27 KiB
27 KiB
Context: fehlende Pass-Regeln (Client Dummy)
Stand: 2026-10-04 · Context Engine 1.10.0 · Katalog 1.9.1 · Scope: alle drei Dummy-Timeslots
Analyse-Liste, keine Katalogänderung. Aufgeführt ist jede Regel, deren Pass-Ergebnis laut Scan-Bericht in keiner Context-Bedingung vorkommt. Abweichungen sind vollständig katalogisiert; diese Lücke betrifft nur Pass-Belege. PingCastle fehlt, weil der Bericht keine Pass-Ergebnisse enthält.
Eine Regel gehört erst nach geprüfter Zuordnung zu einem Cluster in den Katalog: exakte Regel-ID mit Polarität fail-means-met, bei CIS-CAT der Berichtsabschnitt. Keine Heuristik.
Übersicht
| Quelle | Pass-Regeln gesamt | davon im Context | fehlend |
|---|---|---|---|
| Purple Knight | 96 | 20 | 76 |
| Maester | 74 | 8 | 66 |
| CIS-CAT | 87 | 54 | 33 |
| GPO (Einstellungen) | 25 | 7 | 18 |
Purple Knight
| Regel-ID | Titel | Severity (Quelle) | Kategorie (Quelle) |
|---|---|---|---|
SI000013 |
Evidence of Mimikatz DCShadow attack | Critical | AD Infrastructure Security |
SI000014 |
Users and computers with non-default Primary Group IDs | Low | Account Security |
SI000015 |
Reversible passwords found in GPOs | Critical | Group Policy Security |
SI000017 |
Kerberos KRBTGT account with old password | Medium | Kerberos Security |
SI000018 |
Non default value on ms-Mcs-AdmPwd SearchFlags | High | AD Delegation |
SI000021 |
Non-default principals with DC Sync rights on the domain | Critical | AD Delegation |
SI000022 |
Risky RODC credential caching | Medium | AD Infrastructure Security |
SI000023 |
Well-known privileged SIDs in SIDHistory | Critical | AD Infrastructure Security |
SI000025 |
Privileged objects with unprivileged owners | High | AD Delegation |
SI000027 |
Users with Kerberos pre-authentication disabled | Medium | Account Security |
SI000032 |
GPO linking delegation at the domain level | High | Group Policy Security |
SI000033 |
Recent privileged account creation activity | Low | Account Security |
SI000037 |
Users with old passwords | Low | Account Security |
SI000038 |
Enabled admin accounts that are inactive | Medium | Account Security |
SI000039 |
Privileged users that are disabled | Low | Account Security |
SI000040 |
GPO linking delegation at the domain controller OU level | High | Group Policy Security |
SI000041 |
GPO linking delegation at the AD Site level | High | Group Policy Security |
SI000042 |
Users with SPN defined | Low | Kerberos Security |
SI000043 |
Changes to privileged group membership in the last 7 days | Medium | Account Security |
SI000044 |
AD objects created within the last 10 days | Informational | Account Security |
SI000046 |
Objects in privileged groups without adminCount=1 (SDProp) | Medium | AD Delegation |
SI000047 |
Changes to default security descriptor schema in the last 90 days | High | AD Delegation |
SI000048 |
Changes to Default Domain Policy or Default Domain Controllers Policy in the last 7 days | Medium | Group Policy Security |
SI000049 |
Built-in domain Administrator account with old password (180 days) | Medium | Account Security |
SI000050 |
Domain Controller owner is not an administrator | High | AD Delegation |
SI000051 |
Domains with obsolete functional levels | Low | AD Infrastructure Security |
SI000053 |
Operator groups no longer protected by AdminSDHolder and SDProp | Medium | AD Infrastructure Security |
SI000054 |
Computers with older OS versions | Medium | AD Infrastructure Security |
SI000056 |
Enterprise Key Admins with full access to domain | High | AD Delegation |
SI000057 |
