services on the device can utilize new consumer Microsoft account authentication via the Windows\nOnlineID and\nWebAccountManager\n\nAPIs.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft accounts\\Block all consumer Microsoft account user authentication\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nMSAPolicy.admx/adml that is included with the Microsoft Windows 10 Release 1703 Administrative Templates\n(or newer).\n\n### Impact\n\nAll applications and services on the device will be prevented from new authentications using consumer Microsoft accounts via the Windows\nOnlineID and\nWebAccountManager\n\nAPIs. Authentications performed directly by the user in web browsers or in apps that use\nOAuth will remain unaffected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.4.1", "title": "18.10.42.4.1 Ensure 'Enable EDR in block mode' is set to 'Enabled'", "description": "This policy setting controls whether Microsoft Defender Antivirus Endpoint Detection and Response (EDR) is enabled in block mode (passive remediation).\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nEDR in block mode is only available in Microsoft Defender for Endpoint Plan 2.\n\nNote #2:\n\nThis setting is available with Microsoft Defender Antivirus platform release v4.18.2202.X and newer.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Features\\Enable EDR in block mode\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nIf Microsoft Defender Antivirus is running EDR will be enabled in block mode. If the system does not have Microsoft Defender Antivirus installed and running, then this setting will have no effect.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.5.1", "title": "18.10.42.5.1 Ensure 'Configure local setting override for reporting to Microsoft MAPS' is set to 'Disabled'", "description": "This policy setting configures a local override for the configuration to join Microsoft\nActive Protection Service (MAPS), which Microsoft renamed to\nWindows Defender Antivirus Cloud Protection Service and then\nMicrosoft Defender Antivirus Cloud Protection Service.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\MAPS\\Configure local setting override for reporting to Microsoft MAPS\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.5.2", "title": "18.10.42.5.2 Ensure 'Join Microsoft MAPS' is set to 'Enabled: Advanced'", "description": "This policy setting configures Microsoft Active Protection Service (MAPS). Microsoft\nMAPS is designed to help Microsoft continually update and improve definitions of malware, spyware and other potentially unwanted software and to help Microsoft improve Windows\nDefender and related technologies.\n\nThe recommended state for this setting is:\nEnabled: Advanced.\n\nNote:\n\nIn Windows 10 and above, Basic membership is no longer available, so setting the value to\n1\n\nBasic, or\n2\n\nAdvanced, enrolls the device into Advanced membership. For more information, please visit:\n[Turn on cloud protection in Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus#methods-to-configure-cloud-protection).\n\nNote #2:\n\nThis setting originally named\nWindows Defender Antivirus Cloud Protection Service and then\nMicrosoft Defender Antivirus Cloud Protection Service before it was renamed to\nMicrosoft MAPS.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Advanced:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\MAPS\\Join Microsoft MAPS\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nMAPS will send detailed information about malware and potentially unwanted software, including the full path to the software, and detailed information about how the software has affected the device.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.6.1.1", "title": "18.10.42.6.1.1 Ensure 'Configure Attack Surface Reduction rules' is set to 'Enabled'", "description": "This policy setting controls the state for the Attack Surface Reduction (ASR) rules.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Microsoft Defender Exploit Guard\\Attack Surface Reduction\\Configure Attack Surface Reduction rules\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nWhen a rule is triggered, a notification will be displayed from the Action Center.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.6.1.2", "title": "18.10.42.6.1.2 Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured", "description": "This policy setting sets the Attack Surface Reduction rules.\n\nThe recommended state for this setting is:\n\n26190899-1602-49e8-8b27-eb1d0a1ce869 - 1\n\n(Block Office communication application from creating child processes)\n\n3b576869-a4ec-4529-8536-b80a7769e899 - 1\n\n(Block Office applications from creating executable content)\n\n56a863a9-875e-4185-98a7-b882c64b5ce5 - 1\n\n(Block abuse of exploited vulnerable signed drivers)\n\n5beb7efe-fd9a-4556-801d-275e5ffc04cc - 1\n\n(Block execution of potentially obfuscated scripts)\n\n75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 - 1\n\n(Block Office applications from injecting code into other processes)\n\n7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c - 1\n\n(Block Adobe Reader from creating child processes)\n\n9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 - 1\n\n(Block credential stealing from the Windows local security authority subsystem (lsass.exe)) b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 - 1\n\n(Block untrusted and unsigned processes that run from USB) be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 - 1\n\n(Block executable content from email client and webmail) d3e037e1-3eb8-44c8-a917-57927947596d - 1\n\n(Block JavaScript or VBScript from launching downloaded executable content) d4f940ab-401b-4efc-aadc-ad5f3c50688a - 1\n\n(Block Office applications from creating child processes) e6db77e5-3df2-4cf1-b95a-636979351e5b - 1\n\n(Block persistence through WMI event subscription)\n\nNote:\n\nMore information on ASR rules can be found at the following link:\n[Use Attack surface reduction rules to prevent malware infection | Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)", "recommendation": "To establish the recommended configuration via GP, set the following UI path so that\n26190899-1602-49e8-8b27-eb1d0a1ce869,\n3b576869-a4ec-4529-8536-b80a7769e899,\n56a863a9-875e-4185-98a7-b882c64b5ce5,\n5beb7efe-fd9a-4556-801d-275e5ffc04cc,\n75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,\n7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,\n9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2, b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4, be9ba2d9-53ea-4cdc-84e5-9b1eeee46550, d3e037e1-3eb8-44c8-a917-57927947596d, d4f940ab-401b-4efc-aadc-ad5f3c50688a, and e6db77e5-3df2-4cf1-b95a-636979351e5b are each set to a value of\n1:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Microsoft Defender Exploit Guard\\Attack Surface Reduction\\Configure Attack Surface Reduction rules: Set the state for each ASR rule\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nWhen a rule is triggered, a notification will be displayed from the Action Center.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.6.3.1", "title": "18.10.42.6.3.1 Ensure 'Prevent users and apps from accessing dangerous websites' is set to 'Enabled: Block'", "description": "This policy setting controls Microsoft Defender Exploit Guard network protection.\n\nThe recommended state for this setting is:\nEnabled: Block.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Block:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Microsoft Defender Exploit Guard\\Network Protection\\Prevent users and apps from accessing dangerous websites\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers and applications will not be able to access dangerous domains.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.7.1", "title": "18.10.42.7.1 Ensure 'Enable file hash computation feature' is set to 'Enabled'", "description": "This setting determines whether hash values are computed for files scanned by Microsoft\nDefender.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\MpEngine\\Enable file hash computation feature\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 2004 Administrative Templates\n(or newer).\n\n### Impact\n\nThis setting could cause performance degradation during initial deployment and for users where new executable content is frequently being created (such as software developers), or where applications are frequently installed or updated.\n\nFor more information on this setting, please visit\n[Security baseline (FINAL): Windows 10 and Windows Server, version 2004 - Microsoft Tech Community - 1543631](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-windows-10-and-windows-server-version/ba-p/1543631).\n\nNote:\n\nThe impact of this setting should be monitored closely during deployment to ensure user and system performance impact is within acceptable limits.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.8.1", "title": "18.10.42.8.1 Ensure 'Convert warn verdict to block' is set to 'Enabled'", "description": "This policy setting controls whether Microsoft Defender Antivirus network protection will display a warning, or block network traffic.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Network Inspection System\\Convert warn verdict to block\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nLegitimate network traffic could be blocked by Microsoft Defender Antivirus network protection.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.10.1", "title": "18.10.42.10.1 Ensure 'Configure real-time protection and Security Intelligence Updates during OOBE' is set to 'Enabled'", "description": "This policy setting configures whether Real-time Protection and Security Intelligence\nUpdates are enabled during the Out of Box experience (OOBE).\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Real-Time Protection\\Configure real-time protection and Security Intelligence Updates during OOBE\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.10.2", "title": "18.10.42.10.2 Ensure 'Scan all downloaded files and attachments' is set to 'Enabled'", "description": "This policy setting configures scanning for all downloaded files and attachments.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Real-Time Protection\\Scan all downloaded files and attachments\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.10.3", "title": "18.10.42.10.3 Ensure 'Turn off real-time protection' is set to 'Disabled'", "description": "This policy setting configures real-time protection prompts for known malware detection.\n\nMicrosoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Real-Time Protection\\Turn off real-time protection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.10.4", "title": "18.10.42.10.4 Ensure 'Turn on behavior monitoring' is set to 'Enabled'", "description": "This policy setting allows you to configure behavior monitoring for Microsoft Defender\nAntivirus.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Real-Time Protection\\Turn on behavior monitoring\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default configuration.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.10.5", "title": "18.10.42.10.5 Ensure 'Turn on script scanning' is set to 'Enabled'", "description": "This policy setting allows script scanning to be turned on/off. Script scanning intercepts scripts then scans them before they are executed on the system.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Real-Time Protection\\Turn on script scanning\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.11.1.1.1", "title": "18.10.42.11.1.1.1 Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher", "description": "This policy setting configures whether Brute-Force Protection in Microsoft Defender\nAntivirus is enabled. Brute-force protection can detect and block attempts to forcibly sign in to a system.\n\nThe recommended state for this setting is:\nEnabled: Medium. Configuring this setting to\nEnabled: High also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Medium or\nEnabled: High:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Remediation\\Behavioral Network Blocks\\Brute-Force Protection\\Configure Brute-Force Protection aggressiveness\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nSome legitimate authentication attempts may be blocked. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.11.1.1.2", "title": "18.10.42.11.1.1.2 Ensure 'Configure Remote Encryption Protection Mode' is set to 'Enabled: Audit' or higher", "description": "This policy setting configures the Brute-Force Protection feature in Microsoft Defender\nAntivirus. Brute-Force Protection can detect and block attempts to forcibly initiate sign-ins and sessions.\n\nThe recommended state for this setting is:\nEnabled: Audit. Configuring this setting to\nEnabled: Block also conforms to the benchmark.\n\nNote:\n\nConfiguring the value to either\nDefault or\nOff does not conform to this benchmark.\n\nNote #2:\n\nThis setting's name is duplicated in the\nRemote Encryption Protection section, but they configure two different behaviors.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Audit or\nEnabled: Block:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Remediation\\Behavioral Network Blocks\\Brute-Force Protection\\Configure Remote Encryption Protection Mode\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nLegitimate sign-ins and sessions could be detected or blocked by this feature if too many failed attempts are detected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.34", "title": "2.2.34 Ensure 'Load and unload device drivers' is set to 'Administrators'", "description": "This policy setting allows users to dynamically load a new device driver on a system.\nThis user right is not required if a signed driver for the new hardware already exists in the Driver.cab file on the system.\n\nThe recommended state for this setting is:\nAdministrators.\n\nNote:\n\nThis user right is considered a \"sensitive privilege\" for the purposes of auditing.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Load and unload device drivers\n```\n\n### Impact\n\nIf the Load and unload device drivers user right is removed from the\nPrint Operators group or other accounts, it could limit the abilities of users who are assigned to specific administrative roles in your environment. Ensure that delegated tasks will not be negatively affected by this setting.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.11.1.2.1", "title": "18.10.42.11.1.2.1 Ensure 'Configure how aggressively Remote Encryption Protection blocks threats' is set to 'Enabled: Medium' or higher", "description": "This policy setting configures how aggressively Remote Encryption Prevention Protection blocks malicious IP addresses.\n\nThe recommended state for this setting is:\nEnabled: Medium or higher. Configuring this setting to\nEnabled: High also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Medium or\nEnabled: High:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Remediation\\Behavioral Network Blocks\\Remote Encryption Protection\\Configure how aggressively Remote Encryption Protection blocks threats\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nLegitimate websites could be blocked by Remote Encryption Prevention Protection. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.12.1", "title": "18.10.42.12.1 Ensure 'Configure Watson events' is set to 'Disabled'", "description": "This policy setting determines whether or not Watson events are sent to Microsoft.\nWatson events are the reports that get sent to Microsoft when a program or service crashes or fails, including the possibility of automatic submission.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Reporting\\Configure Watson events\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nWatson events will not be sent to Microsoft automatically when a program or service crashes or fails.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.13.1", "title": "18.10.42.13.1 Ensure 'Scan excluded files and directories during quick scans' is set to 'Enabled: 1'", "description": "This policy setting manages whether or not Microsoft Defender Antivirus scans excluded files and directories when running a Quick Scan.\n\nThe recommended state for this setting is:\nEnabled: 1.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 1:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Scan\\Scan excluded files and directories during quick scans\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nA Quick Scan could take longer when including the contextually excluded files and directories.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.13.2", "title": "18.10.42.13.2 Ensure 'Scan packed executables' is set to 'Enabled'", "description": "This policy setting manages whether or not Microsoft Defender Antivirus scans packed executables. Packed executables are executable files that contain compressed code.