{"id":15454772,"url":"https://github.com/noma4i/puppet-windows_cis","last_synced_at":"2025-04-21T12:01:45.844Z","repository":{"id":25842876,"uuid":"29282413","full_name":"noma4i/puppet-windows_cis","owner":"noma4i","description":"Puppet module to apply CIS rules. *for Standalone Mode*","archived":false,"fork":false,"pushed_at":"2019-07-03T13:55:17.000Z","size":215,"stargazers_count":10,"open_issues_count":0,"forks_count":10,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-20T00:55:16.676Z","etag":null,"topics":["cis-rules","puppet","windows-cis"],"latest_commit_sha":null,"homepage":null,"language":"Puppet","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/noma4i.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-01-15T05:30:36.000Z","updated_at":"2024-07-21T00:22:34.000Z","dependencies_parsed_at":"2022-08-24T14:14:52.866Z","dependency_job_id":null,"html_url":"https://github.com/noma4i/puppet-windows_cis","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/noma4i%2Fpuppet-windows_cis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/noma4i%2Fpuppet-windows_cis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/noma4i%2Fpuppet-windows_cis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/noma4i%2Fpuppet-windows_cis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/noma4i","download_url":"https://codeload.github.com/noma4i/puppet-windows_cis/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249834786,"owners_count":21331988,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cis-rules","puppet","windows-cis"],"created_at":"2024-10-01T22:05:37.684Z","updated_at":"2025-04-20T00:55:21.808Z","avatar_url":"https://github.com/noma4i.png","language":"Puppet","funding_links":[],"categories":[],"sub_categories":[],"readme":"# windows_cis\n\n## Overview\n\nPuppet module which is able *TRULY* apply CIS rules. It can apply security templates and registry-based policy.\n\nHardening is made using CIS Benchmark for ALL Scored rules against **_Standalone Windows Server_**\n\n## Usage\n```puppet\n    class { 'windows_cis::rules':\n      ensure =\u003e 'present',\n      list =\u003e 'all',\n    }\n```\n\nThis will apply basic *scored* CIS rules for Standalone Server Instance.\nSome additional rules also are defined in rules_list.txt\n\n\n## Rules list\n--\n\nBased on **CIS Microsoft Windows Server 2012 Benchmark**\n\n###### CCE-23909-5\nSet 'Account lockout threshold' to '5 invalid logon attempt(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout threshold\n\n###### CCE-24768-4\nSet 'Account lockout duration' to '15 or more minute(s)' (Scored)\n\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Account lockout duration\n\n###### CCE-24840-1\nSet 'Reset account lockout counter after' to '15 minute(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy\\Reset account lockout counter after\n\n###### CCE-25317-9\nSet 'Minimum password length' to '14 or more character(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Minimum password length\n\n###### CCE-24644-7\nSet 'Enforce password history' to '24 or more password(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password\nPolicy\\Enforce password history\n\n###### CCE-25602-4\nSet 'Password must meet complexity requirements' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password\nPolicy\\Password must meet complexity requirements\n\n###### CCE-23951-7\n Set 'Store passwords using reversible encryption' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password\nPolicy\\Store passwords using reversible encryption\n\n###### CCE-24018-4\nSet 'Minimum password age' to '1 or more day(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password\nPolicy\\Minimum password age\n\n###### CCE-24535-7\net 'Maximum password age' to '60 or fewer days' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password\nPolicy\\Maximum password age\n\n###### CCE-25088-6\nSet 'Audit Policy: Account Logon: Credential Validation' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Logon\\Audit Policy: Account Logon: Credential\nValidation\n\n###### CCE-24553-0\nSet 'Audit Policy: Account Logon: Kerberos Authentication Service' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Logon\\Audit Policy: Account Logon: Kerberos\nAuthentication Service\n\n###### CCE-25549-7\nSet 'Audit Policy: Account Logon: Kerberos Service Ticket Operations' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Logon\\Audit Policy: Account Logon: Kerberos\nService Ticket Operations\n\n###### CCE-24509-2\nSet 'Audit Policy: Account Logon: Other Account Logon Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Logon\\Audit Policy: Account Logon: Other Account\nLogon Events\n\n###### CCE-24868-2\nSet 'Audit Policy: Account Management: Application Group Management' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management:\nApplication Group Management\n\n###### CCE-23482-3\nConfigure 