DISA STIG library V2R11
| Ref | Title | Text | |
|---|---|---|---|
| WN11-00-000005 | Domain-joined systems must use Windows 11 Enterprise Edition 64-bit version. | Verify domain-joined systems are using Windows 11 Enterprise Edition 64-bit version. For standalone systems, this is NA. Open "Settings". Select "System", then "About". If "Edition" is not "Windows 11 Enterprise", this is a finding. If "Sys | |
| WN11-00-000010 | Windows 11 systems must have a Trusted Platform Module (TPM) enabled. | Verify the system has a TPM and is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has bee | |
| WN11-00-000015 | Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS. Run "System Information". Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding. | |
| WN11-00-000020 | Secure Boot must be enabled on Windows 11 systems. | Verify the system firmware is configured for Secure Boot. Run "System Information". Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. | |
| WN11-00-000030 | Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest. | For AVD implementations with no data at rest, this is NA. Verify all Windows 11 information systems (including SIPRNet) employ BitLocker for full disk encryption. If full disk encryption using BitLocker is not implemented, this is a finding | |
| WN11-00-000031 | Windows 11 systems must use a BitLocker PIN for pre-boot authentication. | For AVD implementations with no data at rest, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\FVE | |
| WN11-00-000032 | Windows 11 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication. | For AVD implementations with no data at rest, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\FVE | |
| WN11-00-000035 | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universal apps installed by default on systems. If an application | |
| WN11-00-000040 | Windows 11 systems must be maintained at a supported servicing level. | 1. Determine your Windows 11 OS version. a. Run "winver.exe". The "About Windows" dialog box will display the system's version and OS build. For example, "Microsoft Windows 11 Version 24H2 (OS Build 26100.8875)". Record the numbers observed | |
| WN11-00-000045 | The Windows 11 system must use an antivirus program. | Verify an organizationally approved antivirus solution (Microsoft Defender Antivirus, for example) is installed on the system and in use. Verify if Microsoft Defender Antivirus is in use or enabled: If Windows Defender is your primary or se | |
| WN11-00-000050 | Local volumes must be formatted using NTFS. | Run "Computer Management". Navigate to Storage >> Disk Management. If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding. This does not apply to system partitions such the Recovery a | |
| WN11-00-000055 | Alternate operating systems must not be permitted on the same system. | Verify the system does not include other operating system installations. Run "Advanced System Settings". Select the "Advanced" tab. Click the "Settings" button in the "Startup and Recovery" section. If the drop-down list box "Default operat | |
| WN11-00-000060 | Non-system-created file shares on a system must limit access to groups that require it. | Non-system-created shares must not exist on workstations. If only system-created shares exist on the system, this is NA. Run "Computer Management". Navigate to System Tools >> Shared Folders >> Shares. If the only shares listed are "ADMIN$" | |
| WN11-00-000065 | Unused accounts must be disabled or removed from the system after 35 days of inactivity. | Run "PowerShell". Copy the lines below to the PowerShell window and enter. "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.La | |
| WN11-00-000070 | Only accounts responsible for the administration of a system must have Administrator rights on the system. | Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may | |
| WN11-00-000075 | Only accounts responsible for the backup operations must be members of the Backup Operators group. | Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Backup Operators group. If the group contains no accounts, this is not a finding. If the group contains any accounts, the acc | |
| WN11-00-000080 | Only authorized user accounts must be allowed to create or run virtual machines on Windows 11 systems. | If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines. For Hyper-V, run "Computer Management". Navigate to System Tools >> Local Users | |
| WN11-00-000085 | Standard local user accounts must not exist on a system in a domain. | Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. The accounts listed assumes a system is joine | |
| WN11-00-000090 | Accounts must be configured to require password expiration. | Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double-click each active account. If "Password never expires" is selected for any account, this is a finding. | |
| WN11-00-000095 | Permissions for system files and directories must conform to minimum requirements. | The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN11-SO-000160). If the default file system permissions are maintained and t | |
| WN11-00-000100 | Internet Information System (IIS) or its subcomponents must not be installed on a workstation. | Verify it has not been installed on the system. Run "Programs and Features". Select "Turn Windows features on or off". If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, thi | |
| WN11-00-000105 | Simple Network Management Protocol (SNMP) must not be installed on the system. | Verify SNMP has not been installed. Navigate to the Windows\System32 directory. If the "SNMP" application exists, this is a finding. | |
| WN11-00-000110 | Simple TCP/IP Services must not be installed on the system. | Verify Simple TCP/IP Services has not been installed. Run "Services.msc". If "Simple TCP/IP Services" is listed, this is a finding. | |
| WN11-00-000115 | The Telnet Client must not be installed on the system. | Verify Telnet Client has not been installed. Navigate to the Windows\System32 directory. If the "telnet" application exists, this is a finding. | |
