1.1.1.1.1.1 Configure 'Maximum lifetime for service ticket'

800-53|IA-5(13)

CCE|CCE-3237-5

1.1.1.1.1.2 Configure 'Enforce user logon restrictions'

800-53|AC-2(11)

CCE|CCE-3700-2

1.1.1.1.1.3 Configure 'Maximum lifetime for user ticket'

CCE|CCE-3625-1

1.1.1.1.1.4 Configure 'Maximum tolerance for computer clock synchronization'

800-53|AU-8(1)

CCE|CCE-3396-9

CSCv6|6.1

1.1.1.1.1.5 Configure 'Maximum lifetime for user ticket renewal'

CCE|CCE-7606-7

1.1.1.1.2.1 Set 'Reset account lockout counter after' to '15' or more

800-53|AC-7

CCE|CCE-3574-1

CSCv6|16.7

1.1.1.1.2.2 Set 'Account lockout duration' to '15' or greater

CCE|CCE-2627-8

1.1.1.1.2.3 Set 'Account lockout threshold' is set to '6' or fewer

CCE|CCE-3551-9

1.1.1.1.3.1 Set 'Maximum password age' to '60' or less

800-53|IA-5(1)

CCE|CCE-3530-3

1.1.1.1.3.2 Set 'Enforce password history' to '24' or more

CCE|CCE-3446-2

1.1.1.1.3.3 Set 'Store passwords using reversible encryption' to 'Disabled'

CCE|CCE-2644-3

CSCv6|16.13

CSCv6|16.14

1.1.1.1.3.4 Set 'Minimum password age' to '1' or more

CCE|CCE-3548-5

1.1.1.1.3.5 Set 'Password must meet complexity requirements' to 'Enabled'

CCE|CCE-3442-1

1.1.1.1.3.6 Set 'Minimum password length' to '14' or more

CCE|CCE-3424-9

1.1.1.2.1.1 Set 'Domain controller: Allow server operators to schedule tasks' to 'Disabled'

800-53|AC-6(8)

CCE|CCE-3479-3

1.1.1.2.1.2 Set 'Accounts: Guest account status' to 'Disabled'

800-53|AC-2

CCE|CCE-2908-2

1.1.1.2.1.3 Set 'Accounts: Limit local account use of blank passwords to console logon only' to 'Enabled'

CCE|CCE-3357-1

1.1.1.2.1.4 Set 'Domain controller: Refuse machine account password changes' to 'Disabled'

800-53|IA-5

CCE|CCE-3605-3

1.1.1.2.1.6 Set 'System objects: Default owner for objects created by members of the Administrators group' to 'Object creator'

800-53|AC-3(4)

CCE|CCE-2947-0

1.1.1.2.1.7 Set 'Network access: Shares that can be accessed anonymously' to 'None'

800-53|IA-2(2)

CCE|CCE-3592-3

1.1.1.2.1.8 Set 'Interactive logon: Smart card removal behavior' to 'Lock Workstation'

800-53|AC-11

CCE|CCE-3674-9

1.1.1.2.1.9 Set 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients'

800-53|SC-8

CCE|CCE-3614-5

1.1.1.2.1.10 Set 'Devices: Prevent users from installing printer drivers' to 'Enabled'

800-53|AC-6(10)

CCE|CCE-3769-7

1.1.1.2.1.11 Set 'Devices: Unsigned driver installation behavior' to 'Warn but allow installation'

800-53|CM-5(3)

CCE|CCE-3787-9

1.1.1.2.1.12 Set 'Recovery console: Allow floppy copy and access to all drives and all folders' to 'Disabled'

800-53|CM-6

CCE|CCE-3676-4

CSCv6|3.1

1.1.1.2.1.13 Set 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)' to 'Enabled'

CCE|CCE-3757-2

1.1.1.2.1.14 Set 'Network access: Restrict anonymous access to Named Pipes and Shares' to 'Enabled'

CCE|CCE-8091-1

1.1.1.2.1.15 Set 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' to '90'

800-53|AU-4

CCE|CCE-8479-8

CSCv6|6.3

1.1.1.2.1.16 Set 'MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)'

800-53|SC-7

CCE|CCE-3616-0

CSCv6|9.2

1.1.1.2.1.17 Set 'System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies' to 'Enabled'

800-53|SI-7(6)

CCE|CCE-7936-8

1.1.1.2.1.18 Set 'MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)' to 'Enabled'

CCE|CCE-5026-0

1.1.1.2.1.19 Set 'Shutdown: Clear virtual memory pagefile' to 'Disabled'

CCE|CCE-3593-1

1.1.1.2.1.20 Set 'Domain member: Disable machine account password changes' to 'Disabled'

CCE|CCE-8592-8

1.1.1.2.1.21 Set 'Microsoft network server: Amount of idle time required before suspending session' to '15'

800-53|AC-12

CCE|CCE-3761-4

CSCv6|16.4

1.1.1.2.1.22 'MSS(NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' to 'Enabled'

800-53|SC-21

CCE|CCE-2817-5

1.1.1.2.1.23 Configure 'Devices: Restrict CD-ROM access to locally logged-on user only'

800-53|MP-2

CCE|CCE-3694-7

CSCv6|8.3

1.1.1.2.1.24 Set 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' to '300000 or 5 minutes (recommended)'

CCE|CCE-2812-6

1.1.1.2.1.25 Set 'Shutdown: Allow system to be shut down without having to log on' to 'Disabled'

CCE|CCE-3448-8

1.1.1.2.1.26 Set 'Interactive logon: Do not display last user name' to 'Enabled'

CCE|CCE-3527-9

1.1.1.2.1.27 Set 'Network security: LAN Manager authentication level' to 'Send NTLMv2 response only. Refuse LM &amp; NTLM'

