| 2.3.8.2 Ensure 'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | CONFIGURATION MANAGEMENT |
| 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL |
| 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 NG | Windows | ACCESS CONTROL |
| 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows 11 Enterprise v5.1.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.9.3 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0 | Windows | ACCESS CONTROL |
| 2.3.9.4 Ensure 'Microsoft network server: Disconnect clients when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | ACCESS CONTROL |
| 5.1.2.4 Ensure access to the Entra admin center is restricted | CIS Microsoft 365 Foundations v7.0.0 L1 E5 | microsoft_azure | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION |
| 18.5.10.1 (L2) Ensure 'Turn off Microsoft Peer-to-Peer Networking Services' is set to 'Enabled' | CIS Microsoft Windows 8.1 v2.4.1 L2 Bitlocker | Windows | CONFIGURATION MANAGEMENT |
| 18.6.10.2 (L2) Ensure 'Turn off Microsoft Peer-to-Peer Networking Services' is set to 'Enabled' | CIS Windows Server 2012 R2 DC L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| 18.6.10.2 (L2) Ensure 'Turn off Microsoft Peer-to-Peer Networking Services' is set to 'Enabled' | CIS Windows Server 2012 R2 MS L2 v3.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Access | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Access | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Acrobat | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - jre6_java | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - jre6_javaw | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - jre6_javaws | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - jre7_javaw | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Outlook | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Picture Manager | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Visio | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Visio | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - VisioViewer | MSCT Windows Server 2012 R2 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Default Protections for Recommended Software - Word | MSCT Windows Server 2012 R2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| DTOO211 - ActiveX Installs must be configured for proper restriction in PowerPoint. | DISA STIG Microsoft PowerPoint 2016 v2r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| EDGE-00-000009 - The default search provider must be set to use an encrypted connection. | DISA STIG Edge v2r3 | Windows | CONFIGURATION MANAGEMENT |
| MSFT-11-003500 - Microsoft Android 11 must be configured to disable USB mass storage mode. | MobileIron - DISA Microsoft Android 11 COBO v1r2 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| MSFT-11-003500 - Microsoft Android 11 must be configured to disable USB mass storage mode. | AirWatch - DISA Microsoft Android 11 COPE v1r2 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| MSFT-11-003500 - Microsoft Android 11 must be configured to disable USB mass storage mode. | MobileIron - DISA Microsoft Android 11 COPE v1r2 | MDM | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN11-CC-000391 - Internet Explorer must be disabled for Windows 11. | DISA Microsoft Windows 11 STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WN11-EP-000310 - Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled. | DISA Microsoft Windows 11 STIG v2r11 | Windows | AUDIT AND ACCOUNTABILITY |
| WN11-SO-000020 - The built-in administrator account must be renamed. | DISA Microsoft Windows 11 STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WN11-SO-000100 - The Windows SMB client must be configured to always perform SMB packet signing. | DISA Microsoft Windows 11 STIG v2r11 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN11-SO-000150 - Anonymous enumeration of shares must be restricted. | DISA Microsoft Windows 11 STIG v2r11 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN11-SO-000160 - The system must be configured to prevent anonymous users from having the same rights as the Everyone group. | DISA Microsoft Windows 11 STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WN11-SO-000167 - Remote calls to the Security Account Manager (SAM) must be restricted to Administrators. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-SO-000180 - NTLM must be prevented from falling back to a Null session. | DISA Microsoft Windows 11 STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WN11-SO-000220 - The system must be configured to meet the minimum session security requirement for NTLM SSP based servers. | DISA Microsoft Windows 11 STIG v2r11 | Windows | CONFIGURATION MANAGEMENT |
| WN11-SO-000255 - User Account Control must automatically deny elevation requests for standard users. | DISA Microsoft Windows 11 STIG v2r11 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN11-SO-000275 - User Account Control must virtualize file and registry write failures to per-user locations. | DISA Microsoft Windows 11 STIG v2r11 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN11-UR-000045 - The 'Create a token object' user right must not be assigned to any groups or accounts. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-UR-000075 - The 'Deny log on as a batch job' user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-UR-000080 - The 'Deny log on as a service' user right on Windows 11 domain-joined workstations must be configured to prevent access from highly privileged domain accounts. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-UR-000090 - The 'Deny log on through Remote Desktop Services' user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-UR-000145 - The 'Perform volume maintenance tasks' user right must only be assigned to the Administrators group. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN11-UR-000165 - The 'Take ownership of files or other objects' user right must only be assigned to the Administrators group. | DISA Microsoft Windows 11 STIG v2r11 | Windows | ACCESS CONTROL |
| WN12-00-000180 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB client - LanManWorkstation | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-00-000180 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB client - mrxsmb10 | DISA Windows Server 2012 and 2012 R2 MS STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| WN12-CC-000068 - Responsiveness events must be prevented from being aggregated and sent to Microsoft. | DISA Windows Server 2012 and 2012 R2 DC STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