Objects with constrained delegation configured | Medium | Kerberos Security |
SI000058 |
Kerberos protocol transition delegation configured | High | Kerberos Security |
SI000059 |
Computers with password last set over 90 days ago | High | AD Infrastructure Security |
SI000060 |
Recent SIDHistory changes on objects | Medium | Account Security |
SI000061 |
Computer Accounts in Privileged Groups | High | Account Security |
SI000062 |
Admins with old passwords | Low | Account Security |
SI000063 |
Domain Controllers with old passwords | Low | AD Infrastructure Security |
SI000064 |
Forest contains more than 50 privileged accounts | Medium | Account Security |
SI000068 |
Trust accounts with old passwords | Low | Account Security |
SI000069 |
Domain Controllers in inconsistent state | Low | AD Infrastructure Security |
SI000072 |
gMSA objects with old passwords | High | AD Infrastructure Security |
SI000073 |
Domain Controllers that have not authenticated to the domain for more than 45 days | Medium | AD Infrastructure Security |
SI000074 |
User accounts with password not required | High | Account Security |
SI000075 |
User accounts that use DES encryption | Medium | Account Security |
SI000076 |
User accounts that store passwords with reversible encryption | Medium | Account Security |
SI000078 |
Users and computers without readable PGID | Medium | Account Security |
SI000081 |
Non-standard schema permissions | High | AD Infrastructure Security |
SI000082 |
Changes to AD Display Specifiers in the past 90 days | Low | AD Delegation |
SI000083 |
Non-privileged users with access to gMSA passwords | High | AD Delegation |
SI000086 |
Weak certificate cipher | Critical | AD Infrastructure Security |
SI000087 |
Domain trust to a third-party domain without quarantine | Medium | AD Infrastructure Security |
SI000088 |
Outbound forest trust with SID History enabled | High | AD Infrastructure Security |
SI000089 |
Users with permissions to set Server Trust Account | Critical | AD Delegation |
SI000092 |
Non-default access to DPAPI key | High | AD Delegation |
SI000097 |
NTFRS SYSVOL Replication | High | AD Infrastructure Security |
SI000098 |
Abnormal Password Refresh | Medium | Account Security |
SI000100 |
Accounts with Constrained Delegation configured to ghost SPN | High | Kerberos Security |
SI000101 |
SYSVOL Executable Changes | Low | Group Policy Security |
SI000102 |
Accounts with altSecurityIdentities configured | High | Kerberos Security |
SI000103 |
FGPP not applied to Global group | Medium | Account Security |
SI000106 |
Inheritance enabled on AdminSDHolder object | Critical | AD Delegation |
SI000108 |
Dangerous Trust Attribute Set | High | AD Infrastructure Security |
SI000110 |
Ephemeral Admins | Low | Account Security |
SI000124 |
Foreign Security Principals in Privileged Group | Medium | AD Delegation |
SI000138 |
Privileged user credentials cached on RODC | Medium | AD Infrastructure Security |
SI000150 |
Operators Groups that are not empty | High | Account Security |
SI000185 |
Objects with Reanimate-Tombstones extended right | Medium | AD Delegation |
SI000188 |
GPO Weak LM Hash storage enabled | High | Group Policy Security |
SI000189 |
Writable shortcuts found in GPO | High | Group Policy Security |
SI000193 |
OU permissions enabling BadSuccessor dMSA escalation | High | Account Security |
SI000217 |
Query policies that have the attribute of LDAP deny list set | Medium | AD Infrastructure Security |
SI000236 |
User accounts using Smart Card authentication with old password | High | Account Security |
SI000304 |