| WN11-00-000120 | The TFTP Client must not be installed on the system. | Verify TFTP Client has not been installed. Navigate to the Windows\System32 directory. If the "TFTP" application exists, this is a finding. | |
| WN11-00-000125 | Copilot must be disabled for Windows 11. | Run the following PowerShell command as an administrator: Get-AppxPackage -AllUsers | Where-Object { $_.Name -like "*Copilot*" } If Microsoft.Copilot displays, this is a finding. | |
| WN11-00-000126 | Windows 11 systems must block consumer account user authentication. | Verify the "block all consumer Microsoft account user authentication" is enabled. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftAccount Value Name: DisableUserAuth Value Type: REG_DWORD Value: 0x0000 | |
| WN11-00-000130 | Software certificate installation files must be removed from Windows 11. | Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or A | |
| WN11-00-000135 | A host-based firewall must be installed and enabled on the system. | Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. The configuration requirements will be determined by the applicable firewall | |
| WN11-00-000140 | Inbound exceptions to the firewall on Windows 11 domain workstations must only allow authorized remote management hosts. | Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts. If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding. Review inbound | |
| WN11-00-000150 | Structured Exception Handling Overwrite Protection (SEHOP) must be enabled. | Verify SEHOP is turned on. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\kernel\ Value | |
| WN11-00-000155 | The Windows PowerShell 2.0 feature must be disabled on the system. | For Windows 11 version 24H2 and newer, this requirement is Not Applicable. Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Get-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShe | |
| WN11-00-000160 | The Server Message Block (SMB) v1 protocol must be disabled on the system. | Different methods are available to disable SMBv1 on Windows 11. This is the preferred method, however if WN11-00-000165 and WN11-00-000170 are configured, this is NA. Run "Windows PowerShell" with elevated privileges (run as administrator). | |
| WN11-00-000165 | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server. | Different methods are available to disable SMBv1 on Windows 11, if WN11-00-000160 is configured, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACH | |
| WN11-00-000170 | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client. | Different methods are available to disable SMBv1 on Windows 11, if WN11-00-000160is configured, this is NA. If the following registry value is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: | |
| WN11-00-000175 | The Secondary Logon service must be disabled on Windows 11. | Run "Services.msc". Locate the "Secondary Logon" service. If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding. | |
| WN11-00-000190 | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 11. | Review the effective User Rights setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. Revie | |
| WN11-00-000210 | Bluetooth must be turned off unless approved by the organization. | This is NA if the system does not have Bluetooth. Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\PolicyMana | |
| WN11-00-000230 | The system must notify the user when a Bluetooth device attempts to connect. | This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy. Search for "Bluetooth". View Bluetooth Settings. Select "More Bluetooth Options" If "Alert me when a new Bluetooth device wants to | |
| WN11-00-000240 | Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email. | Determine whether administrative accounts are prevented from using applications that access the internet, such as web browsers, or with potential internet sources, such as email, except as necessary for local service administration. The org | |
| WN11-00-000260 | The Windows 11 time service must synchronize with an appropriate DoW time source. | Review the Windows time service configuration. Open an elevated "Command Prompt" (run as administrator). Enter "W32tm /query /configuration". Domain-joined systems (excluding the domain controller with the PDC emulator role): If the value f | |
| WN11-00-000395 | Windows 11 must not have portproxy enabled or in use. | Check the registry key for existence of proxied ports: HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\. If the key contains v4tov4\tcp\ or is populated v4tov4\tcp\, this is a finding. Run "netsh interface portproxy show all". If the comma | |
| WN11-00-000400 | All Wi-Fi Direct adapters must be disabled on the system. | Determine whether any Wi-Fi Direct adapters exist on the system. Open PowerShell with elevated privileges (run as administrator). Enter the following command: Get-NetAdapter -InterfaceDescription "Microsoft Wi-Fi Direct*" -IncludeHidden If | |
| WN11-AC-000005 | Windows 11 account lockout duration must be configured to 15 minutes or greater. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account | |
| WN11-AC-000010 | The number of allowed bad logon attempts must be configured to three or less. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account | |
| WN11-AC-000015 | The period of time before the bad logon counter is reset must be configured to 15 minutes. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Reset a | |
| WN11-AC-000020 | The password history must be configured to 24 passwords remembered. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". For GPO-managed systems, navigate to: Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Poli | |
| WN11-AC-000025 | The maximum password age must be configured to 180 days or less. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the " | |
| WN11-AC-000030 | The minimum password age must be configured to at least 1 day. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the " | |
