2.3.10.1 Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled'
2.3.10.10 Ensure 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled'
2.3.10.12 Ensure 'Network access: Shares that can be accessed anonymously' is set to 'None'
2.3.10.6 Configure 'Network access: Named Pipes that can be accessed anonymously' (DC only)
2.3.10.9 Configure 'Network access: Remotely accessible registry paths and sub-paths'
2.3.11.2 Ensure 'Network security: Allow LocalSystem NULL session fallback' is set to 'Disabled'
2.3.11.7 Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM'
2.3.15.2 Ensure 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled'
2.3.17.4 Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'
2.3.17.6 Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'
2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'
2.3.17.8 Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled'
2.3.5.2 Ensure 'Domain controller: LDAP server signing requirements' is set to 'Require signing' (DC only)
2.3.5.3 Ensure 'Domain controller: Refuse machine account password changes' is set to 'Disabled' (DC only)
2.3.6.2 Ensure 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled'
2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled'
2.3.7.2 Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'
2.3.7.3 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'
2.3.7.4 Configure 'Interactive logon: Message text for users attempting to log on'
2.3.7.5 Configure 'Interactive logon: Message title for users attempting to log on'
2.3.7.7 Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days'
2.3.7.9 Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation' or higher
2.3.8.1 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'
2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'
2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'
9.1.3 Ensure 'Windows Firewall: Domain: Outbound connections' is set to 'Allow (default)'
9.1.4 Ensure 'Windows Firewall: Domain: Settings: Display a notification' is set to 'No'
9.1.6 Ensure 'Windows Firewall: Domain: Logging: Size limit (KB)' is set to '16,384 KB or greater'
9.1.7 Ensure 'Windows Firewall: Domain: Logging: Log dropped packets' is set to 'Yes'
9.1.8 Ensure 'Windows Firewall: Domain: Logging: Log successful connections' is set to 'Yes'
9.2.1 Ensure 'Windows Firewall: Private: Firewall state' is set to 'On (recommended)'
9.2.4 Ensure 'Windows Firewall: Private: Settings: Display a notification' is set to 'No'
9.2.6 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater'
9.2.7 Ensure 'Windows Firewall: Private: Logging: Log dropped packets' is set to 'Yes'
9.2.8 Ensure 'Windows Firewall: Private: Logging: Log successful connections' is set to 'Yes'
9.3.1 Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)'
9.3.10 Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'
9.3.4 Ensure 'Windows Firewall: Public: Settings: Display a notification' is set to 'No'
9.3.5 Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'
9.3.6 Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No'
9.3.8 Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater'
9.3.9 Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'
Miscellaneous
Metadata updated.
Platform check updated.
References updated.
Added
17.3.1 Ensure 'Audit PNP Activity' is set to include 'Success'
17.3.2 Ensure 'Audit Process Creation' is set to include 'Success'
17.5.2 Ensure 'Audit Group Membership' is set to include 'Success'
17.5.3 Ensure 'Audit Logoff' is set to include 'Success'
17.5.6 Ensure 'Audit Special Logon' is set to include 'Success'
17.7.2 Ensure 'Audit Authentication Policy Change' is set to include 'Success'
17.7.3 Ensure 'Audit Authorization Policy Change' is set to include 'Success'
17.9.3 Ensure 'Audit Security State Change' is set to include 'Success'
18.4.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less'
18.4.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'
18.4.3 Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'
18.4.6 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'
18.4.9 Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set to 'Enabled: 5 or fewer seconds'
18.5.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication' and 'Require Integrity' set for all NETLOGON and SYSVOL shares' - NETLOGON
18.5.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication' and 'Require Integrity' set for all NETLOGON and SYSVOL shares' - SYSVOL shares'
18.5.21.1 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 1 = Minimize simultaneous connections' - is set to Enabled: 1 = Minimize simultaneous connections
18.8.21.4 Ensure 'Continue experiences on this device' is set to 'Disabled'
18.9.102.1.2 Ensure 'Select when Preview Builds and Feature Updates are received' is set to 'Enabled: Semi-Annual Channel, 180 or more days' - BranchReadinessLevel
18.9.102.1.2 Ensure 'Select when Preview Builds and Feature Updates are received' is set to 'Enabled: Semi-Annual Channel, 180 or more days' - DeferFeatureUpdates
18.9.102.1.2 Ensure 'Select when Preview Builds and Feature Updates are received' is set to 'Enabled: Semi-Annual Channel, 180 or more days' - DeferFeatureUpdatesPeriodInDays
2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS' (DC only)
2.2.20 Ensure 'Deny access to this computer from the network' to include 'Guests' (DC only)
2.2.25 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests' (DC only)
2.2.37 Ensure 'Manage auditing and security log' is set to 'Administrators' and (when Exchange is running in the environment) 'Exchange Servers' (DC only)
2.3.10.13 Ensure 'Network access: Sharing and security model for local accounts' is set to 'Classic - local users authenticate as themselves'
2.3.11.10 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security, Require 128-bit encryption'
2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'
2.3.11.9 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security, Require 128-bit encryption'
2.3.17.2 Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set to 'Prompt for consent on the secure desktop'
2.3.17.3 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests'
2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled'
CIS_DC_SERVER_2016_Level_1_v1.2.0.audit from CIS Microsoft Windows Server 2016 DC L1 v1.2.0
Removed
17.3.1 Ensure 'Audit PNP Activity' is set to 'Success'
17.3.2 Ensure 'Audit Process Creation' is set to 'Success'
17.5.2 Ensure 'Audit Group Membership' is set to 'Success'
17.5.3 Ensure 'Audit Logoff' is set to 'Success'
17.5.6 Ensure 'Audit Special Logon' is set to 'Success'
17.7.2 Ensure 'Audit Authentication Policy Change' is set to 'Success'
17.7.3 Ensure 'Audit Authorization Policy Change' is set to 'Success'
17.9.3 Ensure 'Audit Security State Change' is set to 'Success'
18.4.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set
18.4.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set
18.4.3 Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set
18.4.6 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set
18.4.9 Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set
18.5.14.1 Ensure 'Hardened UNC Paths' is set - NETLOGON
18.5.14.1 Ensure 'Hardened UNC Paths' is set - SYSVOL shares'
18.5.21.1 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled'
18.8.21.4 Ensure 'Continue experiences on this device' is set to 'Disabled'
18.9.102.1.2 'Select when Feature Updates are received' is 'Enabled: Current Branch for Business 180 days' - DeferFeatureUpdatesPeriodInDays
18.9.102.1.2 Ensure 'Select when Feature Updates are received' is 'Enabled: Current Branch for Business, 180 days' - BranchReadinessLevel
18.9.102.1.2 Ensure 'Select when Feature Updates are received' is 'Enabled: Current Branch for Business, 180 days' - DeferFeatureUpdates
2.2.2 Ensure 'Access this computer from the network' is set (DC only)
2.2.20 Ensure 'Deny access to this computer from the network' is set to 'Guests' (DC only)
2.2.25 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests' (DC only)
2.2.37 Ensure 'Manage auditing and security log' is set (DC only)
2.3.10.13 Ensure 'Network access: Sharing and security model for local accounts' is set
2.3.11.10 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set
2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set
2.3.11.9 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set
2.3.17.2 Ensure 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' is set
2.3.17.3 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set
2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set