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Scan\\Scan packed executables\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 and Server 2012 R2 Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - This is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.13.3", "title": "18.10.42.13.3 Ensure 'Scan removable drives' is set to 'Enabled'", "description": "This policy setting manages whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Scan\\Scan removable drives\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nRemovable drives will be scanned during any type of scan by Microsoft Defender Antivirus.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.13.4", "title": "18.10.42.13.4 Ensure 'Trigger a quick scan after X days without any scans' is set to 'Enabled: 7'", "description": "This policy setting configures the number of days after the last scan (of any type) before an aggressive Quick Scan is automatically triggered.\n\nThe recommended state for this setting is:\nEnabled: 7 days.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 7 days:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Scan\\Trigger a quick scan after X days without any scans\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nThis setting should have no adverse effect on the system.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.13.5", "title": "18.10.42.13.5 Ensure 'Turn on e-mail scanning' is set to 'Enabled'", "description": "This policy setting configures e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac).\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Scan\\Turn on e-mail scanning\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates\n(or newer).\n\n### Impact\n\nE-mail scanning by Microsoft Defender Antivirus will be enabled.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.16", "title": "18.10.42.16 Ensure 'Configure detection for potentially unwanted applications' is set to 'Enabled: Block'", "description": "This policy setting controls detection and action for Potentially Unwanted Applications\n(PUA), which are sneaky unwanted application bundlers or their bundled applications, that can deliver adware or malware.\n\nThe recommended state for this setting is:\nEnabled: Block.\n\nFor more information, see this link:\n[Block potentially unwanted applications with Microsoft Defender Antivirus | Microsoft Docs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Block:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Configure detection for potentially unwanted applications\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 1809 & Server 2019 Administrative\nTemplates (or newer).\n\n### Impact\n\nApplications that are identified by Microsoft as PUA will be blocked at download and install time.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.42.17", "title": "18.10.42.17 Ensure 'Control whether exclusions are visible to local users' is set to 'Enabled'", "description": "This policy setting controls whether Microsoft Defender Antivirus exclusions are visible to local users on the system.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Defender Antivirus\\Control whether exclusions are visible to local users\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates\n(or newer).\n\n### Impact\n\nLocal users will not be able to view Microsoft Defender Antivirus exclusions.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.56.1", "title": "18.10.56.1 Ensure 'Turn off Push To Install service' is set to 'Enabled'", "description": "This policy setting controls whether users can push Apps to the device from the Microsoft\nStore App running on other devices or the web.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Push to Install\\Turn off Push To Install service\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPushToInstall.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not be able to push Apps to this device from the Microsoft Store running on other devices or the web.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.2.2", "title": "18.10.57.2.2 Ensure 'Do not allow passwords to be saved' is set to 'Enabled'", "description": "This policy setting helps prevent Remote Desktop clients from saving passwords on a computer.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nIf this policy setting was previously configured as Disabled or Not configured, any previously saved passwords will be deleted the first time a Remote Desktop client disconnects from any server.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Connection Client\\Do not allow passwords to be saved\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe password saving checkbox will be disabled for Remote Desktop clients and users will not be able to save passwords.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.2.1", "title": "18.10.57.3.2.1 Ensure 'Restrict Remote Desktop Services users to a single Remote Desktop Services session' is set to 'Enabled'", "description": "This policy setting allows you to restrict users to a single Remote Desktop Services session.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Connections\\Restrict Remote Desktop Services users to a single Remote Desktop Services session\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was named\nRestrict Terminal Services users to a single remote session, but it was renamed starting with the Windows 7 & Server 2008 R2 Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.1", "title": "18.10.57.3.3.1 Ensure 'Allow UI Automation redirection' is set to 'Disabled'", "description": "This policy setting determines whether User Interface (UI) Automation client applications running on the local computer can access UI elements on the server.\n\nUI Automation gives programs access to most UI elements, which allows use of assistive technology products like Magnifier and Narrator that need to interact with the UI in order to work properly. UI information also allows automated test scripts to interact with the UI. For example, the local computer´s Narrator and Magnifier clients can be used to interact with UI on a web page opened in a remote session.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nRemote Desktop sessions don´t currently support UI Automation redirection.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Allow UI Automation redirection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nTerminalServer.admx/adml that is included with the Microsoft Windows 10 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nUI Automation clients on the local computer will not be able to interact with remote apps.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.2", "title": "18.10.57.3.3.2 Ensure 'Do not allow COM port redirection' is set to 'Enabled'", "description": "This policy setting specifies whether to prevent the redirection of data to client\nCOM ports from the remote computer in a Remote Desktop Services session.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow COM port redirection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers in a Remote Desktop Services session will not be able to redirect server data to local (client) COM ports.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.3", "title": "18.10.57.3.3.3 Ensure 'Do not allow drive redirection' is set to 'Enabled'", "description": "This policy setting prevents users from sharing the local drives on their client computers to Remote Desktop Servers that they access. Mapped drives appear in the session folder tree in Windows Explorer in the following format:\n\n\\\\TSClient\\$\n\nIf local drives are shared they are left vulnerable to intruders who want to exploit the data that is stored on them.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow drive redirection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nDrive redirection will not be possible. In most situations, traditional network drive mapping to file shares (including administrative shares) performed manually by the connected user will serve as a capable substitute to still allow file transfers when needed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.4", "title": "18.10.57.3.3.4 Ensure 'Do not allow location redirection' is set to 'Enabled'", "description": "This policy setting controls the redirection of location data to the remote computer in a Remote Desktop Services session.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow location redirection\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nTerminalServer.admx/adml that is included with the Microsoft Windows 10 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not be able to redirect their location data to the remote computer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.5", "title": "18.10.57.3.3.5 Ensure 'Do not allow LPT port redirection' is set to 'Enabled'", "description": "This policy setting specifies whether to prevent the redirection of data to client\nLPT ports during a Remote Desktop Services session.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow LPT port redirection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers in a Remote Desktop Services session will not be able to redirect server data to local (client) LPT ports.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.6", "title": "18.10.57.3.3.6 Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled'", "description": "This policy setting allows you to control the redirection of supported Plug and Play devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop\nServices session.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow supported Plug and Play device redirection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nUsers in a Remote Desktop Services session will not be able to redirect their supported\n(local client) Plug and Play devices to the remote computer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.7", "title": "18.10.57.3.3.7 Ensure 'Do not allow WebAuthn redirection' is set to 'Enabled'", "description": "This policy setting controls the redirection of web authentication (WebAuthn) requests from a Remote Desktop session to the local device. This redirection enables users to authenticate to resources inside the Remote Desktop session using their local authenticator\n(e.g. Windows Hello for Business, security key, or other).\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Do not allow WebAuthn redirection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\n### Impact\n\nUsers in a Remote Desktop Services session will not be able to authenticate to resources inside the Remote Desktop session using their local authenticator.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.3.8", "title": "18.10.57.3.3.8 Ensure 'Restrict clipboard transfer from server to client' is set to 'Enabled: Disable clipboard transfers from server to client'", "description": "This policy setting controls whether the clipboard can be used to transfer data from the Remote Desktop session to the client.\n\nThe recommended state for this setting is:\nEnabled: Disable clipboard transfers from server to client.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Disable clipboard transfers from server to client:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Device and Resource Redirection\\Restrict clipboard transfer from server to client\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with the Microsoft Windows 11 Release 23H2 v2.0 Administrative Templates\n(or newer).\n\n### Impact\n\nUsers will not be able to transfer clipboard data from the Remote Desktop session to the client.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.36", "title": "2.2.36 Ensure 'Log on as a batch job' is set to 'Administrators' (DC Only)", "description": "This policy setting allows accounts to log on using the task scheduler service. Because the task scheduler is often used for administrative purposes, it may be needed in enterprise environments. However, its use should be restricted in high security environments to prevent misuse of system resources or to prevent threat actors from using the right to launch malicious code after gaining user level access to a computer.\n\nThe recommended state for this setting is:\nAdministrators.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Log on as a batch job\n```\n\n### Impact\n\nIf you configure the Log on as a batch job setting through domain-based Group Policies, the computer will not be able to assign the user right to accounts that are used for scheduled jobs in the Task Scheduler. If you install optional components such as ASP.NET or IIS, you might need to assign this user right to additional accounts that are required by those components. For example, IIS requires assignment of this user right to the\nIIS_WPG group and the\nIUSR_ (ComputerName),\nASPNET, and\nIWAM_ (ComputerName) accounts. If this user right is not assigned to this group and these accounts, IIS will be unable to run some COM objects that are necessary for proper functionality.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.9.1", "title": "18.10.57.3.9.1 Ensure 'Always prompt for password upon connection' is set to 'Enabled'", "description": "This policy setting specifies whether Remote Desktop Services always prompts the client computer for a password upon connection. You can use this policy setting to enforce a password prompt for users who log on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Security\\Always prompt for password upon connection\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn the Microsoft Windows Vista Administrative Templates, this setting was named\nAlways prompt client for password upon connection, but it was renamed starting with the Windows Server 2008 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nUsers cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They will be prompted for a password to log on.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.9.2", "title": "18.10.57.3.9.2 Ensure 'Require secure RPC communication' is set to 'Enabled'", "description": "This policy setting allows you to specify whether Remote Desktop Services requires secure Remote Procedure Call (RPC) communication with all clients or allows unsecured communication.\n\nYou can use this policy setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Security\\Require secure RPC communication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nRemote Desktop Services accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.9.3", "title": "18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL'", "description": "This policy setting specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote\nDesktop Protocol (RDP) connections.\n\nThe recommended state for this setting is:\nEnabled: SSL.\n\nNote:\n\nIn spite of this setting being labeled\nSSL, it is actually enforcing Transport Layer Security (TLS), not the older and less secure, Secure Socket Layer (SSL) protocol.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: SSL:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Security\\Require use of specific security layer for remote (RDP) connections\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nTLS will be required to authenticate to the RD Session Host server. If TLS is not supported, the connection fails.\n\nNote:\n\nBy default, this setting will use a self-signed certificate for RDP connections. If your organization has established the use of a Public Key Infrastructure (PKI) for\nSSL/TLS encryption, then we recommend that you also configure the\nServer authentication certificate template setting to instruct RDP to use a certificate from your PKI instead of a self-signed one. Note that the certificate template used for this purpose must have “Client Authentication” configured as an Intended Purpose. Note also that a valid, non-expired certificate using the specified template must already be installed on the server for it to work.\n\nNote #2:\n\nSome third party two-factor authentication solutions (e.g. RSA Authentication Agent) can be negatively affected by this setting, as the SSL/TLS security layer will expect the user's Windows password upon initial connection attempt (before the RDP logon screen), and once successfully authenticated, pass the credential along to that Windows session on the RDP host (to complete the login). If a two-factor agent is present and expecting a different credential at the RDP logon screen, this initial connection may result in a failed logon attempt, and also effectively cause a “double logon” requirement for each and every new RDP session.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.9.4", "title": "18.10.57.3.9.4 Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled'", "description": "This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Security\\Require user authentication for remote connections by using Network Level Authentication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn the Microsoft Windows Vista Administrative Templates, this setting was initially named\nRequire user authentication using RDP 6.0 for remote connections, but it was renamed starting with the Windows Server 2008 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nOnly client computers that support Network Level Authentication can connect to the\nRD Session Host server.