| 1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | ACCESS CONTROL |
| 2.2.36 Ensure 'Log on as a batch job' is set to 'Administrators' (DC Only) | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.37 Ensure 'Log on as a batch job' is set to 'Administrators' (DC Only) | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 17.2.6 Ensure 'Audit User Account Management' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.4.1 Ensure 'Audit Directory Service Access' is set to include 'Failure' (DC only) | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.3 Ensure 'Audit Logoff' is set to include 'Success' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.3 Ensure 'Audit Other Object Access Events' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.4 Ensure 'Audit Removable Storage' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 18.5.5 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.7 Ensure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.5.9 Ensure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.5.10 Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.5.10 Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.6.5.1 Ensure 'Enable Font Providers' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.6.9.1 Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.6.10.2 Ensure 'Turn off Microsoft Peer-to-Peer Networking Services' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.6.20.1 Ensure 'Configuration of wireless settings using Windows Connect Now' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.8.1.1 Ensure 'Turn off notifications network usage' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.5.1 Ensure 'Turn On Virtualization Based Security' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 NG DC | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.5.2 Ensure 'Turn On Virtualization Based Security: Select Platform Security Level' is set to 'Secure Boot' or higher | CIS Microsoft Windows Server 2019 v5.0.0 NG DC | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.20.1.3 Ensure 'Turn off handwriting recognition error reporting' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.8 Ensure 'Turn off Search Companion content file updates' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.11 Ensure 'Turn off the Windows Messenger Customer Experience Improvement Program' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.28.1 Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.33.1 Ensure 'Allow Clipboard synchronization across devices' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.33.2 Ensure 'Allow upload of User Activities' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.33.2 Ensure 'Allow upload of User Activities' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.1 Ensure 'Allow network connectivity during connected-standby (on battery)' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.2 Ensure 'Allow network connectivity during connected-standby (plugged in)' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.9.51.1 Ensure 'Turn off the advertising ID' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.13.2 Ensure 'Turn off cloud optimized content' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.6 Ensure 'Limit Dump Collection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.16.6 Ensure 'Limit Dump Collection' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.18.1 Ensure 'Enable App Installer' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.36.1 Ensure 'Turn off location' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.56.1 Ensure 'Turn off Push To Install service' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.2.1 Ensure 'Restrict Remote Desktop Services users to a single Remote Desktop Services session' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.1 Ensure 'Do not allow COM port redirection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.4 Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.3.5 Ensure 'Do not allow LPT port redirection' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.59.2 Ensure 'Allow Cloud Search' is set to 'Enabled: Disable Cloud Search' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.59.4 Ensure 'Allow search highlights' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.63.1 Ensure 'Turn off KMS Client Online AVS Validation' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.81.1 Ensure 'Allow suggested apps in Windows Ink Workspace' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.82.3 Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 19.6.6.1.1 Ensure 'Turn off Help Experience Improvement Program' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 19.7.8.3 Ensure 'Do not use diagnostic data for tailored experiences' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 19.7.46.2.1 Ensure 'Prevent Codec Download' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
| 19.7.46.2.1 Ensure 'Prevent Codec Download' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L2 DC | Windows | CONFIGURATION MANAGEMENT |
