Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

Microsoft Windows Server 2012/2012 R2 Domain Controller STIG SCAP Benchmark

  • Version/Release: V3R5
  • Published: 2023-02-27
  • Severity:
  • Sort:
View

Select any old version/release of this SCAP to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-00-000160
Vuln IDs
V-226049
Rule IDs
SV-226049r794699_rule
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.
Fix: F-27739r794698_fix

Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol Alternately: Search for "Features". Select "Turn Windows features on or off". De-select "SMB 1.0/CIFS File Sharing Support". The system must be restarted for the changes to take effect.

b
The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-00-000170
Vuln IDs
V-226050
Rule IDs
SV-226050r794701_rule
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.
Fix: F-27740r794700_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". The system must be restarted for the change to take effect. This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

b
The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-00-000180
Vuln IDs
V-226051
Rule IDs
SV-226051r794766_rule
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.
Fix: F-27741r794765_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client (extra setting needed for pre-Win8.1/2012R2)" to "Enabled" with the following three lines of text entered for "Configure LanmanWorkstation Dependencies": Bowser MRxSmb20 NSI The system must be restarted for the changes to take effect. These policy settings requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

b
Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-00-000220
Vuln IDs
V-226055
Rule IDs
SV-226055r794768_rule
Windows PowerShell versions 4.0 (with a patch) and 5.x add advanced logging features that can provide additional detail when malware has been run on a system. Ensuring Windows PowerShell 2.0 is not installed as well mitigates against a downgrade attack that evades the advanced logging features of later Windows PowerShell versions.
Fix: F-27745r794767_fix

Windows PowerShell 2.0 is not installed by default. Uninstall it if it has been installed. Open "Windows PowerShell". Enter "Uninstall-WindowsFeature -Name PowerShell-v2". Alternately: Use the "Remove Roles and Features Wizard" and deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell".

b
Windows 2012 account lockout duration must be configured to 15 minutes or greater.
RMF Control
AC-7
Severity
Medium
CCI
CCI-002238
Version
WN12-AC-000001
Vuln IDs
V-226056
Rule IDs
SV-226056r852054_rule
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.
Fix: F-27746r794777_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. A value of "0" is also acceptable, requiring an administrator to unlock the account.

b
The number of allowed bad logon attempts must meet minimum requirements.
RMF Control
AC-7
Severity
Medium
CCI
CCI-000044
Version
WN12-AC-000002
Vuln IDs
V-226057
Rule IDs
SV-226057r794277_rule
The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.
Fix: F-27747r475495_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy -> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).

b
The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2012.
RMF Control
AC-7
Severity
Medium
CCI
CCI-000044
Version
WN12-AC-000003
Vuln IDs
V-226058
Rule IDs
SV-226058r852055_rule
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.
Fix: F-27748r475498_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.

b
The password history must be configured to 24 passwords remembered.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000200
Version
WN12-AC-000004
Vuln IDs
V-226059
Rule IDs
SV-226059r794296_rule
A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.
Fix: F-27749r475501_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.

b
The maximum password age must meet requirements.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000199
Version
WN12-AC-000005
Vuln IDs
V-226060
Rule IDs
SV-226060r794295_rule
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.
Fix: F-27750r475504_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Maximum password age" to "60" days or less (excluding "0" which is unacceptable).

b
The minimum password age must meet requirements.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000198
Version
WN12-AC-000006
Vuln IDs
V-226061
Rule IDs
SV-226061r794294_rule
Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.
Fix: F-27751r475507_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password age" to at least "1" day.

b
Passwords must, at a minimum, be 14 characters.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000205
Version
WN12-AC-000007
Vuln IDs
V-226062
Rule IDs
SV-226062r794298_rule
Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.
Fix: F-27752r475510_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password length" to "14" characters.

b
The built-in Windows password complexity policy must be enabled.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000192
Version
WN12-AC-000008
Vuln IDs
V-226063
Rule IDs
SV-226063r794292_rule
The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least 3 of the 4 types of characters (numbers, upper- and lower-case letters, and special characters), as well as preventing the inclusion of user names or parts of.
Fix: F-27753r475513_fix

Configure the policy value for Computer Configuration >> Windows Settings -> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".