\n\nNote:\n\nSome third party two-factor authentication solutions (e.g. RSA Authentication Agent) can be negatively affected by this setting, as Network Level Authentication will expect the user's Windows password upon initial connection attempt (before the RDP logon screen), and once successfully authenticated, pass the credential along to that Windows session on the RDP host (to complete the login). If a two-factor agent is present and expecting a different credential at the RDP logon screen, this initial connection may result in a failed logon attempt, and also effectively cause a “double logon” requirement for each and every new RDP session.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.9.5", "title": "18.10.57.3.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level'", "description": "This policy setting specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption.\n\nThe recommended state for this setting is:\nEnabled: High Level.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: High Level:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Security\\Set client connection encryption level\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.10.1", "title": "18.10.57.3.10.1 Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)'", "description": "This policy setting allows you to specify the maximum amount of time that an active\nRemote Desktop Services session can be idle (without user input) before it is automatically disconnected.\n\nThe recommended state for this setting is:\nEnabled: 15 minutes or less, but not Never (0).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 15 minutes or less, but not Never (0):\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Session Time Limits\\Set time limit for active but idle Remote Desktop Services sessions\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was named\nSet time limit for active but idle Terminal Services sessions, but it was renamed starting with the Windows 7 & Server 2008 R2 Administrative Templates.\n\n### Impact\n\nRemote Desktop Services will automatically disconnect active but idle sessions after\n15 minutes (or the specified amount of time). The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. Note that idle session time limits do not apply to console sessions.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.10.2", "title": "18.10.57.3.10.2 Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute'", "description": "This policy setting allows you to configure a time limit for disconnected Remote Desktop\nServices sessions.\n\nThe recommended state for this setting is:\nEnabled: 1 minute.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: 1 minute:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Session Time Limits\\Set time limit for disconnected sessions\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nDisconnected Remote Desktop sessions are deleted from the server after 1 minute. Note that disconnected session time limits do not apply to console sessions.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.11.1", "title": "18.10.57.3.11.1 Ensure 'Do not delete temp folders upon exit' is set to 'Disabled'", "description": "This policy setting specifies whether Remote Desktop Services retains a user's per-session temporary folders at logoff.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Temporary Folders\\Do not delete temp folders upon exit\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was named\nDo not delete temp folder upon exit, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.57.3.11.2", "title": "18.10.57.3.11.2 Ensure 'Do not use temporary folders per session' is set to 'Disabled'", "description": "By default, Remote Desktop Services creates a separate temporary folder on the RD\nSession Host server for each active session that a user maintains on the RD Session\nHost server. The temporary folder is created on the RD Session Host server in a Temp folder under the user's profile folder and is named with the sessionid. This temporary folder is used to store individual temporary files.\n\nTo reclaim disk space, the temporary folder is deleted when the user logs off from a session.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Remote Desktop Services\\Remote Desktop Session Host\\Temporary Folders\\Do not use temporary folders per session\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nTerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.58.1", "title": "18.10.58.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled'", "description": "This policy setting prevents the user from having enclosures (file attachments) downloaded from an RSS feed to the user's computer.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\RSS Feeds\\Prevent downloading of enclosures\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nInetRes.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was named\nTurn off downloading of enclosures, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nUsers cannot set the Feed Sync Engine to download an enclosure through the Feed property page. Developers cannot change the download setting through feed APIs.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.59.3", "title": "18.10.59.3 Ensure 'Allow indexing of encrypted files' is set to 'Disabled'", "description": "This policy setting controls whether encrypted items are allowed to be indexed. When this setting is changed, the index is rebuilt completely. Full volume encryption (such as BitLocker Drive Encryption or a non-Microsoft solution) must be used for the location of the index to maintain security for encrypted files.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Search\\Allow indexing of encrypted files\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nSearch.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.59.4", "title": "18.10.59.4 Ensure 'Allow search highlights' is set to 'Disabled'", "description": "This policy setting controls search highlights in the start menu search box and in search home.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Search\\Allow search highlights\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nSearch.admx/adml that is included with the Microsoft Windows 10 Release 21H2 Administrative Templates\n(or newer).\n\n### Impact\n\n“Interesting”, “informative”, and “noteworthy” information about the current date will not be displayed (by Microsoft) to the user.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.63.1", "title": "18.10.63.1 Ensure 'Turn off KMS Client Online AVS Validation' is set to 'Enabled'", "description": "The Key Management Service (KMS) is a Microsoft license activation method that entails setting up a local server to store the software licenses. The KMS server itself needs to connect to Microsoft to activate the KMS service, but subsequent on-network clients can activate Microsoft Windows OS and/or their Microsoft Office via the KMS server instead of connecting directly to Microsoft. This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Software Protection Platform\\Turn off KMS Client Online AVS Validation\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nAVSValidationGP.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\n### Impact\n\nThe computer is prevented from sending data to Microsoft regarding its KMS client activation state.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.77.2.1", "title": "18.10.77.2.1 Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass'", "description": "This policy setting allows you to manage the behavior of Windows SmartScreen. Windows\nSmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. Some information is sent to Microsoft about files and programs run on PCs with this feature enabled.\n\nThe recommended state for this setting is:\nEnabled: Warn and prevent bypass.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Warn and prevent bypass:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Defender SmartScreen\\Explorer\\Configure Windows Defender SmartScreen\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsExplorer.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nConfigure Windows SmartScreen, but it was renamed starting with the Windows 10 Release 1703 Administrative Templates.\n\n### Impact\n\nUsers will be warned and prevented from running unrecognized programs downloaded from the Internet.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.81.1", "title": "18.10.81.1 Ensure 'Allow suggested apps in Windows Ink Workspace' is set to 'Disabled'", "description": "This policy setting determines whether suggested apps in Windows Ink Workspace are allowed.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Ink Workspace\\Allow suggested apps in Windows Ink Workspace\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsInkWorkspace.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nThe suggested apps in Windows Ink Workspace will not be allowed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.81.2", "title": "18.10.81.2 Ensure 'Allow Windows Ink Workspace' is set to 'Enabled: On, but disallow access above lock' OR 'Enabled: Disabled'", "description": "This policy setting determines whether Windows Ink items are allowed above the lock screen.\n\nThe recommended state for this setting is:\nEnabled: On, but disallow access above lock\n\nOR\nEnabled: Disabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: On, but disallow access above lock\n\nOR\nEnabled: Disabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Ink Workspace\\Allow Windows Ink Workspace\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsInkWorkspace.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nWindows Ink Workspace will not be permitted above the lock screen.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.82.1", "title": "18.10.82.1 Ensure 'Allow user control over installs' is set to 'Disabled'", "description": "This setting controls whether users are permitted to change installation options that typically are available only to system administrators. The security features of Windows\nInstaller normally prevent users from changing installation options that are typically reserved for system administrators, such as specifying the directory to which files are installed. If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message.\nThese security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Installer\\Allow user control over installs\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nMSI.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was named\nEnable user control over installs, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.82.2", "title": "18.10.82.2 Ensure 'Always install with elevated privileges' is set to 'Disabled'", "description": "This setting controls whether or not Windows Installer should use system permissions when it installs any program on the system.\n\nNote:\n\nThis setting appears both in the Computer Configuration and User Configuration folders.\nTo make this setting effective, you must enable the setting in both folders.\n\nCaution:\n\nIf enabled, skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders.\nNote that the User Configuration version of this setting is not guaranteed to be secure.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Installer\\Always install with elevated privileges\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nMSI.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.82.3", "title": "18.10.82.3 Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled'", "description": "This policy setting controls whether Web-based programs are allowed to install software on the computer without notifying the user.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Installer\\Prevent Internet Explorer security prompt for Windows Installer scripts\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nMSI.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nDisable IE security prompt for Windows Installer scripts, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.83.1", "title": "18.10.83.1 Ensure 'Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.' is set to 'Disabled'", "description": "This policy setting controls whether winlogon includes a user's password in the content of Multiple Provider Router (MPR) notifications.\nMPR handles communication between the Windows operating system and the installed network providers. MPR checks the registry to determine which providers are installed on the system and the order they are cycled through.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Logon Options\\Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWinLogon.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates v1.0 (or newer).\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nEnable MPR notifications for the system, but it was renamed starting with the Windows 11 Release 22H2 Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.\n\nNote:\n\nIf Citrix Workspace App is used in the environment, an exception to this recommendation is needed. For further information, please visit:\n[Cumulative Update 2 (CU2) | Citrix Workspace™ app 2402 LTSR for Windows](https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/2402-ltsr/whats-new/cumulative-update-2).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.88.1", "title": "18.10.88.1 Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled'", "description": "This policy setting enables logging of all PowerShell script input to the\nApplications and Services Logs\\Microsoft\\Windows\\PowerShell\\Operational\n\nEvent Log channel.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nIf logging of\nScript Block Invocation Start/Stop Events is enabled (option box checked), PowerShell will log additional events when invocation of a command, script block, function, or script starts or stops. Enabling this option generates a high volume of event logs. CIS has intentionally chosen not to make a recommendation for this option, since it generates a large volume of events.\nIf an organization chooses to enable the optional setting (checked), this also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows PowerShell\\Turn on PowerShell Script Block Logging\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPowerShellExecutionPolicy.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\n### Impact\n\nPowerShell script input will be logged to the\nApplications and Services Logs\\Microsoft\\Windows\\PowerShell\\Operational\n\nEvent Log channel, which can contain credentials and sensitive information.\n\nNote:\n\nConfiguring this setting to\nEnabled generates a high volume of event logs which will be overwritten if the log size is not expanded or offloaded to a log collection system.\n\nWarning:\n\nThere are potential risks of capturing credentials and sensitive information in the\nPowerShell logs, which could be exposed to users who have read-access to those logs.\nMicrosoft provides a feature called \"Protected Event Logging\" to better secure event log data. For assistance with protecting event logging, visit:\n[About Logging Windows - PowerShell | Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.2#protected-event-logging).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.88.2", "title": "18.10.88.2 Ensure 'Turn on PowerShell Transcription' is set to 'Enabled'", "description": "This Policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows PowerShell\\Turn on PowerShell Transcription\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nPowerShellExecutionPolicy.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates\n(or newer).\n\n### Impact\n\nPowerShell transcript input will be logged to\nPowerShell_transcript output files, which are saved to the My Documents folder (within a separate subfolder for each day) of each users´ profile by default. Optionally, a specific output directory name can be specified, which will contain all PowerShell transcript logs in a subfolder of My Documents. If specifying a full path outside the users My Documents folder, other users on the system could have access to view these logs, which may contain sensitive information such as passwords.\n\nWarning:\n\nThere are potential risks of capturing credentials and sensitive information in\nPowerShell_transcript output files, which could be exposed to users who have read access to the files.\n\nWarning #2:\n\nPowerShell Transcription is not compatible with the natively installed PowerShell v4 on Microsoft Windows 10 Release 1511 and Server 2012 R2 and below. If this recommendation is set as prescribed, PowerShell will need to be updated to at least v5.1 or newer.\nFor more information on updating PowerShell, please see\n[Windows PowerShell System Requirements - PowerShell | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/scripting/windows-powershell/install/windows-powershell-system-requirements?view=powershell-7.3#operating-system-requirements).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.1.1", "title": "18.10.90.1.1 Ensure 'Allow Basic authentication' is set to 'Disabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Client\\Allow Basic authentication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.1.2", "title": "18.10.90.1.2 Ensure 'Allow unencrypted traffic' is set to 'Disabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Client\\Allow unencrypted traffic\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.1.3", "title": "18.10.90.1.3 Ensure 'Disallow Digest authentication' is set to 'Enabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Digest authentication.