'Audit Policy: Account Management: Computer Account Management' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management:\nComputer Account Management\n\n###### CCE-25739-4\nSet 'Audit Policy: Account Management: Distribution Group Management' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management:\nDistribution Group Management\n\n###### CCE-24588-6\nSet 'Audit Policy: Account Management: Other Account Management Events' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management:\nOther Account Management Events\n\n###### CCE-23955-8\nSet 'Audit Policy: Account Management: Security Group Management' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management:\nSecurity Group Management\n\n###### CCE-25123-1\nSet 'Audit Policy: Account Management: User Account Management' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Account Management\\Audit Policy: Account Management: User\nAccount Management\n\n###### CCE-25011-8\nSet 'Audit Policy: Detailed Tracking: DPAPI Activity' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Detailed Tracking\\Audit Policy: Detailed Tracking: DPAPI\nActivity\n\n###### CCE-25461-5\nSet 'Audit Policy: Detailed Tracking: Process Creation' to 'Success' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Detailed Tracking\\Audit Policy: Detailed Tracking:\nProcess Creation\n\n###### CCE-25490-4\nSet 'Audit Policy: Detailed Tracking: Process Termination' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Detailed Tracking\\Audit Policy: Detailed Tracking:\nProcess Termination\n\n###### CCE-23502-8\nSet 'Audit Policy: Detailed Tracking: RPC Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Detailed Tracking\\Audit Policy: Detailed Tracking: RPC\nEvents\n\n\n###### CCE-23619-0[DOMAIN CONTROLLER]\nSet 'Audit Policy: DS Access: Detailed Directory Service Replication' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\DS Access\\Audit Policy: DS Access: Detailed Directory\nService Replication\n\n\n###### CCE-23953-3[DOMAIN CONTROLLER]\nSet 'Audit Policy: DS Access: Directory Service Access' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\DS Access\\Audit Policy: DS Access: Directory Service\nAccess\n\n\n###### CCE-24645-4[DOMAIN CONTROLLER]\nSet 'Audit Policy: DS Access: Directory Service Changes' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\DS Access\\Audit Policy: DS Access: Directory Service\nChanges\n\n\n###### CCE-24355-0[DOMAIN CONTROLLER]\nSet 'Audit Policy: DS Access: Directory Service Replication' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\DS Access\\Audit Policy: DS Access: Directory Service\nReplication\n\n###### CCE-24598-5\nSet 'Audit Policy: Logon-Logoff: Account Lockout' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Account Lockout\n\n###### CCE-24404-6\nSet 'Audit Policy: Logon-Logoff: IPsec Extended Mode' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: IPsec Extended\nMode\n\n###### CCE-24584-5\nSet 'Audit Policy: Logon-Logoff: IPsec Main Mode' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: IPsec Main Mode\n\n###### CCE-23614-1\nSet 'Audit Policy: Logon-Logoff: IPsec Quick Mode' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: IPsec Quick Mode\n\n###### CCE-24901-1\nSet 'Audit Policy: Logon-Logoff: Logoff' to 'Success' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Logoff\n\n###### CCE-23670-3\nSet 'Audit Policy: Logon-Logoff: Logon' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Logon\n\n###### CCE-25189-2\nSet 'Audit Policy: Logon-Logoff: Network Policy Server' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Network Policy\nServer\n\n###### CCE-24494-7\nSet 'Audit Policy: Logon-Logoff: Other Logon/Logoff Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Other\nLogon/Logoff Events\n\n###### CCE-24187-7\nSet 'Audit Policy: Logon-Logoff: Special Logon' to 'Success' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Logon/Logoff\\Audit Policy: Logon-Logoff: Special Logon\n\n###### CCE-25316-1\nSet 'Audit Policy: Object Access: Application Generated' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Application\nGenerated\n\n###### CCE-24643-9\nSet 'Audit Policy: Object Access: Central Access Policy Staging' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Central Access\nPolicy Staging\n\n###### CCE-23129-0\nSet 'Audit Policy: Object Access: Certification Services' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Certification\nServices\n\n###### CCE-24791-6\nSet 'Audit Policy: Object Access: Detailed File Share' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Detailed File\nShare\n\n###### CCE-24035-8\nSet 'Audit Policy: Object Access: File Share' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: File Share\n\n###### CCE-24456-6\nSet 'Audit Policy: Object Access: File System' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: File System\n\n###### CCE-24714-8\nSet 