| 2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.3 Ensure 'Act as part of the operating system' is set to 'No One' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.7 Ensure 'Back up files and directories' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.12 Ensure 'Create permanent shared objects' is set to 'No One' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.29 Ensure 'Manage auditing and security log' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.31 Ensure 'Modify firmware environment values' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.36 Ensure 'Restore files and directories' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.37 Ensure 'Shut down the system' is set to 'Administrators, Users' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.1.3 Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.7.4 Configure 'Interactive logon: Message text for users attempting to log on' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.10.1 Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 2.3.10.2 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.10.8 Ensure 'Network access: Remotely accessible registry paths and sub-paths' is configured | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.11.3 Ensure 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.11.4 Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.17.5 Ensure 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.17.7 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.17.8 Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.4 Ensure 'Enable Certificate Padding' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.5 Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.4.7 Ensure 'NetBT NodeType configuration' is set to 'Enabled: P-node (recommended)' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.5.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.3 Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.7 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.4.1 Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.4.2 Ensure 'Configure NetBIOS settings' is set to 'Enabled: Disable NetBIOS name resolution on public networks' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.6.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication', 'Require Integrity', and 'Require Privacy' set for all NETLOGON and SYSVOL shares' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.7.1 Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.7.4 Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.7.8 Ensure 'Configure RPC packet level privacy setting for incoming connections' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.17.1 Ensure 'Enable / disable CLFS logfile authentication' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.9.26.2 Ensure 'Do not allow password expiration time longer than required by policy' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.5 Ensure 'Password Settings: Password Length' is set to 'Enabled: 15 or more' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.8 Ensure 'Post-authentication actions: Actions' is set to 'Enabled: Reset the password and logoff the managed account' or higher | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.29.6 Ensure 'Turn off picture password sign-in' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.38.2 Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.53.1.2 Ensure 'Enable Windows NTP Server' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.10.3.8 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Configure storage of BitLocker recovery information to AD DS:' is set to 'Enabled: Backup recovery passwords and key packages' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.10.3.9 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for removable data drives' is set to 'Enabled: False' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | MEDIA PROTECTION |
| 18.10.18.4 Ensure 'Enable App Installer Local Archive Malware Scan Override' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.29.4 Ensure 'Turn off heap termination on corruption' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.59.4 Ensure 'Allow Cortana above lock screen' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.59.6 Ensure 'Allow search and Cortana to use location' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.82.2 Ensure 'Always install with elevated privileges' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 18.10.90.1.2 Ensure 'Allow unencrypted traffic' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 19.7.8.2 Ensure 'Do not suggest third-party content in Windows spotlight' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
