| 1.1.2 Ensure 'Maximum password age' is set to '365 or fewer days, but not 0' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.6 Ensure 'Relax minimum password length limits' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.7 Ensure 'Store passwords using reversible encryption' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.10.4 Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 17.3.2 Ensure 'Audit Process Creation' is set to include 'Success' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.4 Ensure 'Audit Logon' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.1 Ensure 'Audit Detailed File Share' is set to include 'Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.2 Ensure 'Audit File Share' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.1 Ensure 'Audit Audit Policy Change' is set to include 'Success' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.2 Ensure 'Audit Other System Events' is set to 'Success and Failure' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.5.4 Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.5.7 Ensure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.5.11 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.4.3 Ensure 'Turn off default IPv6 DNS Servers' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.9.1 Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.20.2 Ensure 'Prohibit access of the Windows Connect Now wizards' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.5.1 Ensure 'Turn On Virtualization Based Security' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 NG MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.5.7 Ensure 'Turn On Virtualization Based Security: Secure Launch Configuration' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 NG MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.20.1.2 Ensure 'Turn off handwriting personalization data sharing' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.4 Ensure 'Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.6 Ensure 'Turn off printing over HTTP' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.10 Ensure 'Turn off the 'Publish to Web' task for files and folders' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.12 Ensure 'Turn off Windows Customer Experience Improvement Program' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.23.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.28.1 Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.33.2 Ensure 'Allow upload of User Activities' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.35.6.1 Ensure 'Allow network connectivity during connected-standby (on battery)' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.8.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.9.1.1 Ensure 'Configure enhanced anti-spoofing' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.15.1 Ensure 'Do not display the password reveal button' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.16.2 Ensure 'Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service' is set to 'Enabled: Disable Authenticated Proxy usage' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.5 Ensure 'Enable App Installer Microsoft Store Source Certificate Validation Bypass' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.26.1.2 Ensure 'Application: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.2.2 Ensure 'Security: Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.3.1 Ensure 'Setup: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.4.1 Ensure 'System: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.29.3 Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.40.1 Ensure 'Allow Message Service Cloud Sync' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.2.2 Ensure 'Do not allow passwords to be saved' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.1 Ensure 'Always prompt for password upon connection' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 18.10.57.3.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.83.2 Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.90.2.1 Ensure 'Allow Basic authentication' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.2 Ensure 'Allow remote server management through WinRM' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.94.1.1 Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.2.1 Ensure 'Configure Automatic Updates' is set to 'Enabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.4.1 Ensure 'Manage preview builds' is set to 'Disabled' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.94.4.2 Ensure 'Select when Quality Updates are received' is set to 'Enabled: 0 days' | CIS Microsoft Windows Server 2022 v5.1.0 L1 MS | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 19.7.8.3 Ensure 'Do not use diagnostic data for tailored experiences' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L2 MS | Windows | CONFIGURATION MANAGEMENT |
