1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)'

800-53|IA-5(1)

CCE|CCE-37166-6

CSCv6|16.5

CSCv7|16.2

CSCv7|16.5

1.1.2 Ensure 'Maximum password age' is set to '60 or fewer days, but not 0'

CCE|CCE-37167-4

CSCv7|16.10

1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)'

CCE|CCE-37073-4

1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)'

CCE|CCE-36534-6

CSCv6|5.7

CSCv6|16.12

1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled'

CCE|CCE-37063-5

CSCv7|4.4

1.1.6 Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

CCE|CCE-36286-3

CSCv6|16.14

CSCv7|16.4

1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)'

800-53|AC-7

CCE|CCE-37034-6

CSCv6|16

CSCv6|16.7

CSCv7|16.11

1.2.2 Ensure 'Account lockout threshold' is set to '10 or fewer invalid logon attempt(s), but not 0'

CCE|CCE-36008-1

1.2.3 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'

CCE|CCE-36883-7

2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

800-53|AC-6(7)

CCE|CCE-37056-9

CSCv6|5.1

CSCv7|4.8

2.2.3 Ensure 'Access this computer from the network' is set to 'Administrators, Authenticated Users' (MS only)

CCE|CCE-35818-4

CSCv6|9

CSCv7|9.2

2.2.4 Ensure 'Act as part of the operating system' is set to 'No One'

CCE|CCE-36876-1

2.2.6 Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-37071-8

CSCv7|4.3

2.2.7 Ensure 'Allow log on locally' is set to 'Administrators'

CCE|CCE-37659-0

CSCv7|4.1

CSCv7|4.5

2.2.9 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users' (MS only)

CCE|CCE-37072-6

CSCv7|4.6

2.2.10 Ensure 'Back up files and directories' is set to 'Administrators'

CCE|CCE-35912-5

2.2.11 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

CCE|CCE-37452-0

2.2.12 Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE'

CCE|CCE-37700-2

2.2.13 Ensure 'Create a pagefile' is set to 'Administrators'

CCE|CCE-35821-8

2.2.14 Ensure 'Create a token object' is set to 'No One'

CCE|CCE-36861-3

2.2.15 Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

CCE|CCE-37453-8

2.2.16 Ensure 'Create permanent shared objects' is set to 'No One'

CCE|CCE-36532-0

2.2.18 Ensure 'Create symbolic links' is set to 'Administrators, NT VIRTUAL MACHINE\Virtual Machines' (MS only)

CCE|CCE-35823-4

2.2.19 Ensure 'Debug programs' is set to 'Administrators'

CCE|CCE-37075-9

2.2.21 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account and member of Administrators group' (MS only)

CCE|CCE-37954-5

CSCv7|16.8

2.2.22 Ensure 'Deny log on as a batch job' to include 'Guests'

CCE|CCE-36923-1

2.2.23 Ensure 'Deny log on as a service' to include 'Guests'

CCE|CCE-36877-9

2.2.24 Ensure 'Deny log on locally' to include 'Guests'

CCE|CCE-37146-8

2.2.26 Ensure 'Deny log on through Remote Desktop Services' is set to 'Guests, Local account' (MS only)

CCE|CCE-36867-0

2.2.28 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One' (MS only)

CCE|CCE-36860-5

2.2.29 Ensure 'Force shutdown from a remote system' is set to 'Administrators'

CCE|CCE-37877-8

2.2.30 Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-37639-2

2.2.32 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' and (when the Web Server (IIS) Role with Web Services Role Service is installed) 'IIS_IUSRS' (MS only)