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Client\\Disallow Digest authentication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nThe WinRM client will not use Digest authentication.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.2.1", "title": "18.10.90.2.1 Ensure 'Allow Basic authentication' is set to 'Disabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Service\\Allow Basic authentication\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.2.2", "title": "18.10.90.2.2 Ensure 'Allow remote server management through WinRM' is set to 'Disabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Service\\Allow remote server management through WinRM\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nAllow automatic configuration of listeners, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates.\n\n### Impact\n\nRemote Management via the WinRM service will not be available.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.2.3", "title": "18.10.90.2.3 Ensure 'Allow unencrypted traffic' is set to 'Disabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Service\\Allow unencrypted traffic\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.90.2.4", "title": "18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled'", "description": "This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will allow RunAs credentials to be stored for any plug-ins.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nIf you enable and then disable this policy setting, any values that were previously configured for\nRunAsPassword will need to be reset.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Management (WinRM)\\WinRM Service\\Disallow WinRM from storing RunAs credentials\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsRemoteManagement.admx/adml that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative\nTemplates (or newer).\n\n### Impact\n\nThe WinRM service will not allow the\nRunAsUser or\nRunAsPassword configuration values to be set for any plug-ins. If a plug-in has already set the\nRunAsUser and\nRunAsPassword configuration values, the\nRunAsPassword configuration value will be erased from the credential store on the computer.\n\nIf this setting is later Disabled again, any values that were previously configured for\nRunAsPassword will need to be reset.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.91.1", "title": "18.10.91.1 Ensure 'Allow Remote Shell Access' is set to 'Disabled'", "description": "This policy setting allows you to manage configuration of remote access to all supported shells to execute scripts and commands.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nThe GPME help text for this setting is incorrectly worded, implying that configuring it to\nEnabled will reject new Remote Shell connections, and setting it to\nDisabled will allow Remote Shell connections. The opposite is true (and is consistent with the title of the setting). This is a wording mistake by Microsoft in the Administrative\nTemplate.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Remote Shell\\Allow Remote Shell Access\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsRemoteShell.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nNew Remote Shell connections are not allowed and are rejected by the server.\n\nNote:\n\nOn Server 2012 (non-R2) or newer, due to design changes in the OS after Server 2008\nR2, configuring this setting as prescribed will prevent the ability to add or remove\nRoles and Features (even locally) via the GUI. We therefore recommend that the necessary\nRoles and Features be installed prior to configuring this setting on a Level 2 server.\nAlternatively, Roles and Features can still be added or removed using the PowerShell commands\nAdd-WindowsFeature or\nRemove-WindowsFeature in the Server Manager module, even with this setting configured.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.93.2.1", "title": "18.10.93.2.1 Ensure 'Prevent users from modifying settings' is set to 'Enabled'", "description": "This policy setting prevent users from making changes to the Exploit protection settings area in the Windows Security settings.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Security\\App and browser protection\\Prevent users from modifying settings\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsDefenderSecurityCenter.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nLocal users cannot make changes in the Exploit protection settings area.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.94.1.1", "title": "18.10.94.1.1 Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled'", "description": "This policy setting specifies that Automatic Updates will wait for computers to be restarted by the users who are logged on to them to complete a scheduled installation.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nThis setting applies only when you configure Automatic Updates to perform scheduled update installations. If you configure the Configure Automatic Updates setting to\nDisabled, this setting has no effect.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Legacy Policies\\No auto-restart with logged on users for scheduled automatic updates installations\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsUpdate.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\nNote #2:\n\nIn older Microsoft Windows Administrative Templates, this setting was initially named\nNo auto-restart for scheduled Automatic Updates installations, but it was renamed starting with the Windows 7 & Server 2008 R2 Administrative Templates.\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.94.2.1", "title": "18.10.94.2.1 Ensure 'Configure Automatic Updates' is set to 'Enabled'", "description": "This policy setting specifies whether computers in your environment will receive security updates from Windows Update or WSUS. If you configure this policy setting to Enabled, the operating system will recognize when a network connection is available and then use the network connection to search Windows Update or your designated intranet site for updates that apply to them.\n\nAfter you configure this policy setting to Enabled, select one of the following four options in the Configure Automatic Updates Properties dialog box to specify how the service will work:\n\n-\n\n2 - Notify for download and auto install\n(Notify before downloading any updates)\n\n-\n\n3 - Auto download and notify for install\n(Download the updates automatically and notify when they are ready to be installed.)\n(Default setting)\n\n-\n\n4 - Auto download and schedule the install\n(Automatically download updates and install them on the schedule specified below.))\n\n-\n\n5 - Allow local admin to choose setting\n(Leave decision on above choices up to the local Administrators (Not Recommended))\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThe sub-setting \"\nConfigure automatic updating:\n\n\" has 4 possible values – all of them are valid depending on specific organizational needs, however if feasible we suggest using a value of\n4 - Auto download and schedule the install. This suggestion is not a scored requirement.\n\nNote #2:\n\nOrganizations that utilize a third-party solution for patching may choose to exempt themselves from this recommendation, and instead configure it to\nDisabled so that the native Windows Update mechanism does not interfere with the third-party patching process.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage end user experience\\Configure Automatic Updates\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsUpdate.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nCritical operating system updates and service packs will be installed as necessary.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.94.2.2", "title": "18.10.94.2.2 Ensure 'Configure Automatic Updates: Scheduled install day' is set to '0 - Every day'", "description": "This policy setting specifies when computers in your environment will receive security updates from Windows Update or WSUS.\n\nThe recommended state for this setting is:\n0 - Every day.\n\nNote:\n\nThis setting is only applicable if\n4 - Auto download and schedule the install is selected in recommendation 'Configure Automatic Updates'. It will have no impact if any other option is selected.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n0 - Every day:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage end user experience\\Configure Automatic Updates: Scheduled install day\n```\n\nNote:\n\nThis Group Policy path is provided by the Group Policy template\nWindowsUpdate.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.\n\n### Impact\n\nIf\n4 - Auto download and schedule the install is selected in recommendation 'Configure Automatic Updates', critical operating system updates and service packs will automatically download every day (at 3:00 A.M., by default).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.94.4.1", "title": "18.10.94.4.1 Ensure 'Manage preview builds' is set to 'Disabled'", "description": "This policy setting manages which updates that are received prior to the update being released.\n\nDev Channel:\n\nIdeal for highly technical users. Insiders in the Dev Channel will receive builds from our active development branch that is earliest in a development cycle. These builds are not matched to a specific Windows 10 release.\n\nBeta Channel:\n\nIdeal for feature explorers who want to see upcoming Windows 10 features. Your feedback will be especially important here as it will help our engineers ensure key issues are fixed before a major release.\n\nRelease Preview Channel (default):\n\nInsiders in the Release Preview Channel will have access to the upcoming release of\nWindows 10 prior to it being released to the world. These builds are supported by\nMicrosoft. The Release Preview Channel is where we recommend companies preview and validate upcoming Windows 10 releases before broad deployment within their organization.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nPreview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see:\n[Managing preview builds across your organization - Windows Insider Program | Microsoft Learn](https://learn.microsoft.com/en-us/windows-insider/business/manage-builds).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage updates offered from Windows Update\\Manage preview builds\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsUpdate.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates\n(or newer).\n\n### Impact\n\nPreview builds are prevented from installing on the device.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.10.94.4.2", "title": "18.10.94.4.2 Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days'", "description": "This settings controls when Quality Updates are received.\n\nThe recommended state for this setting is:\nEnabled: 0 days.\n\nNote:\n\nIf the \"Allow Diagnostic Data\" (formerly \"Allow Telemetry\") policy is set to 0, this policy will have no effect.\n\nNote #2:\n\nStarting with Windows Server 2016 RTM (Release 1607), Microsoft introduced a new Windows\nUpdate (WU) client behavior called\nDual Scan, with an eye to cloud-based update management. In some cases, this Dual Scan feature can interfere with Windows Updates from Windows Server Update Services (WSUS) and/or manual WU updates. If you are using WSUS in your environment, you may need to set the above setting to\nNot Configured or configure the setting\nDo not allow update deferral policies to cause scans against Windows Update\n\n(added in the Windows 10 Release 1709 Administrative Templates) in order to prevent the Dual Scan feature from interfering. More information on Dual Scan is available at these links:\n\n- [Demystifying “Dual Scan” – WSUS Product Team Blog](https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/)\n\n- [Improving Dual Scan on 1607 – WSUS Product Team Blog](https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:0 days:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Update\\Manage updates offered from Windows Update\\Select when Quality Updates are received\n```\n\nNote:\n\nThis Group Policy path may not exist by default. It is provided by the Group Policy template\nWindowsUpdate.admx/adml that is included with the Microsoft Windows 10 Release 1607 & Server 2016 Administrative\nTemplates (or newer).\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.11.1", "title": "18.11.1 Ensure 'Disable HTTP proxy features: Disable WPAD' is set to 'Enabled: Checked'", "description": "This policy setting determines whether Web Proxy Auto-Discovery protocol (WPAD) is disabled on the system. WPAD is used to discover Proxy Auto-Config (PAC) files from the local network.\n\nThe recommended state for this setting is:\nEnabled: Checked.\n\nNote:\n\nWhen this recommendation is set as prescribed, applications can still resolve the name WPAD by calling Domain Name System (DNS) directly.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Checked:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Center for Internet Security (CIS)\\Additional Benchmark Settings\\Disable HTTP proxy features: Disable WPAD\n```\n\nNote:\n\nThis Group Policy path is\nNOT provided by Microsoft. The Group Policy template\nCIS.admx/adml is included with the CIS Microsoft Windows Build Kits published after January 2026.\n\n### Impact\n\nAfter WPAD is disabled, all proxies must be manually configured. The registry key created by this recommendation stops WPAD detection for all proxy detection calls made through the Windows HTTP Services (WinHTTP) application programming interface\n(API).", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "18.11.2", "title": "18.11.2 Ensure 'Disable HTTP proxy features: Disable proxy authentication' is set to 'Enabled: Disable authentication over loopback interfaces' or higher", "description": "This policy setting determines whether Windows can authenticate over a loopback interface.\n\nThe recommended state for this setting is:\nEnabled: Disable authentication over loopback interfaces. Configuring this setting to\nDisable all authentication protocols and loopback authentication also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled: Disable authentication over loopback interfaces or\nDisable all authentication protocols and loopback authentication:\n\n```\nComputer Configuration\\Policies\\Administrative Templates\\Center for Internet Security (CIS)\\Additional Benchmark Settings\\Disable HTTP proxy features: Disable proxy authentication\n```\n\nNote:\n\nThis Group Policy path is\nNOT provided by Microsoft. The Group Policy template\nCIS.admx/adml is included with the CIS Microsoft Windows Build Kits published after January 2026.\n\n### Impact\n\nWindows will not be able to authenticate over a loopback interface", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.45", "title": "2.2.45 Ensure 'Restore files and directories' is set to 'Administrators'", "description": "This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on systems that run Windows Vista (or newer).\n\nThis user right also determines which users can set valid security principals as object owners; it is similar to the Back up files and directories user right.\n\nThe recommended state for this setting is:\nAdministrators.\n\nNote:\n\nThis user right is considered a \"sensitive privilege\" for the purposes of auditing.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Restore files and directories\n```\n\n### Impact\n\nRemoving the \"Restore files and directories\" user right from the Backup Operators group or other delegated accounts may prevent authorized users from performing essential tasks. Before making this change, it's important to assess whether it will disrupt operational responsibilities.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.2.46", "title": "2.2.46 Ensure 'Shut down the system' is set to 'Administrators'", "description": "This policy setting determines which users who are logged on locally to the computers in your environment can shut down the operating system with the Shut Down command.\nMisuse of this user right can result in a denial-of-service condition.\n\nThe recommended state for this setting is:\nAdministrators.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAdministrators:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Shut down the system\n```\n\n### Impact\n\nThe impact of removing these default groups from the\nShut down the system user right could limit the delegated abilities of assigned roles in your environment.\nYou should confirm that delegated activities will not be adversely affected.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.1.3", "title": "2.3.1.3 Configure 'Accounts: Rename administrator account'", "description": "This policy setting enables the ability to rename the built-in local administrator account. This account is a well-known account that is known to be targeted by threat actors.