'Audit Policy: Object Access: Filtering Platform Connection' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Filtering\nPlatform Connection\n\n###### CCE-24824-5\nSet 'Audit Policy: Object Access: Filtering Platform Packet Drop' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Filtering\nPlatform Packet Drop\n\n###### CCE-24599-3\nSet 'Audit Policy: Object Access: Handle Manipulation' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Handle\nManipulation\n\n###### CCE-23655-4\nSet 'Audit Policy: Object Access: Kernel Object' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Kernel Object\n\n###### CCE-24236-2\nSet 'Audit Policy: Object Access: Other Object Access Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Other Object\nAccess Events\n\n###### CCE-23630-7\nSet 'Audit Policy: Object Access: Registry' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Registry\n\n###### CCE-22826-2\nSet 'Audit Policy: Object Access: Removable Storage' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: Removable\nStorage\n\n###### CCE-24439-2\nSet 'Audit Policy: Object Access: SAM' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Object Access\\Audit Policy: Object Access: SAM\n\n###### CCE-25035-7\nSet 'Audit Policy: Policy Change: Audit Policy Change' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: Audit Policy\nChange\n\n###### CCE-25674-3\nSet 'Audit Policy: Policy Change: Authentication Policy Change' to 'Success' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: Authentication\nPolicy Change\n\n###### CCE-24421-0\nSet 'Audit Policy: Policy Change: Authorization Policy Change' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: Authorization\nPolicy Change\n\n###### CCE-24965-6\nSet 'Audit Policy: Policy Change: Filtering Platform Policy Change' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: Filtering\nPlatform Policy Change\n\n###### CCE-24259-4\nSet 'Audit Policy: Policy Change: MPSSVC Rule-Level Policy Change' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: MPSSVC Rule-\nLevel Policy Change\n\n###### CCE-25169-4\nSet 'Audit Policy: Policy Change: Other Policy Change Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Policy Change\\Audit Policy: Policy Change: Other Policy\nChange Events\n\n###### CCE-23876-6\nSet 'Audit Policy: Privilege Use: Non Sensitive Privilege Use' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Privilege Use\\Audit Policy: Privilege Use: Non Sensitive\nPrivilege Use\n\n###### CCE-23920-2\nSet 'Audit Policy: Privilege Use: Other Privilege Use Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Privilege Use\\Audit Policy: Privilege Use: Other\nPrivilege Use Events\n\n###### CCE-24691-8\nSet 'Audit Policy: Privilege Use: Sensitive Privilege Use' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\Privilege Use\\Audit Policy: Privilege Use: Sensitive\nPrivilege Use\n\n###### CCE-25372-4\nSet 'Audit Policy: System: IPsec Driver' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\System\\Audit Policy: System: IPsec Driver\n\n###### CCE-25187-6\nSet 'Audit Policy: System: Other System Events' to 'No Auditing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\System\\Audit Policy: System: Other System Events\n\n###### CCE-25178-5\nSet 'Audit Policy: System: Security State Change' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\System\\Audit Policy: System: Security State Change\n\n###### CCE-25527-3\nSet 'Audit Policy: System: Security System Extension' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\System\\Audit Policy: System: Security System Extension\n\n###### CCE-25093-6\nSet 'Audit Policy: System: System Integrity' to 'Success and Failure' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy\nConfiguration\\Audit Policies\\System\\Audit Policy: System: System Integrity\n\n###### CCE-23836-0\nConfigure 'Accounts: Rename administrator account' (Scored)\n\n    Default Value: Administrator\n\n###### CCE-23675-2\nConfigure 'Accounts: Rename guest account' (Scored)\n\n    Default Value: Guest\n\n###### CCE-25589-3\nSet 'Accounts: Limit local account use of blank passwords to console logon only' to 'Enabled' (Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LimitBlankPasswordUse\n\n###### CCE-24075-4\nConfigure 'Audit: Audit the access of global system objects' (Not Scored)\n\n    Default Value: Disabled\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\AuditBaseObjects\n\n###### CCE-24923-5\nConfigure 'Audit: Audit the use of Backup and Restore privilege' (Not Scored)\n\n    Default Value: Disabled\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\fullprivilegeauditing\n\n###### CCE-24252-9\nSet 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Audit: Force audit policy subcategory settings (Windows Vista or later) to\noverride audit policy category settings\n\n###### CCE-23988-9\nSet 'Audit: Shut down system immediately