| 2.2.27 Ensure 'Log on as a batch job' is set to 'Administrators' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.7.1 Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.11.2 Ensure 'Network security: Allow LocalSystem NULL session fallback' is set to 'Disabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.14.1 Ensure 'System cryptography: Force strong key protection for user keys stored on the computer' is set to 'User is prompted when the key is first used' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.17.3 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 5.1 Ensure 'Bluetooth Audio Gateway Service (BTAGService)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.12 Ensure 'Microsoft iSCSI Initiator Service (MSiSCSI)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.14 Ensure 'Peer Name Resolution Protocol (PNRPsvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.15 Ensure 'Peer Networking Grouping (p2psvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.16 Ensure 'Peer Networking Identity Manager (p2pimsvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.018 - Windows Messenger (MSN Messenger, .NET messenger) is run at system startup. | DISA Windows Vista STIG v6r41 | Windows | CONFIGURATION MANAGEMENT |
| 5.18 Ensure 'Print Spooler (Spooler)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.21 Ensure 'Remote Desktop Configuration (SessionEnv)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.35 Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.5.4 Ensure 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.5.10 Ensure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.8.5.4 (NG) Ensure 'Turn On Virtualization Based Security: Require UEFI Memory Attributes Table' is set to 'True (checked)' | CIS Azure Compute Microsoft Windows Server 2019 v1.0.0 NG DC | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.7.1.6 Ensure 'Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed.' is set to 'True' (checked) | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.11.1.3 (BL) Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent' is set to 'Enabled: True' | CIS Microsoft Windows 8.1 v2.4.1 L2 Bitlocker | Windows | ACCESS CONTROL, CONTINGENCY PLANNING |
| 18.9.11.1.9 (BL) Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives' is set to 'Enabled: False' | CIS Microsoft Windows 8.1 v2.4.1 L1 Bitlocker | Windows | ACCESS CONTROL, CONTINGENCY PLANNING |
| 18.9.11.3.3 (BL) Ensure 'Choose how BitLocker-protected removable drives can be recovered: Allow data recovery agent' is set to 'Enabled: True' | CIS Microsoft Windows 8.1 v2.4.1 L2 Bitlocker | Windows | ACCESS CONTROL, CONTINGENCY PLANNING |
| 18.9.20.1.7 (L2) Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Windows Server 2012 DC L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2022 Stand-alone v2.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.8 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L2 NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.9 Ensure 'Turn off Search Companion content file updates' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.11 Ensure 'Turn off the 'Publish to Web' task for files and folders' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.28.1 Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | ACCESS CONTROL |
| 18.9.35.6.3 Ensure 'Allow standby states (S1-S3) when sleeping (on battery)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.4 Ensure 'Allow standby states (S1-S3) when sleeping (plugged in)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.10.1.4 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Password' is set to 'Enabled: Allow 48-digit recovery password' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.5 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Key' is set to 'Enabled: Allow 256-bit recovery key' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.7 Ensure 'Configure use of hardware-based encryption for fixed data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | ACCESS CONTROL |
| 18.10.10.1.9 Ensure 'Configure use of smart cards on fixed data drives' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.2.1 Ensure 'Allow enhanced PINs for startup' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.10.2.2 Ensure 'Allow Secure Boot for integrity validation' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.10.2.5 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.2.8 Ensure 'Configure use of hardware-based encryption for operating system drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | ACCESS CONTROL |
| 18.10.10.3.7 Ensure 'Configure use of hardware-based encryption for removable data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | ACCESS CONTROL |
| 18.10.16.4 Ensure 'Enable OneSettings Auditing' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.16.5 Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.6 Ensure 'Limit Dump Collection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.57.3.2.1 Ensure 'Allow users to connect remotely by using Remote Desktop Services' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.5 Ensure 'Do not allow LPT port redirection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.7 Ensure 'Do not allow WebAuthn redirection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.91.1 Ensure 'Allow Remote Shell Access' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.92.2 Ensure 'Allow mapping folders into Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 18.10.92.2 Ensure 'Allow mapping folders into Windows Sandbox' is set to 'Disabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