\n\nIt is recommended to choose another name for this account, and to avoid names that denote administrative or elevated access accounts. Be sure to also change the default description for the local administrator (through the Computer Management console).", "recommendation": "To establish the recommended configuration via GP, configure the following UI path:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Accounts: Rename administrator account\n```\n\n### Impact\n\nUsers who are authorized to use this account will need to be aware of the new account name. (The guidance for this setting assumes that the Administrator account was not disabled, which was recommended earlier in this chapter.)", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.1.4", "title": "2.3.1.4 Configure 'Accounts: Rename guest account'", "description": "This policy setting enables the ability to rename the built-in local guest account.\nThis account is a well-known account that is known to be targeted by threat actors.\n\nIt is recommended to rename this account to something that does not indicate its purpose, even if this account is disabled.\n\nOn Domain Controllers, since they do not have their own local accounts, this rule refers to the built-in Guest account that was established when the domain was first created.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Accounts: Rename guest account\n```\n\n### Impact\n\nThere should be little impact, because the Guest account is disabled by default.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.2.1", "title": "2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled'", "description": "This policy setting allows administrators to enable the more precise auditing capabilities present in Windows Vista.\n\nThe Audit Policy settings available in Windows Server 2003 Active Directory do not yet contain settings for managing the new auditing subcategories. To properly apply the auditing policies prescribed in this baseline, the Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings setting needs to be configured to Enabled.\n\nThe recommended state for this setting is:\nEnabled.\n\nImportant:\n\nBe very cautious about audit settings that can generate a large volume of traffic.\nFor example, if you enable either success or failure auditing for all of the Privilege\nUse subcategories, the high volume of audit events generated can make it difficult to find other types of entries in the Security log. Such a configuration could also have a significant impact on system performance.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.5.1", "title": "2.3.5.1 Ensure 'Domain controller: Allow server operators to schedule tasks' is set to 'Disabled' (DC only)", "description": "This policy setting determines whether members of the Server Operators group are allowed to submit jobs by means of the AT schedule facility. The impact of this policy setting configuration should be small for most organizations. Users, including those in the\nServer Operators group, will still be able to create jobs by means of the Task Scheduler\nWizard, but those jobs will run in the context of the account with which the user authenticates when they set up the job.\n\nNote:\n\nAn AT Service Account can be modified to select a different account rather than the\nLOCAL SYSTEM account. To change the account, open System Tools, click Scheduled Tasks, and then click Accessories folder. Then click AT Service Account on the Advanced menu.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: Allow server operators to schedule tasks\n```\n\n### Impact\n\nNone - this is the default behavior. Note that users (including those in the Server\nOperators group) are still able to create jobs by means of the Task Scheduler Wizard.\nHowever, those jobs will run in the context of the account that the user authenticates with when setting up the job.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.5.3", "title": "2.3.5.3 Ensure 'Domain controller: LDAP server channel binding token requirements' is set to 'Always' (DC Only)", "description": "This policy setting determines whether the LDAP server (Domain Controller) enforces validation of Channel Binding Tokens (CBT) received in LDAP bind requests that are sent over SSL/TLS (i.e. LDAPS).\n\nThe recommended state for this setting is:\nAlways.\n\nNote:\n\nAll LDAP clients must have the\n[CVC-2017-8563](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8563) security update to be compatible with Domain Controllers that have this setting enabled.\nMore information on this setting is available at:\n[MSKB 4520412: 2020 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows)", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAlways:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: LDAP server channel binding token requirements\n```\n\nNote:\n\nThis Group Policy path requires the installation of the March 2020 (or later) Windows security update. With that update, Microsoft added this setting to the built-in OS security template.\n\n### Impact\n\nAll LDAP clients must provide channel binding information over SSL/TLS (i.e. LDAPS).\nThe LDAP server (Domain Controller) rejects authentication requests from clients that do not do so. Clients must have the\n[CVC-2017-8563](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8563) security update to support this feature, and may have compatibility issues with this setting without the security update. This may also mean that LDAP authentication requests over SSL/TLS that previously worked may stop working until the security update is installed.\n\nWhen first deploying this setting, you may initially want to only set it to the alternate setting of\nWhen supported\n\n(instead of\nAlways) on all Domain Controllers. This alternate, interim setting enables support for LDAP client channel binding but does not require it. Then set one DC that is not currently being targeted by LDAP clients to\nAlways, and test each of the critical LDAP clients against that DC (and remediating as necessary), before deploying\nAlways to the rest of the DCs.\n\nWe also recommend using the new Event ID 3039 on your Domain Controllers (added with the March 2020 security update) to help locate clients that do not use Channel Binding\nTokens (CBT) in their LDAPS connections. This new Event ID requires increasing the logging level of the\n16 LDAP Interface Events portion of the NTDS service diagnostics to a value of\n2\n\n(Basic). For more information, please see\nTable 2: CBT events at this link:\n[MSKB 4520412: 2020 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows)\n\nOlder OSes such as Windows XP, Windows Server 2003, Windows Vista and Windows Server\n2008 (non-R2), will first require patches for\n[Microsoft Security Advisory 973811](https://technet.microsoft.com/library/security/973811), as well as all associated fixes, in order to be compatible with domain controllers that have this setting deployed.\n\nNote:\n\nOnly\nAlways is actually considered compliant to the CIS benchmark.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.5.4", "title": "2.3.5.4 Ensure 'Domain controller: LDAP server signing requirements Enforcement' is set to 'Enabled' (DC only)", "description": "This policy setting determines whether the Lightweight Directory Access Protocol (LDAP) server requires LDAP clients to negotiate data signing.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nThis policy setting overlaps\nDomain controller: LDAP server signing requirements. CIS has decided to adopt both to\nRequire signing as a failsafe.\n\nNote #2:\n\nDomain member computers must have\nNetwork security: LDAP signing requirements\n\n(Section 2.3.11) set to\nNegotiate signing or higher. If not, they will fail to authenticate once the above\nRequire signing value is configured on the Domain Controllers. Fortunately,\nNegotiate signing is the default in the client configuration.\n\nNote #3:\n\nThis policy setting does not have any impact on LDAP simple bind ( ldap_simple_bind) or LDAP simple bind through SSL ( ldap_simple_bind_s). No Microsoft LDAP clients that are shipped with Windows XP Professional use LDAP simple bind or LDAP simple bind through SSL to talk to a Domain Controller.\n\nNote #4:\n\nBefore enabling this setting, ensure that there are no clients (including server-based applications) that are configured to authenticate with Active Directory via unsigned\nLDAP, because changing this setting will break those applications. Such applications should first be reconfigured to use signed\n[LDAP, Secure LDAP (LDAPS), or IPsec-protected connections](https://support.microsoft.com/en-us/topic/frequently-asked-questions-about-changes-to-lightweight-directory-access-protocol-41a40287-810a-e799-d067-f578fca055fc).", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: LDAP server signing requirements Enforcement\n```\n\n### Impact\n\nUnless TLS/SSL is being used, the LDAP data signing option must be negotiated. Clients that do not support LDAP signing will be unable to run LDAP queries against the Domain\nControllers. All Windows 2000-based computers in your organization that are managed from Windows Server 2003-based or Windows XP-based computers and that use Windows\nNT Challenge/Response (NTLM) authentication must have Windows 2000 Service Pack 3\n(SP3) installed. Alternatively, these clients must have a registry change.\n\nSome non-Microsoft operating systems do not support LDAP signing. If you enable this policy setting, client computers that use those operating systems may be unable to access domain resources. More information about this registry change was published in Microsoft Knowledge Base article 325465.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.5.5", "title": "2.3.5.5 Ensure 'Domain controller: Refuse machine account password changes' is set to 'Disabled' (DC only)", "description": "This security setting determines whether Domain Controllers will refuse requests from member computers to change computer account passwords.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nSome problems can occur as a result of machine account password expiration, particularly if a machine is reverted to a previous point-in-time state, as is common with virtual machines. Depending on how far back the reversion is, the older machine account password stored on the machine may no longer be recognized by the domain controllers, and therefore the computer loses its domain trust. This can also disrupt non-persistent VDI implementations, and devices with write filters that disallow permanent changes to the OS volume. Some organizations may choose to exempt themselves from this recommendation and disable machine account password expiration for these situations.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: Refuse machine account password changes\n```\n\n### Impact\n\nNone - this is the default behavior.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "1.2.1", "title": "1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)'", "description": "This policy setting determines the length of time that must pass before a locked account is unlocked and a user can try to log on again. The setting does this by specifying the number of minutes a locked-out account will remain unavailable. If the value for this policy setting is configured to 0, locked out accounts will remain locked out until an administrator manually unlocks them.\n\nAlthough it might seem like a good idea to configure the value for this policy setting to a high value, such a configuration will likely increase the number of calls that the help desk receives to unlock accounts locked by mistake. Users should be aware of the length of time a lock remains in place, so that they realize they only need to call the help desk if they have an extremely urgent need to regain access to their computer.\n\nThe recommended state for this setting is:\n15 or more minute(s).\n\nNote:\n\nPassword Policy settings (section 1.1) and Account Lockout Policy settings (section\n1.2) must be applied via the\nDefault Domain Policy\n\nGPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another\nGPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative\nCenter.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n15 or more minute(s):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout duration\n```\n\n### Impact\n\nAlthough it may seem like a good idea to configure this policy setting to never automatically unlock an account, such a configuration can increase the number of requests that your organization's help desk receives to unlock accounts that were locked by mistake.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.7.2", "title": "2.3.7.2 Ensure 'Interactive logon: Don't display last signed-in' is set to 'Enabled'", "description": "This policy setting determines whether the account name of the last user to log on to the client computers in your organization will be displayed on each computer's respective Windows logon screen.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Interactive logon: Don't display last signed-in\n```\n\nNote:\n\nIn older versions of Microsoft Windows, this setting was named\nInteractive logon: Do not display last user name, but it was renamed starting with Windows Server 2019.\n\n### Impact\n\nThe name of the last user to successfully log on will not be displayed in the Windows logon screen.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.7.3", "title": "2.3.7.3 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'", "description": "Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.\n\nThe recommended state for this setting is:\n900 or fewer second(s), but not 0.\n\nNote:\n\nA value of\n0 does not conform to the benchmark as it disables the machine inactivity limit.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n900 or fewer seconds, but not 0:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Interactive logon: Machine inactivity limit\n```\n\n### Impact\n\nThe screen saver will automatically activate when the computer has been unattended for the amount of time specified. The impact should be minimal since the screen saver is enabled by default.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.7.4", "title": "2.3.7.4 Configure 'Interactive logon: Message text for users attempting to log on'", "description": "This policy setting specifies a text message that is display to users when they log on. Configure this setting in a manner that is consistent with the security and operational requirements of the organization.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to a value that is consistent with the security and operational requirements of your organization:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Interactive logon: Message text for users attempting to log on\n```\n\n### Impact\n\nUsers will have to acknowledge a dialog box containing the configured text before they can log on to the computer.\n\nNote:\n\nWindows Vista and Windows XP Professional support logon banners that can exceed 512 characters in length and that can also contain carriage-return line-feed sequences.\nHowever, Windows 2000-based clients cannot interpret and display these messages. You must use a Windows 2000-based computer to create a logon message policy that applies to Windows 2000-based computers.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.7.5", "title": "2.3.7.5 Configure 'Interactive logon: Message title for users attempting to log on'", "description": "This policy setting specifies the text displayed in the title bar of the window that is displayed to users when they log on to the system. Configure this setting in a manner that is consistent with the security and operational requirements of the organization.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path to a value that is consistent with the security and operational requirements of your organization:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Interactive logon: Message title for users attempting to log on\n```\n\n### Impact\n\nUsers will have to acknowledge a dialog box with the configured title before they can log on to the computer.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "1.2.2", "title": "1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'", "description": "This policy setting determines the number of failed logon attempts before the account is locked.\n\nThe recommended state for this setting is:\n5 or fewer invalid logon attempt(s), but not 0.\n\nNote:\n\nA value of\n0 does not conform to the benchmark as it disables account lockout threshold.\n\nNote #2:\n\nPassword Policy settings (section 1.1) and Account Lockout Policy settings (section\n1.2) must be applied via the\nDefault Domain Policy\n\nGPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another\nGPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative\nCenter.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n5 or fewer invalid login attempt(s), but not 0:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout threshold\n```\n\n### Impact\n\nIf this policy setting is enabled, a locked-out account will not be usable until it is reset by an administrator or until the account lockout duration expires. This setting may generate additional help desk calls.