if unable to log security audits' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Audit: Shut down system immediately if unable to log security audits\n\n###### CCE-24640-5\nConfigure 'DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\policies\\Microsoft\\windows NT\\DCOM\\MachineAccessRestriction\n\n###### CCE-25572-9\nConfigure 'DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\policies\\Microsoft\\windows NT\\DCOM\\MachineLaunchRestriction\n\n###### CCE-25248-6\nConfigure 'Devices: Allow undock without having to log on' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\undockwithoutlogon\n\n###### CCE-24607-4\nConfigure 'Devices: Restrict CD-ROM access to locally logged- on user only' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllocateCDRoms\n\n###### CCE-23668-7\nConfigure 'Devices: Restrict floppy access to locally logged-on user only' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllocateFloppies\n\n###### CCE-25217-1\nSet 'Devices: Allowed to format and eject removable media' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Devices: Allowed to format and eject removable media\n\n###### CCE-25176-9\nSet 'Devices: Prevent users from installing printer drivers' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Devices: Prevent users from installing printer drivers\n\n\n###### CCE-25305-4[DOMAIN CONTROLLER]\nSet 'Domain controller: Allow server operators to schedule tasks' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: Allow server operators to schedule tasks\n\n\n###### CCE-23587-9[DOMAIN CONTROLLER]\nSet 'Domain controller: LDAP server signing requirements' to 'Require signing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: LDAP server signing requirements\n\n\n###### CCE-24692-6[DOMAIN CONTROLLER]\nSet 'Domain controller: Refuse machine account password changes' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain controller: Refuse machine account password changes\n\n\n###### CCE-24465-7[DOMAIN CONTROLLER]\nSet 'Domain member: Digitally encrypt or sign secure channel data (always)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Domain member: Digitally encrypt or sign secure channel data (always)\n\n\n###### CCE-24414-5[DOMAIN CONTROLLER]\nSet 'Domain member: Digitally encrypt secure channel data (when possible)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Domain member: Digitally encrypt secure channel data (when possible)\n\n\n###### CCE-24812-0[DOMAIN CONTROLLER]\nSet 'Domain member: Digitally sign secure channel data (when possible)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain member: Digitally sign secure channel data (when possible)\n\n\n###### CCE-24243-8[DOMAIN CONTROLLER]\nSet 'Domain member: Disable machine account password changes' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Domain member: Disable machine account password changes\n\n\n###### CCE-23596-0[DOMAIN CONTROLLER]\nSet 'Domain member: Maximum machine account password age' to '30 or fewer day(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain member: Maximum machine account password age\n\n\n###### CCE-25198-3[DOMAIN CONTROLLER]\nSet 'Domain member: Require strong (Windows 2000 or later) session key' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Domain member: Require strong (Windows 2000 or later) session key\n\n###### CCE-25018-3\nConfigure 'Interactive logon: Display user information when the session is locked' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DontDispl\nayLockedUserId\n\n###### CCE-25355-9\nConfigure 'Interactive logon: Message text for users attempting to log on' (Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoti\nceText\n\n###### CCE-24020-0\nConfigure 'Interactive logon: Message title for users attempting to log on' (Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LegalNoti\nceCaption\n\n###### CCE-24408-7\nConfigure 'Interactive logon: Require smart card' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\scforceop\ntion\n\n###### CCE-24748-6\nSet 'Interactive logon: Do not display last user name' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Do not display last user name\n\n###### CCE-25803-8\nSet 'Interactive logon: Do not require CTRL+ALT+DEL' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Do not require CTRL+ALT+DEL\n\n###### CCE-23043-3\nSet 'Interactive logon: Machine inactivity limit' to '900 or fewer seconds' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Machine inactivity limit\n\n\n###### CCE-24264-4[DOMAIN CONTROLLER]\nSet 'Interactive logon: Number of previous logons to cache (in case domain controller is not available)' to '4 or fewer logon(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Number of previous logons to cache (in case domain\ncontroller is not available)\n\n###### CCE-23704-0\nSet 'Interactive logon: Prompt user to change password before expiration' to '14 