| WN11-AC-000035 | Passwords must, at a minimum, be 14 characters. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the " | |
| WN11-AC-000040 | The built-in Microsoft password complexity filter must be enabled. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Pass | |
| WN11-AC-000045 | Reversible password encryption must be disabled. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Stor | |
| WN11-AU-000005 | The system must be configured to audit Account Logon - Credential Validation failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000010 | The system must be configured to audit Account Logon - Credential Validation successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000030 | The system must be configured to audit Account Management - Security Group Management successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000035 | The system must be configured to audit Account Management - User Account Management failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000040 | The system must be configured to audit Account Management - User Account Management successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000045 | The system must be configured to audit Detailed Tracking - PNP Activity successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000050 | The system must be configured to audit Detailed Tracking - Process Creation successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000054 | The system must be configured to audit Logon/Logoff - Account Lockout failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000060 | The system must be configured to audit Logon/Logoff - Group Membership successes. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000065 | The system must be configured to audit Logon/Logoff - Logoff successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000070 | The system must be configured to audit Logon/Logoff - Logon failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000075 | The system must be configured to audit Logon/Logoff - Logon successes. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000080 | The system must be configured to audit Logon/Logoff - Special Logon successes. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000081 | Windows 11 must be configured to audit Object Access - File Share failures. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000082 | Windows 11 must be configured to audit Object Access - File Share successes. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000083 | Windows 11 must be configured to audit Object Access - Other Object Access Events successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000084 | Windows 11 must be configured to audit Object Access - Other Object Access Events failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000085 | The system must be configured to audit Object Access - Removable Storage failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000090 | The system must be configured to audit Object Access - Removable Storage successes. | Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the | |
| WN11-AU-000100 | The system must be configured to audit Policy Change - Audit Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000105 | The system must be configured to audit Policy Change - Authentication Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000107 | The system must be configured to audit Policy Change - Authorization Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000110 | The system must be configured to audit Privilege Use - Sensitive Privilege Use failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000115 | The system must be configured to audit Privilege Use - Sensitive Privilege Use successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000120 | The system must be configured to audit System - IPsec Driver failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000130 | The system must be configured to audit System - Other System Events successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000135 | The system must be configured to audit System - Other System Events failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000140 | The system must be configured to audit System - Security State Change successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000150 | The system must be configured to audit System - Security System Extension successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000155 | The system must be configured to audit System - System Integrity failures. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000160 | The system must be configured to audit System - System Integrity successes. | Security Option "Audit: Force audit policy subcategory settings to override audit policy category settings" must be set to "Enabled" (WN11-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review t | |
| WN11-AU-000500 | The Application event log size must be configured to 32768 KB or greater. | If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. If the following registry value does not exist or is not configured as specified, this is a finding: Registry | |
| WN11-AU-000505 | The security event log size must be configured to a value that holds at least one week's worth of audit records. | If the system is configured to send audit records directly to an audit server, this requirement is not applicable. This must be documented with the information system security officer (ISSO). The registry configuration setting below must be | |
| WN11-AU-000510 | The System event log size must be configured to 32768 KB or greater. | If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. If the following registry value does not exist or is not configured as specified, this is a finding: Registry | |
| WN11-AU-000515 | Windows 11 permissions for the Application event log must prevent access by non-privileged accounts. | Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. Eventlog - Full Control SYSTEM - Full Control Admi | |
