1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)'

800-53|IA-5(1)

CCE|CCE-35219-5

CSCv6|16.5

1.1.2 Ensure 'Maximum password age' is set to '60 or fewer days, but not 0'

CCE|CCE-34907-6

1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)'

CCE|CCE-35366-4

1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)'

CCE|CCE-33789-9

CSCv6|5.7

CSCv6|16.2

1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled'

CCE|CCE-33777-4

1.1.6 Ensure 'Store passwords using reversible encryption' is set to 'Disabled'

CCE|CCE-35370-6

CSCv6|16.13

CSCv6|16.14

1.2.1 Ensure 'Account lockout duration' is set to '15 or more minute(s)'

800-53|AC-7

CCE|CCE-35409-2

CSCv6|16.7

1.2.2 Ensure 'Account lockout threshold' is set to '10 or fewer invalid logon attempt(s), but not 0'

CCE|CCE-33728-7

1.2.3 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)'

CCE|CCE-35408-4

2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

800-53|AC-6(7)

CCE|CCE-35457-1

CSCv6|5.1

2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

CCE|CCE-32928-4

CSCv6|9

2.2.3 Ensure 'Act as part of the operating system' is set to 'No One'

CCE|CCE-35403-5

2.2.4 Ensure 'Adjust memory quotas for a process' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-35490-2

2.2.5 Ensure 'Allow log on locally' is set to 'Administrators, Users'

CCE|CCE-35640-2

CSCv6|16

2.2.6 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users'

CCE|CCE-33035-7

2.2.7 Ensure 'Back up files and directories' is set to 'Administrators'

CCE|CCE-35699-8

2.2.8 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

CCE|CCE-33094-4

2.2.9 Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE, Users'

CCE|CCE-33431-8

2.2.10 Ensure 'Create a pagefile' is set to 'Administrators'

CCE|CCE-33051-4

2.2.11 Ensure 'Create a token object' is set to 'No One'

CCE|CCE-33779-0

2.2.12 Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

CCE|CCE-33095-1

2.2.13 Ensure 'Create permanent shared objects' is set to 'No One'

CCE|CCE-33780-8

CCE|CCE-33053-0

2.2.15 Ensure 'Debug programs' is set to 'Administrators'

CCE|CCE-33157-9

2.2.16 Ensure 'Deny access to this computer from the network' to include 'Guests, Local account'

CCE|CCE-34173-5

2.2.17 Ensure 'Deny log on as a batch job' to include 'Guests'

CCE|CCE-35461-3

2.2.18 Ensure 'Deny log on as a service' to include 'Guests'

CCE|CCE-35404-3

2.2.19 Ensure 'Deny log on locally' to include 'Guests'

CCE|CCE-35293-0

2.2.20 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests, Local account'

CCE|CCE-33787-3

2.2.21 Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One'

CCE|CCE-33778-2

2.2.22 Ensure 'Force shutdown from a remote system' is set to 'Administrators'

CCE|CCE-33715-4

2.2.23 Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-35363-1

2.2.24 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'

CCE|CCE-34021-6

2.2.25 Ensure 'Increase scheduling priority' is set to 'Administrators'

CCE|CCE-35178-3

2.2.26 Ensure 'Load and unload device drivers' is set to 'Administrators'

CCE|CCE-34903-5

2.2.27 Ensure 'Lock pages in memory' is set to 'No One'

CCE|CCE-33807-9

2.2.30 Ensure 'Manage auditing and security log' is set to 'Administrators'

CCE|CCE-35275-7

2.2.31 Ensure 'Modify an object label' is set to 'No One'

CCE|CCE-34913-4

2.2.32 Ensure 'Modify firmware environment values' is set to 'Administrators'

CCE|CCE-35183-3

2.2.33 Ensure 'Perform volume maintenance tasks' is set to 'Administrators'

CCE|CCE-35369-8

2.2.34 Ensure 'Profile single process' is set to 'Administrators'

CCE|CCE-35000-9

2.2.35 Ensure 'Profile system performance' is set to 'Administrators, NT SERVICE\WdiServiceHost'

CCE|CCE-35001-7

2.2.36 Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE'

