| 2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.6 Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.19 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests, Local account' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.21 Ensure 'Force shutdown from a remote system' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.32 Ensure 'Perform volume maintenance tasks' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.38 Ensure 'Take ownership of files or other objects' is set to 'Administrators' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.1.2 Ensure 'Accounts: Guest account status' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.1.4 Configure 'Accounts: Rename administrator account' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.2.1 Ensure 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 2.3.6.2 Ensure 'Domain member: Digitally encrypt secure channel data (when possible)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.10.3 Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 2.3.11.1 Ensure 'Network security: Allow Local System to use computer identity for NTLM' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.11.5 Ensure 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.8 Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.10 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security, Require 128-bit encryption' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.15.2 Ensure 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 2.3.17.1 Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.17.4 Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 5.6 Ensure 'IIS Admin Service (IISADMIN)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.30 Ensure 'Special Administration Console Helper (sacsvr)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.36 Ensure 'Windows Media Player Network Sharing Service (WMPNetworkSvc)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.41 Ensure 'World Wide Web Publishing Service (W3SVC)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 5.44 Ensure 'Xbox Live Game Save (XblGameSave)' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 9.1.1 Ensure 'Windows Firewall: Domain: Firewall state' is set to 'On (recommended)' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.1.3 Ensure 'Windows Firewall: Domain: Settings: Display a notification' is set to 'No' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.4.1 Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 18.4.2 Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.4.3 Ensure 'Configure SMB v1 server' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.5.1 Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.21.1 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.7.9 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.7.10 Ensure 'Manage processing of Queue-specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.7.11 Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 18.9.4.1 Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.7.1.5 Ensure 'Prevent installation of devices using drivers that match these device setup classes: Prevent installation of devices using drivers for these device setup' is set to 'IEEE 1394 device setup classes' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.26.6 Ensure 'Password Settings: Password Age (Days)' is set to 'Enabled: 30 or fewer' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.29.1 Ensure 'Block user from showing account details on sign-in' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 18.9.35.6.4 Ensure 'Allow standby states (S1-S3) when sleeping (plugged in)' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.5 Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 18.9.37.2 Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.82.1 Ensure 'Allow user control over installs' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL |
| 18.10.83.1 Ensure 'Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.90.1.3 Ensure 'Disallow Digest authentication' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.3 Ensure 'Allow unencrypted traffic' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.94.1.1 Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.2.2 Ensure 'Configure Automatic Updates: Scheduled install day' is set to '0 - Every day' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 19.5.1.1 Ensure 'Turn off toast notifications on the lock screen' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
| 19.7.8.5 Ensure 'Turn off Spotlight collection on Desktop' is set to 'Enabled' | CIS Microsoft Windows 10 Enterprise v5.0.0 L1 BL | Windows | CONFIGURATION MANAGEMENT |
