| 2.2.13 Ensure 'Create symbolic links' is set to 'Administrators' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.19 Ensure 'Deny log on through Remote Desktop Services' to include 'Guests' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.23 Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.25 Ensure 'Load and unload device drivers' is set to 'Administrators' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.26 Ensure 'Lock pages in memory' is set to 'No One' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.3.8.2 Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.9.4 Ensure 'Microsoft network server: Server SPN target name validation level' is set to 'Accept if provided by client' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 2.3.10.4 Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.10.5 Ensure 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 2.3.10.7 Ensure 'Network access: Remotely accessible registry paths' is configured | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 2.3.11.8 Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.3.17.1 Ensure 'User Account Control: Admin Approval Mode for the Built-in Administrator account' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.3.17.6 Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 5.7 Ensure 'Infrared monitor service (irmon)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.32 Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 5.45 Ensure 'Xbox Live Networking Service (XboxNetApiSvc)' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 9.3.7 Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 17.6.1 Ensure 'Audit Detailed File Share' is set to include 'Failure' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.5 Ensure 'Audit System Integrity' is set to 'Success and Failure' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.4.5 Ensure 'LSA Protection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.5.1 Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.5.7 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.5.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.7.4 Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.3 Ensure 'Turn off handwriting personalization data sharing' is set to 'Enabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.20.1.3 Ensure 'Turn off handwriting personalization data sharing' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.9.37.2 Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.3.1 Ensure 'Turn off API Sampling' is set to 'Enabled' | CIS Microsoft Windows 11 Stand-alone v5.0.0 L2 BL | Windows | CONFIGURATION MANAGEMENT |
| 18.10.8.1 Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | MEDIA PROTECTION |
| 18.10.10.1.2 Ensure 'Choose how BitLocker-protected fixed drives can be recovered' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.1.7 Ensure 'Configure use of hardware-based encryption for fixed data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 18.10.10.1.8 Ensure 'Configure use of passwords for fixed data drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.10.2.8 Ensure 'Configure use of hardware-based encryption for operating system drives' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 18.10.10.3.5 Ensure 'Choose how BitLocker-protected removable drives can be recovered: Recovery Key' is set to 'Enabled: Do not allow 256-bit recovery key' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | MEDIA PROTECTION |
| 18.10.10.3.9 Ensure 'Configure use of smart cards on removable data drives' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.10.3.12 Ensure 'Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization' is set to 'Enabled: False' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | MEDIA PROTECTION |
| 18.10.15.2 Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
| 18.10.18.2 Ensure 'Enable App Installer Experimental Features' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.6 Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.26.1.2 Ensure 'Application: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.4.1 Ensure 'System: Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.26.4.2 Ensure 'System: Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.29.4 Ensure 'Turn off heap termination on corruption' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.29.5 Ensure 'Turn off shell protocol protected mode' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.1 Ensure 'Always prompt for password upon connection' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.1.2 Ensure 'Allow unencrypted traffic' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.94.1.1 Ensure 'No auto-restart with logged on users for scheduled automatic updates installations' is set to 'Disabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 19.7.26.1 Ensure 'Prevent users from sharing files within their profile.' is set to 'Enabled' | CIS Microsoft Windows 10 Stand-alone v5.0.0 L1 BL NG | Windows | ACCESS CONTROL |
