| 2.2.23 Ensure 'Deny log on as a service' to include 'Guests' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.42 Ensure 'Perform volume maintenance tasks' is set to 'Administrators' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.43 Ensure 'Profile single process' is set to 'Administrators' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.45 Ensure 'Replace a process level token' is set to 'LOCAL SERVICE, NETWORK SERVICE' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.46 Ensure 'Restore files and directories' is set to 'Administrators' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.1.4 Configure 'Accounts: Rename guest account' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.4.1 Ensure 'Devices: Prevent users from installing printer drivers' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.6.3 Ensure 'Domain member: Digitally sign secure channel data (when possible)' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.6.4 Ensure 'Domain member: Disable machine account password changes' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.6.6 Ensure 'Domain member: Require strong (Windows 2000 or later) session key' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.10.1 Ensure 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION |
| 2.3.10.5 Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.11.1 Ensure 'Network security: Allow Local System to use computer identity for NTLM' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.11.6 Ensure 'Network security: Force logoff when logon hours expire' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.11.8 Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.11.9 Ensure 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' is set to 'Require NTLMv2 session security, Require 128-bit encryption' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.15.2 Ensure 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.17.1 Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.17.3 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 2.3.17.4 Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 18.5.1 Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.5.4 Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.5.8 Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.6.4.1 Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.1 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.21.1 Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.7.1 Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.7.6 Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.19.2 Ensure 'Configure security policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.9.26.4 Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' or higher | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.6 Ensure 'Password Settings: Password Age (Days)' is set to 'Enabled: 30 or fewer' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.7 Ensure 'Post-authentication actions: Grace period (hours)' is set to 'Enabled: 8 or fewer hours, but not 0' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.26.8 Ensure 'Post-authentication actions: Actions' is set to 'Enabled: Reset the password and logoff the managed account' or higher | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.9.29.1 Ensure 'Block user from showing account details on sign-in' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 18.9.29.2 Ensure 'Do not display network selection UI' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 18.9.29.6 Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.3 Ensure 'Enable App Installer Hash Override' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.4 Ensure 'Enable App Installer Local Archive Malware Scan Override' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.26.1.2 Ensure 'Application: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.2.2 Ensure 'Security: Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.29.2 Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.29.3 Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.10.29.5 Ensure 'Turn off shell protocol protected mode' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.41.1 Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.57.3.3.2 Ensure 'Do not allow drive redirection' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.4 Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.94.4.1 Ensure 'Manage preview builds' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 19.7.8.2 Ensure 'Do not suggest third-party content in Windows spotlight' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
