CIS Microsoft Windows 11 Enterprise v1.0.0 L1

Audit Details

Name: CIS Microsoft Windows 11 Enterprise v1.0.0 L1

Updated: 9/30/2022

Authority: CIS

Plugin: Windows

Revision: 1.4

Estimated Item Count: 361

File Details

Filename: CIS_MS_Windows_11_Enterprise_Level_1_v1.0.0.audit

Size: 986 kB

MD5: 7adb0cf97c8d94612f5f3672bc91c795
SHA256: 2d4bfeaae64a5f4b9116d24735f0512376ce695df65a0f0b249f4e0cb5e04828

Audit Items

DescriptionCategories
1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.2 Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'

IDENTIFICATION AND AUTHENTICATION

1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)'

IDENTIFICATION AND AUTHENTICATION

1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled'

IDENTIFICATION AND AUTHENTICATION

1.1.6 Ensure 'Relax minimum password length limits' is set to 'Enabled'

IDENTIFICATION AND AUTHENTICATION

1.1.7 Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)'

ACCESS CONTROL

1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0'

ACCESS CONTROL

1.2.3 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'

ACCESS CONTROL

2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.3 Ensure 'Act as part of the operating system' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.4 Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.5 Ensure 'Allow log on locally' is set to 'Administrators, Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.6 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.7 Ensure 'Back up files and directories' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.8 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.9 Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE, Users'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.10 Ensure 'Create a pagefile' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.11 Ensure 'Create a token object' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.12 Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.13 Ensure 'Create permanent shared objects' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.14 Configure 'Create symbolic links' - Create symbolic links

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.15 Ensure 'Debug programs' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.16 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.17 Ensure 'Deny log on as a batch job' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.18 Ensure 'Deny log on as a service' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.19 Ensure 'Deny log on locally' to include 'Guests'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.20 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests, Local account'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.21 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.22 Ensure 'Force shutdown from a remote system' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.23 Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'

AUDIT AND ACCOUNTABILITY

2.2.24 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.25 Ensure 'Increase scheduling priority' is set to 'Administrators, Window Manager\Window Manager Group'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.26 Ensure 'Load and unload device drivers' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.27 Ensure 'Lock pages in memory' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.30 Ensure 'Manage auditing and security log' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.31 Ensure 'Modify an object label' is set to 'No One'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.32 Ensure 'Modify firmware environment values' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.33 Ensure 'Perform volume maintenance tasks' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.34 Ensure 'Profile single process' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.35 Ensure 'Profile system performance' is set to 'Administrators, NT SERVICE\WdiServiceHost'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.36 Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.37 Ensure 'Restore files and directories' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

2.2.38 Ensure 'Shut down the system' is set to 'Administrators, Users'

ACCESS CONTROL, MEDIA PROTECTION

2.2.39 Ensure 'Take ownership of files or other objects' is set to 'Administrators'

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

2.3.1.1 Ensure 'Accounts: Administrator account status' is set to 'Disabled'

IDENTIFICATION AND AUTHENTICATION

2.3.1.2 Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

ACCESS CONTROL

2.3.1.3 Ensure 'Accounts: Guest account status' is set to 'Disabled'

IDENTIFICATION AND AUTHENTICATION