Dangerous GPO logon script path | High | Group Policy Security |
SI000314 |
Unexpected accounts in Cert Publishers Group | High | AD Infrastructure Security |
SI000316 |
GPO with Scheduled Tasks configured | Low | Group Policy Security |
SI000339 |
Users with the attribute userPassword set | Medium | Kerberos Security |
SI000355 |
Distributed COM Users group or Performance Log Users group are not empty | High | Account Security |
Maester
| Regel-ID | Titel | Severity (Quelle) | Kategorie (Quelle) |
|---|---|---|---|
CIS.M365.1.3.1 |
(L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' | High | ["CIS.M365.1.3.1","L1","CIS E3 Level 1","CIS E3","CIS","Security","All","CIS M365 v4.0.0"], CIS, CIS.M365.1.3.1, L1, CIS E3 Level 1, CIS E3, CIS, Security, CIS M365 v5.0.0 |
CISA.MS.AAD.2.1 |
Users detected as high risk SHALL be blocked. | High | ["MS.AAD","MS.AAD.2.1","CISA.MS.AAD.2.1","CISA","Security","All","Entra ID P2"], CISA, MS.AAD, MS.AAD.2.1, CISA.MS.AAD.2.1, CISA, Security, Entra ID P2 |
CISA.MS.AAD.2.2 |
A notification SHOULD be sent to the administrator when high-risk users are detected. | High | ["MS.AAD","MS.AAD.2.2","CISA.MS.AAD.2.2","CISA","Security","All","Entra ID P2"], CISA, MS.AAD, MS.AAD.2.2, CISA.MS.AAD.2.2, CISA, Security, Entra ID P2 |
CISA.MS.AAD.3.2 |
If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | High | ["MS.AAD","MS.AAD.3.2","CISA.MS.AAD.3.2","CISA","Security","All","Entra ID P1"], CISA, MS.AAD, MS.AAD.3.2, CISA.MS.AAD.3.2, CISA, Security, Entra ID P1 |
CISA.MS.AAD.3.4 |
The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | High | ["MS.AAD","MS.AAD.3.4","CISA.MS.AAD.3.4","CISA","Security","All","Entra ID P1"], CISA, MS.AAD, MS.AAD.3.4, CISA.MS.AAD.3.4, CISA, Security, Entra ID P1 |
CISA.MS.AAD.5.1 |
Only administrators SHALL be allowed to register applications. | High | ["MS.AAD","MS.AAD.5.1","CISA.MS.AAD.5.1","CISA","Security","All","Entra ID Free"], CISA, MS.AAD, MS.AAD.5.1, CISA.MS.AAD.5.1, CISA, Security, Entra ID Free |
CISA.MS.AAD.6.1 |
User passwords SHALL NOT expire. | High | ["MS.AAD","MS.AAD.6.1","CISA.MS.AAD.6.1","CISA","Security","All","Entra ID Free"], CISA, MS.AAD, MS.AAD.6.1, CISA.MS.AAD.6.1, CISA, Security, Entra ID Free |
CISA.MS.AAD.7.5 |
Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. | High | ["MS.AAD","MS.AAD.7.5","CISA.MS.AAD.7.5","CISA","Security","All","Entra ID P2"], CISA, MS.AAD, MS.AAD.7.5, CISA.MS.AAD.7.5, CISA, Security, Entra ID P2 |
CISA.MS.AAD.7.6 |
Activation of the Global Administrator role SHALL require approval. | High | ["MS.AAD","MS.AAD.7.6","CISA.MS.AAD.7.6","CISA","Security","All","Entra ID P2"], CISA, MS.AAD, MS.AAD.7.6, CISA.MS.AAD.7.6, CISA, Security, Entra ID P2 |
CISA.MS.AAD.7.8 |
User activation of the Global Administrator role SHALL trigger an alert. | High | ["MS.AAD","MS.AAD.7.8","CISA.MS.AAD.7.8","CISA","Security","All","Entra ID P2"], CISA, MS.AAD, MS.AAD.7.8, CISA.MS.AAD.7.8, CISA, Security, Entra ID P2 |
CT001 |
User device quota should be set to 10 | — | Custom Security Tests, Custom, Security, Device |
EIDSCA.AF01 |
Authentication Method - FIDO2 security key - State. | High | ["EIDSCA","Security","All","EIDSCA.AF01"], EIDSCA, EIDSCA, Security, EIDSCA.AF01 |
EIDSCA.AF02 |
Authentication Method - FIDO2 security key - Allow self-service set up. | Medium | ["EIDSCA","Security","All","EIDSCA.AF02"], EIDSCA, EIDSCA, Security, EIDSCA.AF02 |
EIDSCA.AG01 |
Authentication Method - General Settings - Manage migration. | High | ["EIDSCA","Security","All","EIDSCA.AG01"], EIDSCA, EIDSCA, Security, EIDSCA.AG01 |