CCE|CCE-37106-2

2.2.33 Ensure 'Increase scheduling priority' is set to 'Administrators'

CCE|CCE-38326-5

2.2.34 Ensure 'Load and unload device drivers' is set to 'Administrators'

CCE|CCE-36318-4

2.2.35 Ensure 'Lock pages in memory' is set to 'No One'

CCE|CCE-36495-0

2.2.38 Ensure 'Manage auditing and security log' is set to 'Administrators' (MS only)

CCE|CCE-35906-7

CSCv7|6.5

2.2.39 Ensure 'Modify an object label' is set to 'No One'

CCE|CCE-36054-5

2.2.40 Ensure 'Modify firmware environment values' is set to 'Administrators'

CCE|CCE-38113-7

2.2.41 Ensure 'Perform volume maintenance tasks' is set to 'Administrators'

CCE|CCE-36143-6

2.2.42 Ensure 'Profile single process' is set to 'Administrators'

CCE|CCE-37131-0

2.2.43 Ensure 'Profile system performance' is set to 'Administrators, NT SERVICE\WdiServiceHost'

CCE|CCE-36052-9

2.2.44 Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-37430-6

2.2.45 Ensure 'Restore files and directories' is set to 'Administrators'

CCE|CCE-37613-7

2.2.46 Ensure 'Shut down the system' is set to 'Administrators'

CCE|CCE-38328-1

2.2.48 Ensure 'Take ownership of files or other objects' is set to 'Administrators'

CCE|CCE-38325-7

2.3.1.1 Ensure 'Accounts: Administrator account status' is set to 'Disabled' (MS only)

800-53|AC-2

CCE|CCE-37953-7

2.3.1.2 Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

800-53|IA-8(2)

CCE|CCE-36147-7

2.3.1.3 Ensure 'Accounts: Guest account status' is set to 'Disabled' (MS only)

CCE|CCE-37432-2

CSCv6|16.1

2.3.1.4 Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'

CCE|CCE-37615-2

2.3.1.5 Configure 'Accounts: Rename administrator account'

CCE|CCE-38233-3

2.3.1.6 Configure 'Accounts: Rename guest account'

CCE|CCE-38027-9

2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled'

800-53|AU-12

CCE|CCE-37850-5

CSCv6|6.2

CSCv7|6.2

CSCv7|6.3

CSCv7|6.4

2.3.2.2 Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled'

800-53|AU-5(4)

CCE|CCE-35907-5

CSCv6|6

2.3.4.1 Ensure 'Devices: Allowed to format and eject removable media' is set to 'Administrators'

800-53|MP-2

CCE|CCE-37701-0

CSCv7|8.4

CSCv7|13.7

2.3.4.2 Ensure 'Devices: Prevent users from installing printer drivers' is set to 'Enabled'

800-53|AC-6(10)

CCE|CCE-37942-0

CSCv7|5.1

2.3.6.1 Ensure 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'

800-53|IA-3(1)

CCE|CCE-36142-8

CSCv6|13

CSCv7|13.3

2.3.6.2 Ensure 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled'

CCE|CCE-37130-2

2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled'

CCE|CCE-37222-7

2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled'

800-53|IA-5

CCE|CCE-37508-9

2.3.6.5 Ensure 'Domain member: Maximum machine account password age' is set to '30 or fewer days, but not 0'

CCE|CCE-37431-4

2.3.6.6 Ensure 'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled'

CCE|CCE-37614-5

2.3.7.1 Ensure 'Interactive logon: Do not display last user name' is set to 'Enabled'

800-53|CM-6

CCE|CCE-36056-0

2.3.7.2 Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'

CCE|CCE-37637-6

CSCv6|8

2.3.7.3 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'

800-53|AC-11

CCE|CCE-38235-8

2.3.7.4 Configure 'Interactive logon: Message text for users attempting to log on'

800-53|AC-8

CCE|CCE-37226-8

2.3.7.5 Configure 'Interactive logon: Message title for users attempting to log on'

CCE|CCE-37512-1

2.3.7.7 Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days'

CCE|CCE-37622-8

2.3.7.8 Ensure 'Interactive logon: Require Domain Controller Authentication to unlock workstation' is set to 'Enabled' (MS only)

CCE|CCE-38240-8

CSCv6|16.9

2.3.7.9 Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation' or higher

CCE|CCE-38333-1

2.3.8.1 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'

CCE|CCE-36325-9

2.3.8.2 Ensure 'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled'

CCE|CCE-36269-9

2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'

800-53|SI-5(7)

CCE|CCE-37863-8

2.3.9.1 Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)'

800-53|AC-12

CCE|CCE-38046-9

CSCv6|3

2.3.9.2 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'

Detections

Analytics

Revision 1.2

Nov 9, 2020

Functional Update