| WN11-AU-000520 | Windows 11 permissions for the Security event log must prevent access by non-privileged accounts. | Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. Eventlog - Full Control SYSTEM - Full Control Administra | |
| WN11-AU-000525 | Windows 11 permissions for the System event log must prevent access by non-privileged accounts. | Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. Eventlog - Full Control SYSTEM - Full Control Administrators | |
| WN11-AU-000555 | Windows 11 must be configured to audit Other Policy Change Events Failures. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000560 | Windows 11 must be configured to audit other Logon/Logoff Events Successes. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000565 | Windows 11 must be configured to audit other Logon/Logoff Events Failures. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000570 | Windows 11 must be configured to audit Detailed File Share Failures. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000575 | Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Successes. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000580 | Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Failures. | Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the sys | |
| WN11-AU-000583 | Windows 11 must be configured to audit handle manipulation failures. | Verify that Audit Handle Manipulation auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Handle Manipulation. | |
| WN11-AU-000585 | Windows 11 must have command line process auditing events enabled for failures. | Ensure Audit Process Creation auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policy >> Detailed Tracking >> Audit Process Creation. If "Audit | |
| WN11-AU-000586 | Windows 11 must be configured to audit registry successes. | Verify that Audit Registry auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is | |
| WN11-AU-000587 | Windows 11 must be configured to audit sensitive privilege use successes. | Verify that Audit Sensitive Privilege Use auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privile | |
| WN11-AU-000588 | Windows 11 must be configured to audit sensitive privilege use failures. | Verify that Audit Sensitive Privilege Use auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privile | |
| WN11-AU-000589 | Windows 11 must be configured to audit registry failures. | Verify that Audit Registry auditing has been enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is | |
| WN11-CC-000005 | Camera access from the lock screen must be disabled. | If the device does not have a camera, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Per | |
| WN11-CC-000007 | Windows 11 must cover or disable the built-in or attached camera when not in use. | If the device or operating system does not have a camera installed, this requirement is not applicable. This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local authorizing offic | |
| WN11-CC-000010 | The display of slide shows on the lock screen must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ Value Name: NoLockScreenSlideshow Va | |
| WN11-CC-000020 | IPv6 source routing must be configured to highest protection. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisableIpSourceRouting V | |
| WN11-CC-000025 | The system must be configured to prevent IP source routing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting Va | |
| WN11-CC-000030 | The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value | |
| WN11-CC-000035 | The system must be configured to ignore NetBIOS name release requests except from WINS servers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value Name: NoNameReleaseOnDemand Val | |
| WN11-CC-000037 | Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems. | If the system is not a member of a domain, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: SOFTWARE\Microsoft\Windows\CurrentV | |
| WN11-CC-000038 | WDigest Authentication must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ Value Name: UseLogonCredentia | |
| WN11-CC-000039 | Run as different user must be removed from context menus. | If the following registry values do not exist or are not configured as specified, this is a finding. The policy configures the same Value Name, Type and Value under four different registry paths. Registry Hive: HKEY_LOCAL_MACHINE Registry P | |
| WN11-CC-000040 | Insecure logons to an SMB server must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ Value Name: AllowInsecureGuestAuth | |
| WN11-CC-000044 | Internet connection sharing must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Network Connections\ Value Name: NC_ShowSharedAccessU | |
| WN11-CC-000050 | Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | This requirement is applicable to domain-joined systems, for standalone systems this is NA. If the following registry values do not exist or are not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path | |
| WN11-CC-000052 | Windows 11 must be configured to prioritize ECC Curves with longer key lengths first. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\ Value Name: EccCurve | |
| WN11-CC-000055 | Simultaneous connections to the internet or a Windows domain must be limited. | The default behavior for "Minimize the number of simultaneous connections to the Internet or a Windows Domain" is "Enabled". If it exists and is configured with a value of "0", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry P | |
| WN11-CC-000060 | Connections to non-domain networks when connected to a domain authenticated network must be blocked. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\ Value Name: fBlockNonDomain Value | |
| WN11-CC-000063 | Windows 11 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance. | Verify the Windows 11 system is receiving policy from either group Policy or an MDM with the following steps: From a command line or PowerShell: gpresult /R OS Configuration: Member Workstation If the system OS Configuration is set to "Memb | |