EIDSCA.AG03 |
Authentication Method - General Settings - Report suspicious activity - Included users/groups. | Medium | ["EIDSCA","Security","All","EIDSCA.AG03"], EIDSCA, EIDSCA, Security, EIDSCA.AG03 |
EIDSCA.AM01 |
Authentication Method - Microsoft Authenticator - State. | High | ["EIDSCA","Security","All","EIDSCA.AM01"], EIDSCA, EIDSCA, Security, EIDSCA.AM01 |
EIDSCA.AM03 |
Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM03"], EIDSCA, EIDSCA, Security, EIDSCA.AM03 |
EIDSCA.AM04 |
Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM04"], EIDSCA, EIDSCA, Security, EIDSCA.AM04 |
EIDSCA.AM06 |
Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM06"], EIDSCA, EIDSCA, Security, EIDSCA.AM06 |
EIDSCA.AM07 |
Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM07"], EIDSCA, EIDSCA, Security, EIDSCA.AM07 |
EIDSCA.AM09 |
Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM09"], EIDSCA, EIDSCA, Security, EIDSCA.AM09 |
EIDSCA.AM10 |
Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. | Medium | ["EIDSCA","Security","All","EIDSCA.AM10"], EIDSCA, EIDSCA, Security, EIDSCA.AM10 |
EIDSCA.AP01 |
Default Authorization Settings - Enabled Self service password reset for administrators. | High | ["EIDSCA","Security","All","EIDSCA.AP01"], EIDSCA, EIDSCA, Security, EIDSCA.AP01 |
EIDSCA.AP08 |
Default Authorization Settings - User consent policy assigned for applications. | Medium | ["EIDSCA","Security","All","EIDSCA.AP08"], EIDSCA, EIDSCA, Security, EIDSCA.AP08 |
EIDSCA.AP10 |
Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | High | ["EIDSCA","Security","All","EIDSCA.AP10"], EIDSCA, EIDSCA, Security, EIDSCA.AP10 |
EIDSCA.AP14 |
Default Authorization Settings - Default User Role Permissions - Allowed to read other users. | High | ["EIDSCA","Security","All","EIDSCA.AP14"], EIDSCA, EIDSCA, Security, EIDSCA.AP14 |
EIDSCA.AS04 |
Authentication Method - SMS - Use for sign-in. | High | ["EIDSCA","Security","All","EIDSCA.AS04"], EIDSCA, EIDSCA, Security, EIDSCA.AS04 |
EIDSCA.AT01 |
Authentication Method - Temporary Access Pass - State. | High | ["EIDSCA","Security","All","EIDSCA.AT01"], EIDSCA, EIDSCA, Security, EIDSCA.AT01 |
EIDSCA.AT02 |
Authentication Method - Temporary Access Pass - One-time. | High | ["EIDSCA","Security","All","EIDSCA.AT02"], EIDSCA, EIDSCA, Security, EIDSCA.AT02 |
EIDSCA.AV01 |
Authentication Method - Voice call - State. | High | ["EIDSCA","Security","All","EIDSCA.AV01"], EIDSCA, EIDSCA, Security, EIDSCA.AV01 |
EIDSCA.PR02 |
Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | High | ["EIDSCA","Security","All","EIDSCA.PR02"], EIDSCA, EIDSCA, Security, EIDSCA.PR02 |
EIDSCA.ST08 |
Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Medium | ["EIDSCA","Security","All","EIDSCA.ST08"], EIDSCA, EIDSCA, Security, EIDSCA.ST08 |
EIDSCA.ST09 |
Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. | Medium | ["EIDSCA","Security","All","EIDSCA.ST09"], EIDSCA, EIDSCA, Security, EIDSCA.ST09 |
MT.1001 |
At least one Conditional Access policy is configured with device compliance. | Medium | ["Maester","CA","Security","All","MT.1001"], Maester/Entra, Maester, CA, Security, MT.1001 |
MT.1002 |
App management restrictions on applications and service principals is configured and enabled. | High | ["Maester","App","Security","All","MT.1002"], Maester/Entra, Maester, App, Security, MT.1002 |
MT.1003 |
At least one Conditional Access policy is configured with All Apps. | High | ["Maester","CA","Security","All","MT.1003"], Maester/Entra, Maester, CA, Security, MT.1003 |
MT.1004 |
