CIS Microsoft Windows 10 Enterprise v2.0.0 L1 + NG

Audit Details

Name: CIS Microsoft Windows 10 Enterprise v2.0.0 L1 + NG

Updated: 2/27/2024

Authority: CIS

Plugin: Windows

Revision: 1.6

Estimated Item Count: 392

File Details

Filename: CIS_MS_Windows_10_Enterprise_Level_1_Next_Generation_Windows_Security_v2.0.0.audit

Size: 1.06 MB

MD5: 03641afe8482ae3c82a63a4f7c3b8d17
SHA256: b65c544c907b53c65c1f1207a0f111074684d63fa8ef4be994489be87acab751

Audit Items

DescriptionCategories
1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.2 Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'

IDENTIFICATION AND AUTHENTICATION

1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled'

IDENTIFICATION AND AUTHENTICATION

1.1.6 Ensure 'Relax minimum password length limits' is set to 'Enabled'

IDENTIFICATION AND AUTHENTICATION

1.1.7 Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)'

ACCESS CONTROL

1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'

ACCESS CONTROL

1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'

ACCESS CONTROL

1.2.4 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'

ACCESS CONTROL

2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.3 Ensure 'Act as part of the operating system' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.4 Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.5 Ensure 'Allow log on locally' is set to 'Administrators, Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.6 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.7 Ensure 'Back up files and directories' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.8 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.9 Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE, Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.10 Ensure 'Create a pagefile' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.11 Ensure 'Create a token object' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.12 Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.13 Ensure 'Create permanent shared objects' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.14 Configure 'Create symbolic links'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.15 Ensure 'Debug programs' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.16 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.17 Ensure 'Deny log on as a batch job' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.18 Ensure 'Deny log on as a service' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.19 Ensure 'Deny log on locally' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.20 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests, Local account'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.21 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.22 Ensure 'Force shutdown from a remote system' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.23 Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.24 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.25 Ensure 'Increase scheduling priority' is set to 'Administrators, Window Manager\Window Manager Group'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.26 Ensure 'Load and unload device drivers' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.27 Ensure 'Lock pages in memory' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.30 Ensure 'Manage auditing and security log' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.31 Ensure 'Modify an object label' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.32 Ensure 'Modify firmware environment values' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.33 Ensure 'Perform volume maintenance tasks' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.34 Ensure 'Profile single process' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.35 Ensure 'Profile system performance' is set to 'Administrators, NT SERVICE\WdiServiceHost'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.36 Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.37 Ensure 'Restore files and directories' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.38 Ensure 'Shut down the system' is set to 'Administrators, Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.39 Ensure 'Take ownership of files or other objects' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.3.1.1 Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

ACCESS CONTROL

2.3.1.2 Ensure 'Accounts: Guest account status' is set to 'Disabled'

IDENTIFICATION AND AUTHENTICATION