\n\nIf you enforce this setting a threat actor could cause a denial-of-service condition by deliberately generating failed logons for multiple users, therefore you should also configure the Account Lockout Duration to a relatively low value.\n\nIf the Account Lockout Threshold is set to 0, there is a possibility that a threat actor's attempt to discover passwords with a brute force password attack might go undetected if a robust audit mechanism is not in place.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.7.9", "title": "2.3.7.9 Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation' or higher", "description": "This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader.\n\nThe recommended state for this setting is:\nLock Workstation. Configuring this setting to\nForce Logoff or\nDisconnect if a Remote Desktop Services session also conforms to the benchmark.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nLock Workstation,\nForce Logoff or\nDisconnect if a Remote Desktop Services session:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Interactive logon: Smart card removal behavior\n```\n\n### Impact\n\nIf you select\nLock Workstation, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.\n\nIf you select\nForce Logoff, users are automatically logged off when their smart card is removed.\n\nIf you select\nDisconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the users off.\nThis allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy will function identically to\nLock Workstation.\n\nEnforcing this setting on computers used by people who must log onto multiple computers in order to perform their duties could be frustrating and lower productivity. For example, if network administrators are limited to a single account but need to log into several computers simultaneously in order to effectively manage the network enforcing this setting will limit them to logging onto one computer at a time. For these reasons it is recommended that this setting only be enforced on workstations used for purposes commonly associated with typical users such as document creation and email.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.8.1", "title": "2.3.8.1 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'", "description": "This policy setting determines whether packet signing is required by the Server Message\nBlock (SMB) client component. SMB is the resource sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols.\nSMB signatures authenticate both users and the servers that host the data. If either side fails the authentication process, data transmission will not take place.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Microsoft network client: Digitally sign communications (always)\n```\n\n### Impact\n\nThe Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing.\n\nImplementation of SMB signing may negatively affect performance, because each packet needs to be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a Domain\nController, file server, print server, and application server performance may be substantially slowed. Additionally, if computers are configured to ignore all unsigned SMB communications, older applications and operating systems will not be able to connect. However, if\nSMB signing is completely disabled, computers will be vulnerable to session hijacking attacks.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.10.4", "title": "2.3.10.4 Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'", "description": "This policy setting determines whether Credential Manager (formerly called Stored\nUser Names and Passwords) saves passwords or credentials for later use when it gains domain authentication.\n\nThe recommended state for this setting is:\nEnabled.\n\nNote:\n\nChanges to this setting will not take effect until Windows is restarted.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network access: Do not allow storage of passwords and credentials for network authentication\n```\n\n### Impact\n\nCredential Manager will not store passwords and credentials on the computer. Users will be forced to enter passwords whenever they log on to their Passport account or other network resources that aren't accessible to their domain account. Testing has shown that clients running Windows Vista or Windows Server 2008 will be unable to connect to Distributed File System (DFS) shares in untrusted domains. Enabling this setting also makes it impossible to specify alternate credentials for scheduled tasks, this can cause a variety of problems. For example, some third-party backup products will no longer work. This policy setting should have no impact on users who access network resources that are configured to allow access with their Active Directory-based domain account.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "1.2.4", "title": "1.2.4 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'", "description": "This policy setting determines the length of time before the Account lockout threshold resets to zero. The default value for this policy setting is Not Defined. If the Account lockout threshold is defined, this reset time must be less than or equal to the value for the Account lockout duration setting.\n\nThe recommended state for this setting is:\n15 or more minute(s).\n\nNote:\n\nPassword Policy settings (section 1.1) and Account Lockout Policy settings (section\n1.2) must be applied via the\nDefault Domain Policy\n\nGPO in order to be globally in effect on domain user accounts as their default behavior. If these settings are configured in another\nGPO, they will only affect local user accounts on the computers that receive the GPO. However, custom exceptions to the default password policy and account lockout policy rules for specific domain users and/or groups can be defined using Password Settings Objects (PSOs), which are completely separate from Group Policy and most easily configured using Active Directory Administrative\nCenter.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\n15 or more minute(s):\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Reset account lockout counter after\n```\n\n### Impact\n\nUsers can accidentally lock themselves out of their accounts if they mistype their password multiple times.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.10.6", "title": "2.3.10.6 Ensure 'Network access: Named Pipes that can be accessed anonymously' is configured (DC only)", "description": "This policy setting determines which communication sessions, or pipes, will have attributes and permissions that allow anonymous access.\n\nThe recommended state for this setting is:\nLSARPC, NETLOGON, SAMR and (when the legacy\nComputer Browser service is enabled)\nBROWSER.\n\nNote:\n\nA Member Server that holds the\nRemote Desktop Services\n\nRole with\nRemote Desktop Licensing\n\nRole Service will require a special exception to this recommendation, to allow the\nHydraLSPipe and\nTermServLicensing\n\nNamed Pipes to be accessed anonymously.", "recommendation": "To establish the recommended configuration via GP, configure the following UI path:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network access: Named Pipes that can be accessed anonymously\n```\n\n### Impact\n\nNull session access over named pipes will be disabled unless they are included, and applications that rely on this feature or on unauthenticated access to named pipes will no longer function. The\nBROWSER named pipe may need to be added to this list if the\nComputer Browser service is needed for supporting legacy components. The\nComputer Browser service is disabled by default.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.1", "title": "2.3.11.1 Ensure 'Network security: Allow Local System to use computer identity for NTLM' is set to 'Enabled'", "description": "This policy setting determines whether Local System services that use Negotiate when reverting to NTLM authentication can use the computer identity. This policy is supported on at least Windows 7 or Windows Server 2008 R2.\n\nThe recommended state for this setting is:\nEnabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Allow Local System to use computer identity for NTLM\n```\n\n### Impact\n\nServices running as Local System that use Negotiate when reverting to NTLM authentication will use the computer identity. This might cause some authentication requests between\nWindows operating systems to fail and log an error.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.2", "title": "2.3.11.2 Ensure 'Network security: Allow LocalSystem NULL session fallback' is set to 'Disabled'", "description": "This policy setting determines whether NTLM is allowed to fall back to a NULL session when used with LocalSystem.\n\nThe recommended state for this setting is:\nDisabled.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Allow LocalSystem NULL session fallback\n```\n\n### Impact\n\nAny applications that require NULL sessions for LocalSystem will not work as designed.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.3", "title": "2.3.11.3 Ensure 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' is set to 'Disabled'", "description": "This setting determines if online identities are able to authenticate to this computer.\n\nThe Public Key Cryptography Based User-to-User (PKU2U) protocol introduced in Windows\n7 and Windows Server 2008 R2 is implemented as a security support provider (SSP).\nThe SSP enables peer-to-peer authentication, particularly through the Windows 7 media and file sharing feature called HomeGroup, which permits sharing between computers that are not members of a domain.\n\nWith PKU2U, a new extension was introduced to the Negotiate authentication package,\nSpnego.dll. In previous versions of Windows, Negotiate decided whether to use Kerberos or NTLM for authentication. The extension SSP for Negotiate,\nNegoexts.dll, which is treated as an authentication protocol by Windows, supports Microsoft SSPs including PKU2U.\n\nWhen computers are configured to accept authentication requests by using online IDs,\nNegoexts.dll calls the PKU2U SSP on the computer that is used to log on. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer computers. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation and associates the user's certificate to a security token and the logon process completes.\n\nThe recommended state for this setting is:\nDisabled.\n\nNote:\n\nIf a hybrid environment is used, and PKU2U is\nDisabled, Remote Desktop connections from a hybrid joined system to a hybrid joined system will fail.\n\nNote #2:\n\nIf the failover clustering role is installed, and PKU2U is\nDisabled, failover clustering will not function properly.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nDisabled:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network Security: Allow PKU2U authentication requests to this computer to use online identities\n```\n\n### Impact\n\nNone - this is the default configuration for domain-joined computers.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.4", "title": "2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'", "description": "This policy setting allows you to set the encryption types that Kerberos is allowed to use.\n\nThe recommended state for this setting is:\nAES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types.\n\nNote:\n\nSome legacy applications and OSes may still require\nRC4_HMAC_MD5\n\n- we recommend you test in your environment and verify whether you can safely remove it.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Configure encryption types allowed for Kerberos\n```\n\n### Impact\n\nIf not selected, the encryption type will not be allowed. This setting may affect compatibility with client computers or services and applications. Multiple selections are permitted.\n\nNote:\n\nSome legacy applications and OSes may still require\nRC4_HMAC_MD5\n\n- we recommend you test in your environment and verify whether you can safely remove it.\n\nNote #2:\n\nWindows Server 2008 (non-R2) and below allow DES for Kerberos by default, but later\nOS versions do not.\n\nNote #3:\n\nSome prerequisites might need to be met on Domain Controllers to support Kerberos\nAES 128 and 256 bit encryption types, as well as enabling support for Kerberos AES\n128 and 256 bit on user accounts (in account options) for this recommendation to work correctly.\n\nNote #4:\n\nIf your organization uses Azure Files, please note that Microsoft did not introduce\nAES 256 Kerberos encryption support for it until AD DS authentication module v0.2.2.\nPlease see this link for more information:\n[Troubleshoot Azure Files identity-based authentication and authorization issues (SMB) - Azure | Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/security/files-troubleshoot-smb-authentication?tabs=azure-portal)", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.6", "title": "2.3.11.6 Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM'", "description": "This policy setting determines which challenge or response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers.\n\nLAN Manager (LM) is a family of early Microsoft client/server software (predating\nWindows NT) that allowed users to link personal computers together on a single network.\nLM network capabilities included transparent file and print sharing, user security features, and network administration tools. In Active Directory domains, the Kerberos protocol is the default authentication protocol. However, if the Kerberos protocol is not negotiated for some reason, Active Directory will use LM, NTLM, or NTLMv2.\nLAN Manager authentication includes the LM, NTLM, and NTLM version 2 (NTLMv2) variants, and is the protocol that is used to authenticate all Windows clients when they perform the following operations:\n\n- Join a domain\n\n- Authenticate between Active Directory forests\n\n- Authenticate to down-level domains\n\n- Authenticate to computers that do not run Windows 2000, Windows Server 2003, or Windows\nXP\n\n- Authenticate to computers that are not in the domain\n\nThe recommended state for this setting is:\nSend NTLMv2 response only. Refuse LM & NTLM.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to:\nSend NTLMv2 response only. Refuse LM & NTLM:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: LAN Manager authentication level\n```\n\n### Impact\n\nClients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; Domain Controllers refuse LM and NTLM (accept only NTLMv2 authentication).\nClients that do not support NTLMv2 authentication will not be able to authenticate in the domain and access domain resources by using LM and NTLM.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.9", "title": "2.3.11.9 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security, Require 128-bit encryption'", "description": "This policy setting determines which behaviors are allowed by clients for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services. The setting does not modify how the authentication sequence works but instead require certain behaviors in applications that use the SSPI.\n\nThe recommended state for this setting is:\nRequire NTLMv2 session security, Require 128-bit encryption.\n\nNote:\n\nThese values are dependent on the\nNetwork security: LAN Manager Authentication Level\n\n(Rule 2.3.11.7) security setting value.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nRequire NTLMv2 session security, Require 128-bit encryption:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Minimum session security for NTLM SSP based (including secure RPC) clients\n```\n\n### Impact\n\nNTLM connections will fail if NTLMv2 protocol and strong encryption (128-bit) are not both negotiated. Client applications that are enforcing these settings will be unable to communicate with older servers that do not support them.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.10", "title": "2.3.11.10 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security, Require 128-bit encryption'", "description": "This policy setting determines which behaviors are allowed by servers for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services. The setting does not modify how the authentication sequence works but instead require certain behaviors in applications that use the SSPI.\n\nThe recommended state for this setting is:\nRequire NTLMv2 session security, Require 128-bit encryption.\n\nNote:\n\nThese values are dependent on the\nNetwork security: LAN Manager Authentication Level\n\n(Rule 2.3.11.7) security setting value.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nRequire NTLMv2 session security, Require 128-bit encryption:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\n```\n\n### Impact\n\nNTLM connections will fail if NTLMv2 protocol and strong encryption (128-bit) are not both negotiated. Server applications that are enforcing these settings will be unable to communicate with older servers that do not support them.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.11", "title": "2.3.11.11 Ensure 'Network security: Restrict NTLM: Audit Incoming NTLM Traffic' is set to 'Enable auditing for all accounts'", "description": "This policy setting allows the auditing of incoming NTLM traffic. Events for this setting are recorded in the operational event log (e.g. Applications and Services\nLog\\Microsoft\\Windows\\NTLM).