At least one Conditional Access policy is configured with All Apps and All Users. | High | ["Maester","CA","Security","All","MT.1004"], Maester/Entra, Maester, CA, Security, MT.1004 |
MT.1006 |
At least one Conditional Access policy is configured to require MFA for admins. | High | ["Maester","CA","Security","All","MT.1006"], Maester/Entra, Maester, CA, Security, MT.1006 |
MT.1007 |
At least one Conditional Access policy is configured to require MFA for all users. | High | ["Maester","CA","Security","All","MT.1007"], Maester/Entra, Maester, CA, Security, MT.1007 |
MT.1008 |
At least one Conditional Access policy is configured to require MFA for Azure management. | High | ["Maester","CA","Security","All","MT.1008"], Maester/Entra, Maester, CA, Security, MT.1008 |
MT.1013 |
At least one Conditional Access policy is configured to require new password when user risk is high. | High | ["Maester","CA","Security","All","MT.1013"], Maester/Entra, Maester, CA, Security, MT.1013 |
MT.1016 |
At least one Conditional Access policy is configured to require MFA for guest access. | High | ["Maester","CA","Security","All","MT.1016"], Maester/Entra, Maester, CA, Security, MT.1016 |
MT.1022 |
All users utilizing a P1 license should be licensed. | Medium | ["Entra","License","MT.1022"], Maester/Entra, Entra, License, MT.1022 |
MT.1023 |
All users utilizing a P2 license should be licensed. | Medium | ["Entra","License","MT.1023"], Maester/Entra, Entra, License, MT.1023 |
MT.1024.oneAdmin |
Designate more than one global admin. | Low | Maester/Entra, Maester, Entra, Security, Recommendation, MT.1024, oneAdmin |
MT.1024.pwagePolicyNew |
Do not expire passwords. | High | Maester/Entra, Maester, Entra, Security, Recommendation, MT.1024, pwagePolicyNew |
MT.1024.roleOverlap |
Use least privileged administrative roles . | Low | Maester/Entra, Maester, Entra, Security, Recommendation, MT.1024, roleOverlap |
MT.1024.selfServicePasswordReset |
Enable self-service password reset. | Low | Maester/Entra, Maester, Entra, Security, Recommendation, MT.1024, selfServicePasswordReset |
MT.1024.servicePrincipalKeyExpiry |
Renew expiring service principal credentials. | High | Maester/Entra, Maester, Entra, Security, Recommendation, MT.1024, servicePrincipalKeyExpiry |
MT.1026 |
No hybrid user with permanent role assignment on Control Plane. | High | ["Maester","Privileged","Security","All","MT.1026"], Maester/Entra, Maester, Privileged, Security, MT.1026 |
MT.1029 |
Stale accounts are not assigned to privileged roles. | High | ["Privileged","Security","All","PIM","MT.1029"], Maester/Entra, Privileged, Security, PIM, MT.1029 |
MT.1031 |
Privileged role on Control Plane are managed by PIM only. | High | ["Privileged","Security","All","PIM","MT.1031"], Maester/Entra, Privileged, Security, PIM, MT.1031 |
MT.1035 |
All security groups assigned to Conditional Access Policies should be protected by RMAU. | High | ["Maester","CA","Security","All","MT.1035"], Maester/Entra, Maester, CA, Security, MT.1035 |
MT.1049 |
Conditional Access policies for User Risk and Sign-in Risk should be configured separately. | High | ["Maester","CA","Security","All","MT.1049"], Maester/Entra, Maester, CA, Security, MT.1049 |
MT.1052 |
At least one Conditional Access policy is targeting the Device Code authentication flow. | High | ["Maester","CA","Security","All","MT.1052"], Maester/Entra, Maester, CA, Security, MT.1052 |
MT.1055 |
Microsoft 365 Group (and Team) creation should be restricted to approved users. | Medium | ["Maester","Group","Security","All","MT.1055"], Maester/Entra, Maester, Group, Security, MT.1055 |