or more day(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Prompt user to change password before expiration\n\n\n###### CCE-25643-8[DOMAIN CONTROLLER]\nSet 'Interactive logon: Require Domain Controller authentication to unlock workstation' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Require Domain Controller authentication to unlock\nworkstation\n\n###### CCE-24154-7\nSet 'Interactive logon: Smart card removal behavior' to 'Lock Workstation' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Smart card removal behavior\n\n###### CCE-22731-4\nSet 'Interactive logon: Machine account lockout threshold' to 10 or fewer invalid logon attempts (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Interactive logon: Machine account lockout threshold\n\n\n###### CCE-24969-8[SIDE EFFECT]\nSet 'Microsoft network client: Digitally sign communications (always)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network client: Digitally sign communications (always)\n\n###### CCE-24740-3\nSet 'Microsoft network client: Digitally sign communications (if server agrees)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network client: Digitally sign communications (if server agrees)\n\n###### CCE-24751-0\nSet 'Microsoft network client: Send unencrypted password to third-party SMB servers' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network client: Send unencrypted password to third-party SMB servers\n\n###### CCE-24502-7\nConfigure 'Microsoft network server: Server SPN target name validation level' (Not Scored)'\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\SMBServer\nNameHardeningLevel\n\n###### CCE-23897-2\nSet 'Microsoft network server: Amount of idle time required before suspending session' to '15 or fewer minute(s)' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network server: Amount of idle time required before suspending\nsession\n\n###### CCE-23716-4\nSet 'Microsoft network server: Digitally sign communications (always)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network server: Digitally sign communications (always)\n\n###### CCE-24354-3\nSet 'Microsoft network server: Digitally sign communications (if client agrees)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network server: Digitally sign communications (if client agrees)\n\n###### CCE-24148-9\nSet 'Microsoft network server: Disconnect clients when logon hours expire' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Microsoft network server: Disconnect clients when logon hours expire\n\n###### CCE-24205-7\nConfigure 'MSS: (AutoReboot) Allow Windows to automatically restart after a system crash (recommended except for highly secure environments)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl\\AutoReboot\n\n###### CCE-24217-2\nConfigure 'MSS: (AutoShareServer) Enable Administrative Shares (recommended except for highly secure environments)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\AutoShare\nServer\n\n\n###### CCE-24977-1[SIDE EFFECT]\nConfigure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\EnableICMPRedirect\n\n###### CCE-24074-7\nConfigure 'MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Lanmanserver\\Parameters\\Hidden\n\n###### CCE-24310-5\nConfigure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\KeepAliveTime\n\n###### CCE-24253-7\nConfigure 'MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic.' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\IPSEC\\NoDefaultExempt\n\n###### CCE-23715-6\nConfigure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Netbt\\Parameters\\NoNameReleaseOnD\nemand\n\n###### CCE-23677-8\nConfigure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\PerformRouterDis\ncovery\n\n###### CCE-25202-3\nConfigure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\TcpMaxDataRetra\nnsmissions\n\n###### CCE-25455-7\nConfigure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\TcpMaxDataRetran\nsmissions\n\n###### CCE-24927-6\nSet 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)\n\n###### CCE-24452-5\nSet 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' to 'Highest protection, source routing is completely disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (DisableIPSourceRouting IPv6) IP source routing protection level\n(protects against packet spoofing)\n\n###### CCE-24968-0\nSet 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' to 'Highest protection, source routing is completely disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (DisableIPSourceRouting) IP source routing protection level (protects\nagainst packet spoofing)\n\n###### CCE-23462-5\nSet 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)\n\n###### CCE-24993-8\nSet 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' to '0' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver\ngrace period expires (0 recommended)\n\n###### CCE-25110-8\nSet 