| WN11-CC-000066 | Command line data must be included in process creation events. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ Value Name: ProcessCreat | |
| WN11-CC-000068 | Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ Value Name: AllowProtectedCred | |
| WN11-CC-000070 | Virtualization-Based Security (VBS) must be enabled on Windows 11 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | Confirm VBS is enabled and running with Secure Boot or Secure Boot and DMA Protection. If there are documented operational mission needs to disable VBS, this may be reduced to a CAT III finding. Run "PowerShell" with elevated privileges (ru | |
| WN11-CC-000075 | Credential Guard must be running on Windows 11 systems. | Confirm Credential Guard is running. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRun | |
| WN11-CC-000080 | Virtualization-based protection of code integrity must be enabled. | Confirm virtualization-based protection of code integrity. If there are documented operational mission needs to disable code integrity, this may be reduced to a CAT II finding. Run "PowerShell" with elevated privileges (run as administrator | |
| WN11-CC-000085 | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers. | The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad"). If the registry value name below does not exist, this is a finding. If it | |
| WN11-CC-000090 | Group Policy objects must be reprocessed even if they have not changed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} V | |
| WN11-CC-000100 | Downloading print driver packages over HTTP must be prevented. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableWebPnPDownload Value | |
| WN11-CC-000105 | Web publishing and online ordering wizards must be prevented from downloading a list of providers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoWebServices Va | |
| WN11-CC-000110 | Printing over HTTP must be prevented. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableHTTPPrinting Value Ty | |
| WN11-CC-000115 | Systems must at least attempt device authentication using certificates. | This requirement is applicable to domain-joined systems, for standalone systems this is NA. The default behavior for "Support device authentication using certificate" is "Automatic". If it exists and is configured with a value of "0", this | |
| WN11-CC-000120 | The network selection user interface (UI) must not be displayed on the logon screen. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: DontDisplayNetworkSelectionUI Val | |
| WN11-CC-000130 | Local users on domain-joined computers must not be enumerated. | This requirement is applicable to domain-joined systems, for standalone systems this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path | |
| WN11-CC-000145 | Users must be prompted for a password on resume from sleep (on battery). | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Val | |
| WN11-CC-000150 | The user must be prompted for a password on resume from sleep (plugged in). | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Val | |
| WN11-CC-000155 | Solicited Remote Assistance must not be allowed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowToGetHelp Val | |
| WN11-CC-000165 | Unauthenticated RPC clients must be restricted from connecting to the RPC server. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ Value Name: RestrictRemoteClients Value Type: | |
| WN11-CC-000170 | The setting to allow Microsoft accounts to be optional for modern style apps must be enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: MSAOptional Value | |
| WN11-CC-000175 | The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ Value Name: DisableInventory Value Type: R | |
| WN11-CC-000180 | Autoplay must be turned off for non-volume devices. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value Ty | |
| WN11-CC-000185 | The default autorun behavior must be configured to prevent autorun commands. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value | |
| WN11-CC-000190 | Autoplay must be disabled for all drives. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoR | |
| WN11-CC-000195 | Enhanced anti-spoofing for facial recognition must be enabled on Windows 11. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures\ (For GPO-managed systems) Or Regis | |
| WN11-CC-000200 | Administrator accounts must not be enumerated during elevation. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ Value Name: EnumerateAdministr | |
| WN11-CC-000204 | Enhanced diagnostic data must be limited to the minimum required to support Windows Analytics. | If "Enhanced" level is enabled for telemetry, this must be configured. If "Security" or "Basic" are configured, this is NA. (See WN11-CC-000205). If the following registry value does not exist or is not configured as specified, this is a fi | |
| WN11-CC-000205 | Windows Telemetry must not be configured to Full. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ Value Name: AllowTelemetry Type: REG_ | |
| WN11-CC-000206 | Windows Update must not obtain updates from other PCs on the internet. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ Value Type: REG_DWORD Value: 0x | |
| WN11-CC-000210 | The Microsoft Defender SmartScreen for Explorer must be enabled. | This is applicable to unclassified systems, for other systems this is NA. If the following registry values do not exist or are not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Polici | |
| WN11-CC-000215 | Explorer Data Execution Prevention must be enabled. | The default behavior is for data execution prevention to be turned on for file explorer. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Wi | |
| WN11-CC-000220 | File Explorer heap termination on corruption must be disabled. | The default behavior is for File Explorer heap termination on corruption to be enabled. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Win | |