MT.1059.d41d8cd98f00b204e9800998ecf8427e |
MDI Health Issues - . | — | Defender for Identity health issues, Maester, Defender, Security, MDI, MT.1059, Severity:, |
MT.1061 |
Device registration MFA control conflicts with Conditional Access policies. | Medium | Maester/Entra, Maester, CA, Security, MT.1061 |
MT.1065 |
Ensure all Recovery Services Vaults have soft delete enabled | High | AzureConfig, Backup, Azure, MT.1065 |
MT.1067 |
Authentication method policies should not reference non-existent groups. | Medium | Maester/Entra, Maester, Authentication, Security, MT.1067 |
MT.1068 |
Restrict non-admin users from creating tenants. | Medium | Maester/Entra, Governance, Entra, Security, MT.1068 |
MT.1069 |
Restrict non-admin users from creating security groups. | Low | Maester/Entra, Governance, Entra, Security, MT.1069 |
MT.1070 |
Restrict device join to selected users/groups or none. | Medium | Maester/Entra, Governance, Entra, Security, MT.1070 |
MT.1072 |
Conditional access policies should not use the deprecated Approved Client App grant. | High | Maester/Entra, Maester, CA, Security, MT.1072 |
MT.1074 |
Ensure no more then 100 outbound mails per day are send using the .onmicrosoft.com domain | Medium | Maester/Exchange, Maester, Exchange, MT.1074 |
MT.1085 |
Pending approvals for Critical Asset Management should not be present. | Medium | Exposure Management, Entra, Graph, Security, XSPM, MT.1085 |
CIS-CAT
Abschnitt = erste zwei Ebenen der Regelnummer. Der Context ordnet CIS-CAT über den Berichtsabschnitt zu; ein ganzer nicht katalogisierter Abschnitt kann daher mit einem Eintrag geschlossen werden.
| Regel-ID | Abschnitt | Titel |
|---|---|---|
1.1.1 |
1.1 | 1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)' |
1.1.2 |
1.1 | 1.1.2 Ensure 'Maximum password age' is set to '365 or fewer days, but not 0' |
1.1.3 |
1.1 | 1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)' |
1.1.7 |
1.1 | 1.1.7 Ensure 'Store passwords using reversible encryption' is set to 'Disabled' |
2.3.4.1 |
2.3 | 2.3.4.1 Ensure 'Devices: Prevent users from installing printer drivers' is set to 'Enabled' |
2.3.6.1 |
2.3 | 2.3.6.1 Ensure 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled' |
2.3.6.2 |
2.3 | 2.3.6.2 Ensure 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled' |
2.3.6.3 |
2.3 | 2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled' |
2.3.6.4 |
2.3 | 2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled' |
2.3.6.5 |
2.3 | 2.3.6.5 Ensure 'Domain member: Maximum machine account password age' is set to '30 or fewer days, but not 0' |
2.3.6.6 |
2.3 | 2.3.6.6 Ensure 'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled' |
2.3.8.2 |
2.3 | 2.3.8.2 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled' |
2.3.9.1 |
2.3 | 2.3.9.1 Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)' |
2.3.9.3 |
2.3 | 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' |
2.3.10.1 |
2.3 | 2.3.10.1 Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled' |
2.3.10.5 |
2.3 | 2.3.10.5 Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' |
2.3.10.8 |
2.3 | 2.3.10.8 Ensure 'Network access: Remotely accessible registry paths' is configured |
2.3.10.9 |
2.3 | 2.3.10.9 Ensure 'Network access: Remotely accessible registry paths and sub-paths' is configured |
2.3.10.10 |
2.3 | 2.3.10.10 Ensure 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled' |
2.3.10.12 |
2.3 | 2.3.10.12 Ensure 'Network access: Shares that can be accessed anonymously' is set to 'None' |
2.3.10.13 |