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' to '0.9 or less' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\MSS: (WarningLevel) Percentage threshold for the security event log at which\nthe system will generate a warning\n\n###### CCE-23358-5\nConfigure 'Network access: Do not allow storage of passwords and credentials for network authentication' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\DisableDomainCreds\n\n###### CCE-25466-4\nConfigure 'Network access: Named Pipes that can be accessed anonymously' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessi\nonPipes\n\n###### CCE-25592-7\nConfigure 'Network access: Shares that can be accessed anonymously' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessi\nonShares\n\n###### CCE-24597-7\nSet 'Network access: Allow anonymous SID/Name translation' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Allow anonymous SID/Name translation\n\n###### CCE-24774-2\nSet 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Do not allow anonymous enumeration of SAM accounts and shares\n\n###### CCE-23082-1\nSet 'Network access: Do not allow anonymous enumeration of SAM accounts' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Do not allow anonymous enumeration of SAM accounts\n\n###### CCE-23807-1\nSet 'Network access: Let Everyone permissions apply to anonymous users' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Let Everyone permissions apply to anonymous users\n\n\n###### CCE-25426-8131. Set 'Network access: Remotely accessible registry paths and sub-paths' to 'System\\CurrentControlSet\\Control\\Print\\Printers System\\CurrentControlSet\\Services\\Eventlog icrosoft\\OLAP Server Software\\Microsoft\\Windows NT\\CurrentVersion\\Print Softwar (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network access: Remotely accessible registry paths and sub-paths\n\nSet to:\n\tSystem\\CurrentControlSet\\Control\\Print\\Printers\n\tSystem\\CurrentControlSet\\Services\\Eventlog Software\\Microsoft\\OLAP Server\n\tSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Print\n\tSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Windows\n\tSystem\\CurrentControlSet\\Control\\ContentIndex\n\tSystem\\CurrentControlSet\\Control\\Terminal Server\n\tSystem\\CurrentControlSet\\Control\\Terminal Server\\UserConfig\n\tSystem\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration\n\tSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Prefab\n\tSystem\\CurrentControlSet\\Services\\SysmonLog\n\n\n###### CCE-23899-8132. Set 'Network access: Remotely accessible registry paths' to 'System\\CurrentControlSet\\Control\\ProductOptions System\\CurrentControlSet\\Control\\Server Applications icrosoft\\Windows NT\\CurrentVersion' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network access: Remotely accessible registry paths\n\nSet to:\n\tSystem\\CurrentControlSet\\Control\\ProductOptions\n\tSystem\\CurrentControlSet\\Control\\Server Applications\n\tSoftware\\Microsoft\\Windows NT\\CurrentVersion\n\n###### CCE-24564-7\nSet 'Network access: Restrict anonymous access to Named Pipes and Shares' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Restrict anonymous access to Named Pipes and Shares\n\n###### CCE-22742-1\nSet 'Network access: Sharing and security model for local accounts' to 'Classic - local users authenticate as themselves' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Network access: Sharing and security model for local accounts\n\n###### CCE-25299-9\nConfigure 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\pku2u\\AllowOnlineID\n\n###### CCE-24147-1\nConfigure 'Network Security: Configure encryption types allowed for Kerberos' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\\nParameters\\SupportedEncryptionTypes\n\n###### CCE-25367-4\nConfigure 'Network security: Force logoff when logon hours expire' (Not Scored)\n\n    WHAT??!\n\n###### CCE-25046-4\nConfigure 'Network Security: Restrict NTLM: Add remote server exceptions for NTLM authentication' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\ClientAllowedNTLMServers\n\n###### CCE-23483-1\nConfigure 'Network Security: Restrict NTLM: Add server exceptions in this domain' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DCAllowedNTLM Servers\n\n###### CCE-23338-7\nConfigure 'Network Security: Restrict NTLM: Audit Incoming NTLM Traffic' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\AuditReceivingNTLMTraffic\n\n###### CCE-24238-8\nConfigure 'Network Security: Restrict NTLM: Audit NTLM authentication in this domain' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\AuditNTLMInDomain\n\n###### CCE-24393-1\nConfigure 'Network Security: Restrict NTLM: Incoming NTLM traffic' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictReceivingNTLMTraffic\n\n###### CCE-25645-3\nConfigure 'Network Security: Restrict NTLM: NTLM authentication in this