| WN11-CC-000225 | File Explorer shell protocol must run in protected mode. | The default behavior is for shell protected mode to be turned on for file explorer. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentV | |
| WN11-CC-000252 | Windows 11 must be configured to disable Windows Game Recording and Broadcasting. | This is NA for Windows 11 LTSC. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\GameDVR\ (For GPO-man | |
| WN11-CC-000255 | The use of a hardware security device with Windows Hello for Business must be enabled. | Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. If the following registry value does not exis | |
| WN11-CC-000260 | Windows 11 must be configured to require a minimum PIN length of six characters or greater. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\ (For GPO-managed systems) Or R | |
| WN11-CC-000270 | Passwords must not be saved in the Remote Desktop Client. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DisablePasswordSavi | |
| WN11-CC-000275 | Local drives must be prevented from sharing with Remote Desktop Session Hosts. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCdm Value T | |
| WN11-CC-000280 | Remote Desktop Services must always prompt a client for passwords upon connection. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fPromptForPassword | |
| WN11-CC-000285 | The Remote Desktop Session Host must require secure RPC communications. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEncryptRPCTraffic | |
| WN11-CC-000290 | Remote Desktop Services must be configured with the client connection encryption set to the required level. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: MinEncryptionLevel | |
| WN11-CC-000295 | Attachments must be prevented from being downloaded from RSS feeds. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: DisableEnclosureDownload | |
| WN11-CC-000300 | Basic authentication for RSS feeds over HTTP must not be used. | The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Po | |
| WN11-CC-000305 | Indexing of encrypted files must be turned off. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ (For GPO-managed systems) Or Registry | |
| WN11-CC-000310 | Users must be prevented from changing installation options. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: EnableUserControl Value Type: | |
| WN11-CC-000315 | The Windows Installer feature "Always install with elevated privileges" must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value Ty | |
| WN11-CC-000320 | Users must be notified if a web-based program attempts to install software. | The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. If it exists and is configured with a value of "1", this is | |
| WN11-CC-000325 | Automatically signing in the last interactive user after a system-initiated restart must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableAutomaticRe | |
| WN11-CC-000326 | PowerShell script block logging must be enabled on Windows 11. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScri | |
| WN11-CC-000327 | PowerShell Transcription must be enabled on Windows 11. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscrip | |
| WN11-CC-000330 | The Windows Remote Management (WinRM) client must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value Type: REG_ | |
| WN11-CC-000335 | The Windows Remote Management (WinRM) client must not allow unencrypted traffic. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowUnencryptedTraffic Val | |
| WN11-CC-000345 | The Windows Remote Management (WinRM) service must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value Type: REG | |
| WN11-CC-000350 | The Windows Remote Management (WinRM) service must not allow unencrypted traffic. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowUnencryptedTraffic Va | |
| WN11-CC-000355 | The Windows Remote Management (WinRM) service must not store RunAs credentials. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: DisableRunAs Value Type: R | |
| WN11-CC-000360 | The Windows Remote Management (WinRM) client must not use Digest authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowDigest Value Type: REG | |
| WN11-CC-000365 | Windows 11 must be configured to prevent Windows apps from being activated by voice while the system is locked. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ Value Name: LetAppsActivateWithVoiceAbove | |
| WN11-CC-000366 | Windows 11 must be configured to prevent Windows apps from being activated by voice. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ Value Name: LetAppsActivateWithVoice Type | |
| WN11-CC-000370 | The convenience PIN for Windows 11 must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows\System Value Name: AllowDomainPINLogon Value Type: RE | |
| WN11-CC-000385 | Windows Ink Workspace must be configured to disallow access above the lock. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\WindowsInkWorkspace (For GPO-managed systems) Or Registry Pat | |
| WN11-CC-000390 | Windows 11 must be configured to prevent users from receiving suggestions for third-party or additional applications. | Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWA | |
| WN11-CC-000391 | Internet Explorer must be disabled for Windows 11. | Determine if IE11 is installed or enabled on Windows 11 semi-annual channel. If IE11 is installed or not disabled on Windows 11 semi-annual channel, this is a finding. If IE11 is installed on an unsupported operating system and is enabled o | |
| WN11-EP-000310 | Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows\Kernel DMA Protection Value Name: DeviceEnumerationPo | |
| WN11-PK-000005 | The DoW Root CA certificates must be installed in the Trusted Root Store. | Verify the DoW Root CA certificates are installed as Trusted Root Certification Authorities. The certificates referenced below apply to unclassified systems; refer to PKE documentation for other networks. Run "PowerShell" as an administrato | |