800-53|IA-5(6)

CCE|CCE-3703-6

1.1.1.2.1.28 Configure 'DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax'

CCE|CCE-7773-5

1.1.1.2.1.29 Configure 'MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)'

CCE|CCE-8380-8

1.1.1.2.1.30 Set 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' to 'Disabled'

CCE|CCE-3690-5

1.1.1.2.1.31 Set 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers'

CCE|CCE-3759-8

1.1.1.2.1.32 Set 'System objects: Require case insensitivity for  non-Windows subsystems' to 'Enabled'

CCE|CCE-3714-3

1.1.1.2.1.33 Configure 'DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax'

CCE|CCE-8561-3

1.1.1.2.1.34 Set 'System settings: Optional subsystems' to ''

800-53|CM-7

CCE|CCE-17448-2

CSCv6|9.1

1.1.1.2.1.35 Set 'Devices: Allowed to format and eject removable media' to 'Administrators'

CCE|CCE-3586-5

1.1.1.2.1.36 Set 'Microsoft network client: Digitally sign communications (always)' to 'Enabled'

800-53|IA-3(1)

CCE|CCE-3652-5

1.1.1.2.1.37 Set 'Interactive logon: Prompt user to change password before expiration' to '14'

CCE|CCE-3804-2

1.1.1.2.1.38 Set 'Domain member: Maximum machine account password age' to '30'

CCE|CCE-2984-3

1.1.1.2.1.39 Set 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode(recommended)' to 'Enabled'

CCE|CCE-3778-8

1.1.1.2.1.40 Configure 'Interactive logon: Display user information when the session is locked'

CCE|CCE-17461-5

1.1.1.2.1.41 Set 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)' to '3'

CCE|CCE-7613-3

1.1.1.2.1.42 Set 'Domain member: Digitally sign secure channel data (when possible)' to 'Enabled'

CCE|CCE-3514-7

1.1.1.2.1.43 Set 'Domain member: Digitally encrypt secure channel data (when possible)' to 'Enabled'

CCE|CCE-3796-0

1.1.1.2.1.44 Configure 'Domain controller: LDAP server signing requirements'

CCE|CCE-3801-8

1.1.1.2.1.45 Set 'Microsoft network client: Send unencrypted password to third-party SMB servers' to 'Disabled'

800-53|SI-5(7)

CCE|CCE-2870-4

1.1.1.2.1.46 Set 'Interactive logon: Do not require CTRL+ALT+DEL' to 'Disabled'

CCE|CCE-3060-1

1.1.1.2.1.47 Configure 'Interactive logon: Message title for users attempting to log on'

800-53|AC-8

CCE|CCE-2790-4

1.1.1.2.1.48 Configure 'Interactive logon: Message text for users attempting to log on'

CCE|CCE-3672-3

1.1.1.2.1.49 Set 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' to '0'

CCE|CCE-3764-8

1.1.1.2.1.50 Set 'Microsoft network client: Digitally sign communications (if server agrees)' to 'Enabled'

CCE|CCE-8534-0

1.1.1.2.1.51 Set 'Domain member: Digitally encrypt or sign secure channel data (always)' to 'Enabled'

CCE|CCE-3731-7

1.1.1.2.1.52 Set 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' to 'Enabled'

CCE|CCE-2963-7

1.1.1.2.1.53 Set 'Network security: Do not store LAN Manager hash value on next password change' to 'Enabled'

CCE|CCE-3632-7

1.1.1.2.1.54 Set 'Network access: Remotely accessible registry paths and sub-paths'

800-53|AC-6(7)

CCE|CCE-8325-3

1.1.1.2.1.55 Configure 'System cryptography: Force strong key protection for user keys stored on the computer'

800-53|IA-5(2)

CCE|CCE-8462-4

1.1.1.2.1.56 Set 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)'

CCE|CCE-3227-6

1.1.1.2.1.57 Set MSS(PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses' to 'Disabled'

CCE|CCE-3509-7

1.1.1.2.1.58 Set 'MSS: (TcpMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged'

CCE|CCE-8472-3

1.1.1.2.1.59 Set 'Microsoft network server: Disconnect clients when logon hours expire' to 'Enabled'

CCE|CCE-3773-9

1.1.1.2.1.60 Set 'Network access: Let Everyone permissions apply to anonymous users' to 'Disabled'

CCE|CCE-3817-4

1.1.1.2.1.61 Set 'Microsoft network server: Digitally sign communications (always)' to 'Enabled'

CCE|CCE-3295-3

1.1.1.2.1.62 Set 'Network security: LDAP client signing requirements' to 'Negotiate signing' or better

CCE|CCE-2819-1

1.1.1.2.1.63 Set 'Devices: Allow undock without having to log on' to 'Disabled'

CCE|CCE-3613-7

1.1.1.2.1.64 Set 'Audit: Audit the access of global system objects' to 'Disabled'

800-53|AU-12

CCE|CCE-3774-7

1.1.1.2.1.65 Set 'MSS: (AutoReboot) Allow Windows to automatically restart after a system crash'

800-53|SC-24

CCE|CCE-7611-7

1.1.1.2.1.66 Set 'Interactive logon: Require smart card' to 'Disabled'

800-53|IA-5(11)

CCE|CCE-8542-3

1.1.1.2.1.67 Configure 'Devices: Restrict floppy access to locally logged-on user only'

Detections

Analytics

Revision 1.24

Nov 17, 2020

Functional Update