domain' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\RestrictNTLMInDomain\n\n###### CCE-25095-1\nConfigure 'Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictSendingNTLMTraffic\n\n\n###### CCE-25508-3[DOMAIN CONTROLLER]\nSet 'Network security: Allow Local System to use computer identity for NTLM' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: Allow Local System to use computer identity for NTLM\n\n\n###### CCE-25531-5[DOMAIN CONTROLLER]\nSet 'Network security: Allow LocalSystem NULL session fallback' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: Allow LocalSystem NULL session fallback\n\n###### CCE-24150-5\nSet 'Network security: Do not store LAN Manager hash value on next password change' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: Do not store LAN Manager hash value on next password change\n\n###### CCE-24650-4\nSet 'Network security: LAN Manager authentication level' to 'Send NTLMv2 response only. Refuse LM \u0026 NTLM' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: LAN Manager authentication level\n\n###### CCE-25245-2\nSet 'Network security: LDAP client signing requirements' to 'Negotiate signing' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: LDAP client signing requirements\n\n\n###### CCE-24783-3[SIDE EFFECT]\nSet 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' to 'Require NTLMv2 session security,Require 128-bit encryption' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Network security: Minimum session security for NTLM SSP based (including secure RPC) client\n\n###### CCE-25264-3\nSet 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' to 'Require NTLMv2 session security,Require 128-bit encryption' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\n\n###### CCE-24470-7\nSet 'Recovery console: Allow automatic administrative logon' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\Recovery console: Allow automatic administrative logon\n\n###### CCE-25274-2\nSet 'Recovery console: Allow floppy copy and access to all drives and all folders' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\Recovery console: Allow floppy copy and access to all drives and all folders\n\n###### CCE-25100-9\nSet 'Shutdown: Allow system to be shut down without having to log on' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Shutdown: Allow system to be shut down without having to log on\n\n###### CCE-25120-7\nSet 'Shutdown: Clear virtual memory pagefile' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\Shutdown: Clear virtual memory pagefile\n\n###### CCE-23711-5\nConfigure 'System cryptography: Force strong key protection for user keys stored on the computer' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Cryptography\\ForceKeyProtection\n\n###### CCE-23921-0\nSet 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\System cryptography: Use FIPS compliant algorithms for encryption, hashing,\nand signing\n\n###### CCE-24870-8\nSet 'System objects: Require case insensitivity for non- Windows subsystems' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\SecurityOptions\\System objects: Require case insensitivity for non-Windows subsystems\n\n###### CCE-24633-0\nSet 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\System objects: Strengthen default permissions of internal system objects\n(e.g. Symbolic Links)\n\n###### CCE-24878-1\nConfigure 'System settings: Optional subsystems' (Not Scored)\n\n    HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\SubSystems\\optional\n\n###### CCE-24939-1\nSet 'System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security\nOptions\\System settings: Use Certificate Rules on Windows Executables for Software\nRestriction Policies\n\n###### CCE-24134-9\nSet 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Admin Approval Mode for the Built-in Administrator account\n\n###### CCE-23295-9\nSet 'User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop\n\n###### CCE-23877-4\nSet 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent for non-Windows binaries' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode\n\n###### CCE-24519-1\nSet 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prompt for credentials' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Behavior of the elevation prompt for standard users\n\n###### CCE-24498-8\nSet 'User Account Control: Detect application installations and prompt for elevation' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Detect application installations and prompt for\nelevation\n\n###### CCE-23880-8\nSet 'User Account Control: Only elevate executables that are signed and validated' to 'Disabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Only elevate executables that are signed and validated\n\n###### CCE-25471-4\nSet 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Only elevate UIAccess applications that are installed in\nsecure