CCE|CCE-35003-3

2.2.37 Ensure 'Restore files and directories' is set to 'Administrators'

CCE|CCE-35067-8

2.2.38 Ensure 'Shut down the system' is set to 'Administrators, Users'

CCE|CCE-35004-1

2.2.39 Ensure 'Take ownership of files or other objects' is set to 'Administrators'

CCE|CCE-35009-0

2.3.1.1 Ensure 'Accounts: Administrator account status' is set to 'Disabled'

800-53|AC-2

CCE|CCE-33511-7

2.3.1.2 Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'

800-53|IA-8

CCE|CCE-35487-8

2.3.1.3 Ensure 'Accounts: Guest account status' is set to 'Disabled'

CCE|CCE-33949-9

CSCv6|16.1

2.3.1.4 Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'

800-53|IA-5

CCE|CCE-32929-2

2.3.1.5 Configure 'Accounts: Rename administrator account'

CCE|CCE-33034-0

2.3.1.6 Configure 'Accounts: Rename guest account'

CCE|CCE-35488-6

2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set

800-53|AU-12

CCE|CCE-35533-9

CSCv6|6.2

2.3.2.2 Ensure 'Audit: Shut down system immediately if unable to log security audits' is set to 'Disabled'

800-53|AU-5

CCE|CCE-33046-4

CSCv6|6

2.3.4.1 Ensure 'Devices: Allowed to format and eject removable media' is set to 'Administrators and Interactive Users'

800-53|MP-2

CCE|CCE-34355-8

CSCv6|8.3

2.3.6.1 Ensure 'Domain member: Digitally encrypt or sign secure channel data (always)' is set to 'Enabled'

800-53|IA-3

CCE|CCE-34892-0

CSCv6|13

2.3.6.2 Ensure 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled'

CCE|CCE-35273-2

2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled'

CCE|CCE-34893-8

2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled'

CCE|CCE-34986-0

2.3.6.5 Ensure 'Domain member: Maximum machine account password age' is set to '30 or fewer days, but not 0'

CCE|CCE-34894-6

2.3.6.6 Ensure 'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled'

CCE|CCE-35177-5

2.3.7.1 Ensure 'Interactive logon: Do not display last user name' is set to 'Enabled'

800-53|CM-6

CCE|CCE-34898-7

CSCv6|3.1

2.3.7.2 Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'

CCE|CCE-35099-1

CSCv6|8

2.3.7.4 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'

800-53|AC-11

CCE|CCE-34900-1

2.3.7.5 Configure 'Interactive logon: Message text for users attempting to log on'

800-53|AC-8

CCE|CCE-35064-5

2.3.7.6 Configure 'Interactive logon: Message title for users attempting to log on'

CCE|CCE-35179-1

2.3.7.8 Ensure 'Interactive logon: Prompt user to change password before expiration' is set to 'between 5 and 14 days'

CCE|CCE-35274-0

2.3.7.9 Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation' or higher

CCE|CCE-34988-6

2.3.8.1 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'

CCE|CCE-35222-9

2.3.8.2 Ensure 'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled'

CCE|CCE-34908-4

2.3.8.3 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'

800-53|SI-5

CCE|CCE-33717-0

2.3.9.1 Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set

800-53|AC-12

CCE|CCE-34909-2

CSCv6|3

CSCv6|16.4

2.3.9.2 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'

CCE|CCE-35065-2

2.3.9.3 Ensure 'Microsoft network server: Digitally sign communications (if client agrees)' is set to 'Enabled'

CCE|CCE-35182-5

2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled'

CCE|CCE-34911-8

2.3.9.5 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher

CCE|CCE-35299-7

CSCv6|14

2.3.10.1 Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled'

800-53|AC-6(10)

800-53|IA-2(2)

CCE|CCE-34914-2

2.3.10.2 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'

800-53|AC-6

CCE|CCE-34631-2

2.3.10.3 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'

CCE|CCE-34723-7

2.3.10.4 Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'

CCE|CCE-33718-8

2.3.10.5 Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled'

CCE|CCE-35367-2

2.3.10.6 Ensure 'Network access: Named Pipes that can be accessed anonymously' is set to 'None'

Detections

Analytics

Revision 1.3

Mar 4, 2019

Functional Update

Miscellaneous