| 1.1.3 Ensure 'Minimum password age' is set to '1 or more day(s)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | IDENTIFICATION AND AUTHENTICATION |
| 1.1.4 Ensure 'Minimum password length' is set to '14 or more character(s)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | IDENTIFICATION AND AUTHENTICATION |
| 2.2.17 Ensure 'Deny log on as a batch job' to include 'Guests' | CIS Microsoft Windows 8.1 v2.4.1 L1 | Windows | ACCESS CONTROL |
| 17.2.1 Ensure 'Audit Application Group Management' is set to 'Success and Failure' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.2.4 Ensure 'Audit Other Account Management Events' is set to include 'Success' (DC only) | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.3.1 Ensure 'Audit PNP Activity' is set to include 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.3.2 Ensure 'Audit Process Creation' is set to include 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.5.6 Ensure 'Audit Special Logon' is set to include 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.1 Ensure 'Audit Detailed File Share' is set to include 'Failure' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.2 Ensure 'Audit File Share' is set to 'Success and Failure' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.6.4 Ensure 'Audit Removable Storage' is set to 'Success and Failure' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.7.2 Ensure 'Audit Authentication Policy Change' is set to include 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.8.1 Ensure 'Audit Sensitive Privilege Use' is set to 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 17.9.4 Ensure 'Audit Security System Extension' is set to include 'Success' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | AUDIT AND ACCOUNTABILITY |
| 18.4.2 Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.6.1 Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL |
| 18.10.8.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | MEDIA PROTECTION |
| 18.10.15.1 Ensure 'Do not display the password reveal button' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | IDENTIFICATION AND AUTHENTICATION |
| 18.10.16.1 Ensure 'Allow Diagnostic Data' is set to 'Enabled: Diagnostic data off (not recommended)' or 'Enabled: Send required diagnostic data' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.16.3 Ensure 'Do not show feedback notifications' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.18.6 Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.57.3.9.3 Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.57.3.10.1 Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL |
| 18.10.59.3 Ensure 'Allow indexing of encrypted files' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | CONFIGURATION MANAGEMENT |
| 18.10.82.1 Ensure 'Allow user control over installs' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL |
| 18.10.90.2.1 Ensure 'Allow Basic authentication' is set to 'Disabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 18.10.90.2.4 Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled' | CIS Microsoft Windows Server 2019 v5.0.0 L1 DC | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Internet Explorer Processes - FEATURE_MIME_SNIFFING - iexplore.exe | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Internet Explorer Processes - FEATURE_ZONE_ELEVATION - explorer.exe | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Intranet Sites: Include all network paths (UNCs) | MSCT Windows Server v20H2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Java permissions - Locked-Down Local Machine Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Launching applications and files in an IFRAME - Restricted Sites Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Manage auditing and security log | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| Microsoft network server: Digitally sign communications (always) | MSCT Windows Server v20H2 DC v1.0.0 | Windows | IDENTIFICATION AND AUTHENTICATION |
| Network access: Allow anonymous SID/Name translation | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| Network access: Do not allow anonymous enumeration of SAM accounts | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| Network security: Allow LocalSystem NULL session fallback | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| Prevent ignoring certificate errors | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Reset account lockout counter after | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| Scan all downloaded files and attachments | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Send file samples when further analysis is required | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Turn on Cross-Site Scripting Filter - Restricted Sites Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| Turn on Enhanced Protected Mode | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Turn on SmartScreen Filter scan - Locked-Down Restricted Sites Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| Turn On Virtualization Based Security - HypervisorEnforcedCodeIntegrity | MSCT Windows Server v20H2 DC v1.0.0 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| Use Pop-up Blocker - Restricted Sites Zone | MSCT Windows Server v20H2 DC v1.0.0 | Windows | CONFIGURATION MANAGEMENT |
| User Account Control: Admin Approval Mode for the Built-in Administrator account | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| User Account Control: Detect application installations and prompt for elevation | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| User Account Control: Only elevate UIAccess applications that are installed in secure locations | MSCT Windows Server v20H2 DC v1.0.0 | Windows | ACCESS CONTROL |
| WN25-DC-000420 - The Windows Server 2025 'Enable computer and user accounts to be trusted for delegation' user right must only be assigned to the Administrators group on domain controllers. | DISA Microsoft Windows Server 2025 STIG v1r4 | Windows | ACCESS CONTROL |