locations\n\n###### CCE-23653-9\nSet 'User Account Control: Run all administrators in Admin Approval Mode' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Run all administrators in Admin Approval Mode\n\n###### CCE-23656-2\nSet 'User Account Control: Switch to the secure desktop when prompting for elevation' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Switch to the secure desktop when prompting for elevation\n\n###### CCE-24231-3\nSet 'User Account Control: Virtualize file and registry write failures to per-user locations' to 'Enabled' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control: Virtualize file and registry write failures to per-user locations\n\n###### CCE-23273-6\nConfigure 'Deny log on through Remote Desktop Services' (Not Scored)\n\n    Optional\n\n###### CCE-25619-8\nConfigure 'Log on as a service' (Not Scored)\n\n    Optional\n\n###### CCE-25683-4\nSet 'Access Credential Manager as a trusted caller' to 'No One' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Access Credential Manager as a trusted caller\n\n###### CCE-24938-3\nConfigure 'Access this computer from the network' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Access this computer from the network\n\nThe recommended state for this setting is:\n\t- Administrators, Authenticated Users\n\n###### CCE-25043-1\nSet 'Act as part of the operating system' to 'No One' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Act as part of the operating system\n\n\n###### CCE-23271-0[DOMAIN CONTROLLER]\nSet 'Add workstations to domain' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Add workstations to domain\n\n###### CCE-25112-4\nSet 'Adjust memory quotas for a process' to 'Administrators, Local Service, Network Service' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Adjust memory quotas for a process\n\n###### CCE-25228-8\nSet 'Allow log on locally' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Allow log on locally\n\n###### CCE-24406-1\nSet 'Allow log on through Remote Desktop Services' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Allow log on through Remote Desktop Services\n\n###### CCE-25380-7\nSet 'Back up files and directories' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Back up files and directories\n\n###### CCE-25271-8\nConfigure 'Bypass traverse checking' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights\nAssignment\\Bypass traverse checking\n\nThe recommended state for this setting is:\n\t- Administrators, Authenticated Users, Backup Operators, Local Service, Network Service.\n\n###### CCE-24185-1\nSet 'Change the system time' to 'LOCAL SERVICE, Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Change the system time\n\nSet the following Group Policy setting to:\n\t- LOCAL SERVICE, Administrators.\n\n###### CCE-24632-2\nSet 'Change the time zone' to 'LOCAL SERVICE, Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Change the time zone\n\nSet the following Group Policy setting to:\n\t- LOCAL SERVICE, Administrators.\n\n###### CCE-23972-3\nSet 'Create a pagefile' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Create a pagefile\n\n###### CCE-23939-2\nSet 'Create a token object' to 'No One' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Create a token object\n\n###### CCE-23850-1\nSet 'Create global objects' to 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Create global objects\n\n###### CCE-23723-0\nSet 'Create permanent shared objects' to 'No One' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Create permanent shared objects\n\n###### CCE-24549-8\nSet 'Create symbolic links' to 'Administrators' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Create symbolic links\n\n\n###### CCE-23648-9[SIDE EFFECT]\nSet 'Debug programs' to 'Administrators' (Scored)\n\n    Windows Product Updates may stop responding or may use most or all the CPU resources, in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=100747).\n\nComputer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Debug programs\n\n###### CCE-24188-5\nSet 'Deny access to this computer from the network' to 'Guests' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny access to this computer from the network\n\n###### CCE-25215-5\nSet 'Deny log on as a batch job' to 'Guests' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on as a batch job\n\n###### CCE-23117-5\nSet 'Deny log on as a service' to 'No One' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on as a service\n\n###### CCE-24460-8\nSet 'Deny log on locally' to 'Guests' (Scored)\n\n    Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Deny log on locally\n\n\n## Limitations\n\nWindows only ofc\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnoma4i%2Fpuppet-windows_cis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnoma4i%2Fpuppet-windows_cis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnoma4i%2Fpuppet-windows_cis/lists"}