\n\nThe recommended state for this setting is:\nEnable auditing for all accounts.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnable auditing for all accounts:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Restrict NTLM: Audit Incoming NTLM Traffic\n```\n\n### Impact\n\nThe event log will contain information on incoming NTLM authentication traffic.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.12", "title": "2.3.11.12 Ensure 'Network security: Restrict NTLM: Audit NTLM authentication in this domain' is set to 'Enable all' (DC only)", "description": "This policy setting allows auditing of NTLM authentication within the domain from the Domain Controller.\n\nThe recommended state for this setting is:\nEnable all.\n\nNote:\n\nThis setting is specific to each Domain Controller and will only log authentications made to that Domain Controller.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nEnable all:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Restrict NTLM: Audit NTLM authentication in this domain\n```\n\n### Impact\n\nThe event log will contain information on NTLM authentication traffic made to that\nDomain Controller.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" }, { "id": "2.3.11.13", "title": "2.3.11.13 Ensure 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' is set to 'Audit all' or higher", "description": "This policy setting allows the auditing of outgoing NTLM traffic. Events for this setting are recorded in the operational event log (e.g. Applications and Services\nLog\\Microsoft\\Windows\\NTLM).\n\nThe recommended state for this setting is:\nAudit all. Configuring this setting to\nDeny All also conforms to the benchmark.\n\nNote:\n\nConfiguring this setting to\nDeny All is more secure, however it could have a negative impact on applications that still require NTLM. Test carefully before implementing the\nDeny All value.", "recommendation": "To establish the recommended configuration via GP, set the following UI path to\nAudit all or\nDeny All:\n\n```\nComputer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers\n```\n\n### Impact\n\nThe event log will contain information on outgoing NTLM authentication traffic.", "severity": "unknown", "outcome": "fail", "resultType": "compliance_check", "isIoe": false, "deviation": true, "tool": "cis-cat" } ], "notRunChecks": [ { "id": "CIS.M365.1.2.2", "title": "Ensure sign-in to shared mailboxes is blocked", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.1.3.6", "title": "Ensure the customer lockbox feature is enabled", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.11", "title": "Ensure comprehensive attachment filtering is applied", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.4", "title": "Ensure Safe Attachments policy is enabled (Only Checks Default Policy)", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.5", "title": "Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.9", "title": "Ensure that DKIM is enabled for all Exchange Online Domains", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.3.1.1", "title": "Ensure Microsoft 365 audit log search is Enabled", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.8.4.1", "title": "Ensure all or a majority of third-party and custom apps are blocked", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.AAD.5.4", "title": "Group owners SHALL NOT be allowed to consent to applications.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.1.1", "title": "Automatic forwarding to external domains SHALL be disabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.10.1", "title": "Emails SHALL be scanned for malware.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.10.2", "title": "Emails identified as containing malware SHALL be quarantined or dropped.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.10.3", "title": "Email scanning SHALL be capable of reviewing emails after delivery.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.11.1", "title": "Impersonation protection checks SHOULD be used.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.13.1", "title": "Mailbox auditing SHALL be enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.14.1", "title": "A spam filter SHALL be enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.15.2", "title": "Direct download links SHOULD be scanned for malware.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.16.1", "title": "Alerts SHALL be enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.17.1", "title": "Microsoft Purview Audit (Standard) logging SHALL be enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.4.2", "title": "The DMARC message rejection option SHALL be p=reject.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.5.1", "title": "SMTP AUTH SHALL be disabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.8.1", "title": "A DLP solution SHALL be used.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.8.4", "title": "At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.9.3", "title": "Disallowed file types SHALL be determined and enforced.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.9.5", "title": "At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.AF05", "title": "Authentication Method - FIDO2 security key - Restricted.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.CP01", "title": "Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.CR04", "title": "Consent Framework - Admin Consent Request - Consent request duration (days).", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1021", "title": "Security Defaults are enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1033.0", "title": "User should be blocked from using legacy authentication ([redacted-email])", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1033.1", "title": "User should be blocked from using legacy authentication ([redacted-email])", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1033.2", "title": "User should be blocked from using legacy authentication ([redacted-email])", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1033.3", "title": "User should be blocked from using legacy authentication ([redacted-email])", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1037", "title": "Only users with Presenter role are allowed to present in Teams meetings", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1041", "title": "Ensure users installing Outlook add-ins is not allowed", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1044", "title": "Ensure modern authentication for Exchange Online is enabled", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1050", "title": "Apps with high-risk permissions having a direct path to Global Admin", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1051", "title": "Apps with high-risk permissions having an indirect path to Global Admin", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1063", "title": "All App registration owners should have MFA registered", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1076", "title": "MOERA SHOULD NOT be used for sent mail", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1087", "title": "Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.104", "title": "High Confidence Phish action set to Quarantine message.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.111", "title": "Anti-phishing policy exists and EnableUnauthenticatedSender is true.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.114", "title": "No IP Allow Lists have been configured.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.118.1", "title": "Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.118.2", "title": "Domains are not being allow listed in an unsafe manner in Transport Rules.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.124", "title": "Safe attachments unknown malware response set to block messages.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.140", "title": "High Confidence Spam action set to Quarantine message.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.189.2", "title": "Safe Links is not bypassed.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.223", "title": "User impersonation action is set to move to Quarantine.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.228", "title": "No trusted senders in Anti-phishing policy.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.232", "title": "Each domain has a malware filter policy applied to it, or the default policy is being used.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.239", "title": "No exclusions for the built-in protection policies.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.242", "title": "Important protection alerts responsible for AIR activities are enabled.", "severity": "high", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.1.3.3", "title": "Ensure 'External sharing' of calendars is not available", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.1", "title": "Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.12", "title": "Ensure the connection filter IP allow list is not used (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.13", "title": "Ensure the connection filter safe list is off (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.2", "title": "Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.3", "title": "Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.6", "title": "Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.1.7", "title": "Ensure that an anti-phishing policy has been created (Only Checks Default Policy)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.2.4.4", "title": "Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.8.1.1", "title": "Ensure external file sharing in Teams is enabled for only approved cloud storage services", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.8.2.2", "title": "Ensure communication with unmanaged Teams users is disabled", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.8.5.3", "title": "Ensure only people in my org can bypass the lobby", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CIS.M365.8.6.1", "title": "Ensure users can report security concerns in Teams to internal destination", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.11.2", "title": "User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.11.3", "title": "The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.12.1", "title": "IP allow lists SHOULD NOT be created.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.12.2", "title": "Safe lists SHOULD NOT be enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.14.2", "title": "Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.14.3", "title": "Allowed domains SHALL NOT be added to inbound anti-spam protection policies.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.14.4", "title": "If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.15.1", "title": "URL comparison with a block-list SHOULD be enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.15.3", "title": "User click tracking SHOULD be enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.16.2", "title": "Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.17.2", "title": "Microsoft Purview Audit (Premium) logging SHALL be enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.17.3", "title": "Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.2.1", "title": "A list of approved IP addresses for sending mail SHALL be maintained.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.2.2", "title": "An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.3.1", "title": "DKIM SHOULD be enabled for all domains.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.4.1", "title": "A DMARC policy SHALL be published for every second-level domain.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.4.3", "title": "The DMARC point of contact for aggregate reports SHALL include [redacted-email].", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.6.1", "title": "Contact folders SHALL NOT be shared with all domains.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.6.2", "title": "Calendar details SHALL NOT be shared with all domains.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.7.1", "title": "External sender warnings SHALL be implemented.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.8.2", "title": "The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.8.3", "title": "The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.9.1", "title": "Emails SHALL be filtered by attachment file types.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.9.2", "title": "The attachment filter SHOULD attempt to determine the true file type and assess the file extension.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "CISA.MS.EXO.9.4", "title": "Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.AF06", "title": "Authentication Method - FIDO2 security key - Restrict specific keys.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.CR02", "title": "Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "EIDSCA.CR03", "title": "Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1040", "title": "Ensure additional storage providers are restricted in Outlook on the web", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1042", "title": "Restrict dial-in users from bypassing a meeting lobby", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1043", "title": "Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1046", "title": "Restrict anonymous users from joining meetings", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1047", "title": "Restrict anonymous users from starting Teams meetings", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1048", "title": "Limit external participants from having control in a Teams meeting", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1057", "title": "App registrations should no longer use secrets.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1058", "title": "Exchange application access policies must be configured.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1062", "title": "Ensure Direct Send is set to be rejected", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1075", "title": "Require explicit assignment of Third Party Entra Apps.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1077", "title": "App registrations with privileged API permissions should not have owners.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1078", "title": "App registrations with highly privileged directory roles should not have owners.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1079", "title": "Privileged API permissions on service principals should not remain unused.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1080", "title": "Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1081", "title": "Hybrid users should not be assigned Entra ID role assignments.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1088", "title": "Devices with critical credentials should be protected by TPM.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1089", "title": "Devices with critical credentials should be protected by Credential Guard.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.100", "title": "Bulk Complaint Level threshold is between 4 and 6.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.101", "title": "Bulk is marked as spam.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.102", "title": "Advanced Spam filter options are turned off.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.103", "title": "Outbound spam filter policy settings configured.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.105", "title": "Safe Links Synchronous URL detonation is enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.106", "title": "Quarantine retention period is 30 days.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.108", "title": "DKIM signing is set up for all your custom domains.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.108.1", "title": "DNS Records have been set up to support DKIM.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.109", "title": "Senders are not being allow listed in an unsafe manner.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.110", "title": "Internal Sender notifications are disabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.112", "title": "Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.113", "title": "AllowClickThrough is disabled in Safe Links policies.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.115", "title": "Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.116", "title": "Mailbox intelligence based impersonation protection action set to move message to junk mail folder.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.118.3", "title": "Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.118.4", "title": "Your own domains are not being allow listed in an unsafe manner in Transport Rules.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.120.1", "title": "Zero Hour Autopurge Enabled for Phish.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.120.2", "title": "Zero Hour Autopurge Enabled for Malware.