| 9.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On' | CIS Microsoft Azure Foundations v4.0.0 L2 | microsoft_azure | RISK ASSESSMENT |
| Accounts: Limit local account use of blank passwords to console logon only | MSCT Windows 10 v2004 v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| Allow Basic authentication - Service - AllowBasic | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Allow binary and script behaviors | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow drag and drop or copy and paste files - Internet Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow log on locally | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Allow only approved domains to use ActiveX controls without prompt - Restricted Sites Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Allow only approved domains to use the TDC ActiveX control - Restricted Sites Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow script-initiated windows without size or position constraints - Internet Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow scriptlets - Restricted Sites Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow updates to status bar via script - Internet Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Allow VBScript to run in Internet Explorer - Internet Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Allow VBScript to run in Internet Explorer - Restricted Sites Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Apply UAC restrictions to local accounts on network logons | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Audit Audit Policy Change | MSCT Windows 10 v2004 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Logon | MSCT Windows 10 v2004 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Audit Security System Extension | MSCT Windows 10 v2004 v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Configure Attack Surface Reduction rules - 5beb7efe-fd9a-4556-801d-275e5ffc04cc | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Configure Attack Surface Reduction rules - 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Configure Solicited Remote Assistance - fAllowFullControl | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Configure Solicited Remote Assistance - fUseMailto | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Create a pagefile | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Create permanent shared objects | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Deny access to this computer from the network | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Disallow WinRM from storing RunAs credentials | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Don't run antimalware programs against ActiveX controls - Local Machine Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Download signed ActiveX controls - Internet Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Download signed ActiveX controls - Restricted Sites Zone | MSCT Windows 10 v2004 v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Enable Structured Exception Handling Overwrite Protection (SEHOP) | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Enforce password history | MSCT Windows 10 v2004 v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| Enumeration policy for external devices incompatible with Kernel DMA Protection | MSCT Windows 10 v2004 v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Force shutdown from a remote system | MSCT Windows 10 v2004 v1.0.0 | Windows | ACCESS CONTROL |
| Prevent per-user installation of ActiveX controls | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Reset account lockout counter after | MSCT Windows Server 2025 MS v1.0.0 | Windows | ACCESS CONTROL |
| Run .NET Framework-reliant components signed with Authenticode - Internet Zone | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Run ActiveX controls and plugins | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Scan removable drives | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Security Zones: Do not allow users to change policies | MSCT Windows Server 2025 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Set client connection encryption level - MinEncryptionLevel | MSCT Windows Server 2025 MS v1.0.0 | Windows | ACCESS CONTROL |
| Specify the maximum log file size (KB) - Application | MSCT Windows Server 2025 MS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Specify the maximum log file size (KB) - System | MSCT Windows Server 2025 MS v1.0.0 | Windows | AUDIT AND ACCOUNTABILITY |
| Take ownership of files or other objects | MSCT Windows Server 2025 MS v1.0.0 | Windows | ACCESS CONTROL |
| Turn off real-time protection | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Turn on SmartScreen Filter scan - Locked-Down Restricted Sites Zone | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Turn On Virtualization Based Security - EnableVirtualizationBasedSecurity | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Use Pop-up Blocker - Restricted Sites Zone | MSCT Windows Server 2025 MS v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| User Account Control: Behavior of the elevation prompt for standard users - ConsentPromptBehaviorUser | MSCT Windows Server 2025 MS v1.0.0 | Windows | ACCESS CONTROL |
| Userdata persistence - Restricted Sites Zone | MSCT Windows Server 2025 MS v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