| WN11-PK-000010 | The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems. | Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\root | Where Sub | |
| WN11-PK-000015 | The DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems. | Verify the DoW Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Wher | |
| WN11-PK-000020 | The US DoW CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems. | Verify the US DoW CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\d | |
| WN11-RG-000005 | Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained. | Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive. If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding. Run "Regedit". | |
| WN11-SO-000010 | The built-in guest account must be disabled. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Accou | |
| WN11-SO-000015 | Local accounts with blank passwords must be restricted to prevent access from the network. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value Type: REG_D | |
| WN11-SO-000020 | The built-in administrator account must be renamed. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Accou | |
| WN11-SO-000025 | The built-in guest account must be renamed. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Accou | |
| WN11-SO-000030 | Audit policy using subcategories must be enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy Value Type: | |
| WN11-SO-000035 | Outgoing secure channel traffic must be encrypted or signed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireSignOrSeal Valu | |
| WN11-SO-000040 | Outgoing secure channel traffic must be encrypted. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SealSecureChannel Valu | |
| WN11-SO-000045 | Outgoing secure channel traffic must be signed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SignSecureChannel Valu | |
| WN11-SO-000050 | The computer account password must not be prevented from being reset. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: DisablePasswordChange | |
| WN11-SO-000055 | The maximum age for machine account passwords must be configured to 30 days or less. | (remove)This is the default configuration for this setting (30 days). If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentContr | |
| WN11-SO-000060 | The system must be configured to require a strong session key. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireStrongKey Value | |
| WN11-SO-000070 | The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: InactivityTimeoutS | |
| WN11-SO-000075 | The required legal notice must be configured to display before console logon. | If the following registry value does not exist or is not configured as specified, this is a finding: Note: If configuring this policy via a Policy Configuration Service Provider (CSP), additional steps are needed (see Fix Text). Registry Hi | |
| WN11-SO-000085 | Caching of logon credentials must be limited. | This is the default configuration for this setting (10 logons to cache). If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microso | |
| WN11-SO-000095 | The Smart Card removal option must be configured to Force Logoff or Lock Workstation. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: SCRemoveOption Value T | |
| WN11-SO-000100 | The Windows SMB client must be configured to always perform SMB packet signing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: RequireSecuri | |
| WN11-SO-000110 | Unencrypted passwords must not be sent to third-party SMB Servers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnablePlainTe | |
| WN11-SO-000120 | The Windows SMB server must be configured to always perform SMB packet signing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RequireSecuritySig | |
| WN11-SO-000140 | Anonymous SID/Name translation must not be allowed. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Netwo | |
| WN11-SO-000145 | Anonymous enumeration of SAM accounts must not be allowed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DW | |
| WN11-SO-000150 | Anonymous enumeration of shares must be restricted. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD | |
| WN11-SO-000160 | The system must be configured to prevent anonymous users from having the same rights as the Everyone group. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous Value Type: R | |
| WN11-SO-000165 | Anonymous access to Named Pipes and Shares must be restricted. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAc | |
| WN11-SO-000167 | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictRemoteSAM Value Type: REG_SZ Va | |
| WN11-SO-000180 | NTLM must be prevented from falling back to a Null session. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ Value Name: allownullsessionfallback Value T | |
| WN11-SO-000185 | PKU2U authentication using online identities must be prevented. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ Value Name: AllowOnlineID Value Type: REG_DWO | |
| WN11-SO-000190 | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ Value Name | |
| WN11-SO-000195 | The system must be configured to prevent the storage of the LAN Manager hash of passwords. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value Type: REG_DWORD Value: 1 | |
| WN11-SO-000205 | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DW | |
| WN11-SO-000210 | The system must be configured to the required LDAP client signing level. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity Value Type: REG_D | |
| WN11-SO-000215 | The system must be configured to meet the minimum session security requirement for NTLM SSP based clients. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec Value Type: REG | |
| WN11-SO-000220 | The system must be configured to meet the minimum session security requirement for NTLM SSP based servers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec Value Type: REG | |