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.120.3", "title": "Zero Hour Autopurge Enabled for Spam.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.141", "title": "Bulk action set to Move message to Junk Email Folder.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.142", "title": "Phish action set to Quarantine message.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.156", "title": "Safe Links Policies are tracking when user clicks on safe links.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.158", "title": "Safe Attachments is enabled for SharePoint and Teams.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.179", "title": "Safe Links is enabled intra-organization.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.180", "title": "Anti-phishing policy exists and EnableSpoofIntelligence is true.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.189", "title": "Safe Attachments is not bypassed.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.205", "title": "Common attachment type filter is enabled.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.220", "title": "Advanced Phish filter Threshold level is adequate.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.221", "title": "Mailbox intelligence is enabled in anti-phishing policies.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.222", "title": "Domain Impersonation action is set to move to Quarantine.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.225", "title": "Safe Documents is enabled for Office clients.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.226", "title": "Each domain has a Safe Link policy applied to it.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.227", "title": "Each domain has a Safe Attachments policy applied to it.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.229", "title": "No trusted domains in Anti-phishing policy.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.230", "title": "Each domain has a Anti-phishing policy applied to it, or the default policy is being used.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.231", "title": "Each domain has a anti-spam policy applied to it, or the default policy is being used.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.233", "title": "Domains are pointed directly at EOP or enhanced filtering is used.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.233.1", "title": "Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.234", "title": "Click through is disabled for Safe Documents.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.235", "title": "SPF records is set up for all your custom domains.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.236", "title": "Safe Links is enabled for emails.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.237", "title": "Safe Links is enabled for teams messages.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.238", "title": "Safe Links is enabled for office documents.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.240", "title": "Outlook is configured to display external tags for external emails.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.241", "title": "Anti-phishing policy exists and EnableFirstContactSafetyTips is true.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.243", "title": "Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.244", "title": "Policies are configured to honor sending domains DMARC.", "severity": "medium", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1039", "title": "Ensure MailTips are enabled for end users", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1083", "title": "Ensure Delicensing Resiliency is enabled", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "MT.1086", "title": "Devices should not share both critical and non-critical user credentials.", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.107", "title": "End-user spam notification is enabled.", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.121", "title": "Supported filter policy action used.", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.139", "title": "Spam action set to move message to junk mail folder or quarantine.", "severity": "low", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.119", "title": "Similar Domains Safety Tips is enabled.", "severity": "info", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.123", "title": "Unusual Characters Safety Tips is enabled.", "severity": "info", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.143", "title": "Safety Tips are enabled.", "severity": "info", "resultType": "exposure_finding", "tool": "maester" }, { "id": "ORCA.224", "title": "Similar Users Safety Tips is enabled.", "severity": "info", "resultType": "exposure_finding", "tool": "maester" } ], "environmentFacts": [ { "title": "Computer list row count", "property": "inventory.sectioncontrolpathsanalysis.computer.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 2 }, { "title": "Deleted objects list row count", "property": "inventory.sectioncontrolpathsanalysis.deleted.objects.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 26 }, { "title": "Indirect member list row count", "property": "inventory.sectioncontrolpathsanalysis.indirect.member.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 8 }, { "title": "User list row count", "property": "inventory.sectioncontrolpathsanalysis.user.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 3 }, { "title": "Indirect member list row count", "property": "inventory.sectioncontrolpathsanalysis.indirect.member.list.row_count", "value": 2, "state": "observed", "tool": "pingcastle", "count": 16 }, { "title": "Trusts list row count", "property": "inventory.sectiontrustsdetails.trusts.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Reachable domains list row count", "property": "inventory.sectiontrustsdetails.reachable.domains.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Certificates list row count", "property": "inventory.sectionpki.certificates.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Certificate Templates list row count", "property": "inventory.sectionpki.certificate.templates.list.row_count", "value": 12, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Delegations list row count", "property": "inventory.sectionpki.delegations.list.row_count", "value": 12, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "DC Certificates list row count", "property": "inventory.sectionpki.dc.certificates.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Microsoft Entra Connect account list row count", "property": "inventory.sectioninfrastructure.microsoft.entra.connect.account.list.row_count", "value": 0, "state": "license-restricted", "tool": "pingcastle", "count": 1 }, { "title": "WSUS settings list row count", "property": "inventory.sectioninfrastructure.wsus.settings.list.row_count", "value": 0, "state": "license-restricted", "tool": "pingcastle", "count": 1 }, { "title": "Exchange servers row count", "property": "inventory.sectioninfrastructure.exchange.servers.row_count", "value": 0, "state": "license-restricted", "tool": "pingcastle", "count": 1 }, { "title": "SCCM servers row count", "property": "inventory.sectioninfrastructure.sccm.servers.row_count", "value": 0, "state": "license-restricted", "tool": "pingcastle", "count": 1 }, { "title": "Service Connection Points list row count", "property": "inventory.sectioninfrastructure.service.connection.points.list.row_count", "value": 0, "state": "license-restricted", "tool": "pingcastle", "count": 1 }, { "title": "Account list row count", "property": "inventory.sectionanomalies.account.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Logon script list row count", "property": "inventory.sectionanomalies.logon.script.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Password policies list row count", "property": "inventory.sectionpasswordpolicies.password.policies.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Screensaver policies list row count", "property": "inventory.sectionpasswordpolicies.screensaver.policies.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Security settings list row count", "property": "inventory.sectiongpo.security.settings.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Audit settings list row count", "property": "inventory.sectiongpo.audit.settings.list.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Privileges list row count", "property": "inventory.sectiongpo.privileges.list.row_count", "value": 19, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Login list row count", "property": "inventory.sectiongpo.login.list.row_count", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Folder Options row count", "property": "inventory.sectiongpo.folder.options.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Defender ASR row count", "property": "inventory.sectiongpo.defender.asr.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "Firewall Rules row count", "property": "inventory.sectiongpo.firewall.rules.row_count", "value": 0, "state": "empty", "tool": "pingcastle", "count": 1 }, { "title": "WEF configuration count", "property": "logging.wef.configuration_count", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Tabelle 29 row count", "property": "inventory.sectioncomputerinformation.tabelle.29.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Computer Accounts", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.computer.accounts", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Enabled", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.enabled", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Disabled", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.disabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Active", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.active", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Inactive", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.inactive", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb AccessDenied", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.accessdenied", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb SidHistory", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.sidhistory", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Bad PrimaryGroup", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.bad.primarygroup", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb unconstrained delegations (enabled)", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.unconstrained.delegations.enabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb unconstrained delegations (disabled)", "property": "pingcastle.sectioncomputerinformation.tabelle.29.nb.unconstrained.delegations.disabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Operating System list row count", "property": "inventory.sectioncomputerinformation.operating.system.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Operating System", "property": "operating_system.name", "value": "Windows Server 2019 1809", "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb OS", "property": "operating_system.count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Domain Controllers list row count", "property": "inventory.sectioncomputerinformation.domain.controllers.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Operating System", "property": "operating_system.name", "value": "Windows 2019", "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Account list row count", "property": "inventory.sectionenabledtrusteddelegationcomputer.account.list.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Admin groups list row count", "property": "inventory.sectionadmingroups.admin.groups.list.row_count", "value": 14, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Admin groups detail row count", "property": "inventory.sectionadmingroups.admin.groups.detail.row_count", "value": 5, "state": "observed", "tool": "pingcastle", "count": 2 }, { "title": "Tabelle 25 row count", "property": "inventory.sectiondomaininformation.tabelle.25.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Admin groups detail row count", "property": "inventory.sectionadmingroups.admin.groups.detail.row_count", "value": 3, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Domain Functional Level", "property": "domain.functional_level", "value": "Windows Server 2016", "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Forest Functional Level", "property": "forest.functional_level", "value": "Windows Server 2016", "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Admin groups detail row count", "property": "inventory.sectionadmingroups.admin.groups.detail.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 2 }, { "title": "DC count", "property": "domain.controller_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Recycle Bin enabled", "property": "domain.recycle_bin_enabled", "value": false, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Account list row count", "property": "inventory.sectionuserinformation.account.list.row_count", "value": 3, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Delegations list row count", "property": "inventory.sectionadmingroups.delegations.list.row_count", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Unprotected OU row count", "property": "inventory.sectionadmingroups.unprotected.ou.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Delegations list row count", "property": "inventory.sectionadmingroups.delegations.list.row_count", "value": 2, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Compromise Grapth Indirect links list row count", "property": "inventory.sectioncontrolpathsanalysis.compromise.grapth.indirect.links.list.row_count", "value": 4, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Tabelle 27 row count", "property": "inventory.sectionuserinformation.tabelle.27.row_count", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Summary of group row count", "property": "inventory.sectioncontrolpathsanalysis.summary.of.group.row_count", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb User Accounts", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.user.accounts", "value": 16, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Enabled", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.enabled", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Disabled", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.disabled", "value": 1, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Active", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.active", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Inactive", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.inactive", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb AccessDenied", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.accessdenied", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Tabelle 1 row count", "property": "inventory.sectionactivedirectoryindicators.tabelle.1.row_count", "value": 11, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Locked", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.locked", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb pwd never Expire", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.pwd.never.expire", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb SidHistory", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.sidhistory", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Bad PrimaryGroup", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.bad.primarygroup", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Password not Req.", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.password.not.req", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Summary of group row count", "property": "inventory.sectioncontrolpathsanalysis.summary.of.group.row_count", "value": 11, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Des enabled.", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.des.enabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb unconstrained delegations (enabled)", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.unconstrained.delegations.enabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb unconstrained delegations (disabled)", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.unconstrained.delegations.disabled", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Nb Reversible password", "property": "pingcastle.sectionuserinformation.tabelle.27.nb.reversible.password", "value": 0, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Account list row count", "property": "inventory.sectionneverexpiresuser.account.list.row_count", "value": 15, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "User list row count", "property": "inventory.sectioncontrolpathsanalysis.user.list.row_count", "value": 5, "state": "observed", "tool": "pingcastle", "count": 1 }, { "title": "Indirect member list row count", "property": "inventory.sectioncontrolpathsanalysis.indirect.member.list.row_count", "value": 4, "state": "observed", "tool": "pingcastle", "count": 2 }, { "title": "User list row count", "property": "inventory.sectioncontrolpathsanalysis.user.list.row_count", "value": 3, "state": "observed", "tool": "pingcastle", "count": 1 } ] }