2.3 | 2.3.10.13 Ensure 'Network access: Sharing and security model for local accounts' is set to 'Classic - local users authenticate as themselves' |
2.3.13.1 |
2.3 | 2.3.13.1 Ensure 'Shutdown: Allow system to be shut down without having to log on' is set to 'Disabled' |
2.3.15.1 |
2.3 | 2.3.15.1 Ensure 'System objects: Require case insensitivity for non-Windows subsystems' is set to 'Enabled' |
2.3.15.2 |
2.3 | 2.3.15.2 Ensure 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled' |
2.3.17.4 |
2.3 | 2.3.17.4 Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' |
2.3.17.5 |
2.3 | 2.3.17.5 Ensure 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled' |
2.3.17.6 |
2.3 | 2.3.17.6 Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled' |
2.3.17.7 |
2.3 | 2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' |
2.3.17.8 |
2.3 | 2.3.17.8 Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled' |
19.7.5.1 |
19.7 | 19.7.5.1 Ensure 'Do not preserve zone information in file attachments' is set to 'Disabled' |
19.7.5.2 |
19.7 | 19.7.5.2 Ensure 'Notify antivirus programs when opening attachments' is set to 'Enabled' |
19.7.26.1 |
19.7 | 19.7.26.1 Ensure 'Prevent users from sharing files within their profile.' is set to 'Enabled' |
19.7.46.2.1 |
19.7 | 19.7.46.2.1 Ensure 'Prevent Codec Download' is set to 'Enabled' |
GPO-Einstellungen (Verdict Passed)
| Einstellung | Scope | Technische Identität |
|---|---|---|
| allowdde | user | gpo-policy-identity-fe0f949d14c555c06980c7f1be88ecab |
| enableoleactions | user | gpo-policy-identity-de40f1ecce2e45b1899716ec95948cb6 |
| EnableScriptBlockInvocationLogging | computer | gpo-policy-identity-7b0456c1b66a87c2bb97a99315b119d4 |
| fAllowFullControl | computer | gpo-policy-identity-6d0463b00d14f0674cebe9ed81bfca67 |
| fUseMailto | computer | gpo-policy-identity-20a81de462534bd60111802c0ecd1ec6 |
| MaxTicketExpiry | computer | gpo-policy-identity-8590d6843170a869ba261df8ce43b34e |
| MaxTicketExpiryUnits | computer | gpo-policy-identity-db2aa9231047c05e8914b11c1bbc1e18 |
| privilege rights · secreatepagefileprivilege | computer | gpo-policy-identity-b6237595766e0910af2c9b5246f1c6ef |
| privilege rights · seprofilesingleprocessprivilege | computer | gpo-policy-identity-b79dd2a5cbf48fadac6a853bfa1588ce |
| registry values · machine\system\currentcontrolset\control\lsa\nolmhash | computer | gpo-policy-identity-8750b6186583a650aedbd8cde05b5dce |
| registry values · machine\system\currentcontrolset\services\lanmanserver\parameters\enablesecuritysignature | computer | gpo-policy-identity-07391ebdcd8b74f59c174e0dcf465774 |
| registry values · machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature | computer | gpo-policy-identity-40df1cce2a18ab54de584d997a763dce |
| registry values · machine\system\currentcontrolset\services\netlogon\parameters\requiresignorseal | computer | gpo-policy-identity-68e6d42ea8fc7b9b8de723f2cba019ef |
| registry values · machine\system\currentcontrolset\services\ntds\parameters\ldapserverintegrity | computer | gpo-policy-identity-69964f975c2afa036c53821d833ac388 |
| Software\Policies\Microsoft\Edge\ExtensionInstallBlocklist | computer | gpo-policy-identity-9c404b72d73c89d991f6bd879de714b2 |
| SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses | computer | gpo-policy-identity-9c23ac1bc5d4049c4460cfac648236af |
| SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs | computer | gpo-policy-identity-71d55b57e12919c3eaf1ceb41f73f18d |
| system access · lsaanonymousnamelookup | computer | gpo-policy-identity-f9b99fd736dfaef934d63699413dc71f |