| WN11-SO-000230 | The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ (For GPO-managed systems) Or Re | |
| WN11-SO-000240 | The default permissions of global system objects must be increased. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: | |
| WN11-SO-000245 | User Account Control approval mode for the built-in Administrator must be enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: FilterAdministrato | |
| WN11-SO-000250 | User Account Control must prompt administrators for consent on the secure desktop. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehav | |
| WN11-SO-000251 | Windows 11 must use multifactor authentication for local and network access to privileged and nonprivileged accounts. | If the system is not a member of a domain, this is Not Applicable. If all of the following settings exist and are populated, this is not a finding. \HKLM\SOFTWARE\Microsoft\Cryptography\Calais\Readers \HKLM\SOFTWARE\Microsoft\Cryptography\C | |
| WN11-SO-000255 | User Account Control must automatically deny elevation requests for standard users. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehav | |
| WN11-SO-000260 | User Account Control must be configured to detect application installations and prompt for elevation. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableInstallerDet | |
| WN11-SO-000265 | User Account Control must only elevate UIAccess applications that are installed in secure locations. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableSecureUIAPat | |
| WN11-SO-000270 | User Account Control must run all administrators in Admin Approval Mode, enabling UAC. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableLUA Value Ty | |
| WN11-SO-000275 | User Account Control must virtualize file and registry write failures to per-user locations. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableVirtualizati | |
| WN11-SO-000280 | Passwords for enabled local Administrator accounts must be changed at least every 180 days. | If there are no enabled local Administrator accounts, this is Not Applicable. Use of an enabled built-in account without management by LAPS must be documented and supplied to the information system security manager (ISSM)/information system | |
| WN11-UC-000015 | Toast notifications to the lock screen must be turned off. | Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWA | |
| WN11-UC-000020 | Zone information must be preserved when saving attachments. | Note: This Check must be performed for each interactive user profile on the system. The default behavior is for Windows to mark file attachments with their zone information. If it exists and is configured with a value of "1", this is a find | |
| WN11-UR-000005 | The "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000010 | The "Access this computer from the network" user right must only be assigned to the Administrators and Remote Desktop Users groups. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000015 | The "Act as part of the operating system" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000025 | The "Allow log on locally" user right must only be assigned to the Administrators and Users groups. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000030 | The "Back up files and directories" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000035 | The "Change the system time" user right must only be assigned to Administrators and Local Service. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000040 | The "Create a pagefile" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000045 | The "Create a token object" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000050 | The "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000055 | The "Create permanent shared objects" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000060 | The "Create symbolic links" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000065 | The "Debug programs" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000070 | The "Deny access to this computer from the network" user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following | |
| WN11-UR-000075 | The "Deny log on as a batch job" user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts. | This requirement is applicable to domain-joined systems, for standalone systems this is NA. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows | |
| WN11-UR-000080 | The "Deny log on as a service" user right on Windows 11 domain-joined workstations must be configured to prevent access from highly privileged domain accounts. | This requirement is applicable to domain-joined systems, for standalone systems this is NA. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows | |
| WN11-UR-000085 | The "Deny log on locally" user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following | |
| WN11-UR-000090 | The "Deny log on through Remote Desktop Services" user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following | |
| WN11-UR-000095 | The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000100 | The "Force shutdown from a remote system" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000110 | The "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000120 | The "Load and unload device drivers" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000125 | The "Lock pages in memory" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000130 | The "Manage auditing and security log" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000140 | The "Modify firmware environment values" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000145 | The "Perform volume maintenance tasks" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000150 | The "Profile single process" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000160 | The "Restore files and directories" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000165 | The "Take ownership of files or other objects" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or |
257 of 257.