| 1.1.1 Ensure 'Enforce password history' is set to '24 or more password(s)' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.5 Ensure 'Password must meet complexity requirements' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.2.2 Ensure 'Account lockout threshold' is set to '5 or fewer invalid logon attempt(s), but not 0' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 1.2.4 Ensure 'Reset account lockout counter after' is set to '15 or more minute(s)' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 2.2.1 Ensure 'Access Credential Manager as a trusted caller' is set to 'No One' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.11 Ensure 'Back up files and directories' is set to 'Administrators' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.12 Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.15 Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.24 Ensure 'Deny log on locally' to include 'Guests' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 2.2.35 Ensure 'Lock pages in memory' is set to 'No One' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 9.2.5 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.2.7 Ensure 'Windows Firewall: Private: Logging: Log successful connections' is set to 'Yes' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 9.3.7 Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater' | CIS Microsoft Windows Server 2019 v5.0.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 17.2.6 Ensure 'Audit User Account Management' is set to 'Success and Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.1 Ensure 'Audit Account Lockout' is set to include 'Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.4 Ensure 'Audit Logon' is set to 'Success and Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.3 Ensure 'Audit Other Object Access Events' is set to 'Success and Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.2 Ensure 'Audit Authentication Policy Change' is set to include 'Success' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.4 Ensure 'Audit MPSSVC Rule-Level Policy Change' is set to 'Success and Failure' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.5.6 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.5.11 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.7.2 Ensure 'Audit client does not support signing' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.7.4 Ensure 'Enable authentication rate limiter' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.6.7.5 Ensure 'Enable remote mailslots' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.6.8.3 Ensure 'Audit server does not support signing' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.6.11.4 Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.6.14.1 Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication', 'Require Integrity', and 'Require Privacy' set for all NETLOGON and SYSVOL shares' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.7.4 Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.7.10 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.13.1 Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 18.9.19.4 Ensure 'Continue experiences on this device' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.24.1 Ensure 'Enumeration policy for external devices incompatible with Kernel DMA Protection' is set to 'Enabled: Block All' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.9.53.1.1 Ensure 'Enable Windows NTP Client' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | AUDIT AND ACCOUNTABILITY |
| 18.10.6.1 Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.8.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | MEDIA PROTECTION |
| 18.10.9.1.1 Ensure 'Configure enhanced anti-spoofing' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.2 Ensure 'Enable App Installer Experimental Features' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.3 Ensure 'Enable App Installer Hash Override' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.5 Ensure 'Enable App Installer Microsoft Store Source Certificate Validation Bypass' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.41.1 Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL |
| 18.10.57.3.3.3 Ensure 'Do not allow drive redirection' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.11.1 Ensure 'Do not delete temp folders upon exit' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.81.2 Ensure 'Allow Windows Ink Workspace' is set to 'Enabled: On, but disallow access above lock' OR 'Enabled: Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 18.10.94.2.2 Ensure 'Configure Automatic Updates: Scheduled install day' is set to '0 - Every day' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 18.10.94.4.1 Ensure 'Manage preview builds' is set to 'Disabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
| 19.7.5.2 Ensure 'Notify antivirus programs when opening attachments' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 19.7.8.2 Ensure 'Do not suggest third-party content in Windows spotlight' is set to 'Enabled' | CIS Microsoft Windows Server 2025 v2.1.0 L1 MS | Windows | CONFIGURATION MANAGEMENT |