c
Reversible password encryption must be disabled.
RMF Control
IA-5
Severity
High
CCI
CCI-000196
Version
WN12-AC-000009
Vuln IDs
V-226064
Rule IDs
SV-226064r877397_rule
Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.
Fix: F-27754r475516_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Store password using reversible encryption" to "Disabled".

b
Kerberos user logon restrictions must be enforced.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-AC-000010-DC
Vuln IDs
V-226065
Rule IDs
SV-226065r794383_rule
This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default which is the most secure setting for validating access to target resources is not circumvented.
Fix: F-27755r475519_fix

Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Enforce user logon restrictions" to "Enabled".

b
The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-AC-000011-DC
Vuln IDs
V-226066
Rule IDs
SV-226066r794792_rule
This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection.
Fix: F-27756r794791_fix

Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for service ticket" to a maximum of 600 minutes, but not 0, which equates to "Ticket doesn't expire".

b
The Kerberos user ticket lifetime must be limited to 10 hours or less.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-AC-000012-DC
Vuln IDs
V-226067
Rule IDs
SV-226067r794794_rule
In Kerberos, there are 2 types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that startup under a specified user account, users must always get a TGT first, then get Service Tickets to all computers and services accessed.
Fix: F-27757r794793_fix

Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for user ticket" to a maximum of 10 hours, but not 0, which equates to "Ticket doesn't expire".

b
The Kerberos policy user ticket renewal maximum lifetime must be limited to 7 days or less.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-AC-000013-DC
Vuln IDs
V-226068
Rule IDs
SV-226068r794388_rule
This setting determines the period of time (in days) during which a user's TGT may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access.
Fix: F-27758r475528_fix

Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for user ticket renewal" to a maximum of 7 days or less.

b
The computer clock synchronization tolerance must be limited to 5 minutes or less.
RMF Control
IA-2
Severity
Medium
CCI
CCI-001941
Version
WN12-AC-000014-DC
Vuln IDs
V-226069
Rule IDs
SV-226069r852056_rule
This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible.
Fix: F-27759r475531_fix

Configure the policy value in the Default Domain Policy for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum tolerance for computer clock synchronization" to a maximum of 5 minutes or less.

c
Active Directory data files must have proper access control permissions.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-AD-000001-DC
Vuln IDs
V-226070
Rule IDs
SV-226070r877392_rule
Improper access permissions for directory data related files could allow unauthorized users to read, modify, or delete directory data or audit trails.
Fix: F-27760r475534_fix

Ensure the permissions on NTDS database and log files are at least as restrictive as the following: NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) (I) - permission inherited from parent container (F) - full access

b
The system must be configured to audit Account Logon - Credential Validation successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000001
Vuln IDs
V-226085
Rule IDs
SV-226085r794339_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Credential validation records events related to validation tests on credentials for a user account logon.
Fix: F-27775r475579_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Success" selected.

b
The system must be configured to audit Account Logon - Credential Validation failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000002
Vuln IDs
V-226086
Rule IDs
SV-226086r794340_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Credential validation records events related to validation tests on credentials for a user account logon.
Fix: F-27776r475582_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Failure" selected.

b
Windows Server 2012/2012 R2 domain controllers must be configured to audit Account Management - Computer Account Management successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000011-DC
Vuln IDs
V-226087
Rule IDs
SV-226087r852064_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts.
Fix: F-27777r475585_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Computer Account Management" with "Success" selected.

b
The system must be configured to audit Account Management - Other Account Management Events successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000015
Vuln IDs
V-226088
Rule IDs
SV-226088r852065_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.
Fix: F-27778r475588_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Other Account Management Events" with "Success" selected.

b
The system must be configured to audit Account Management - Security Group Management successes.
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
WN12-AU-000017
Vuln IDs
V-226089
Rule IDs
SV-226089r852066_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.
Fix: F-27779r475591_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Security Group Management" with "Success" selected.

b
The system must be configured to audit Account Management - User Account Management successes.
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
WN12-AU-000019
Vuln IDs
V-226090
Rule IDs
SV-226090r852067_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.
Fix: F-27780r475594_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Success" selected.

b
The system must be configured to audit Account Management - User Account Management failures.
RMF Control
AC-2
Severity
Medium
CCI
CCI-000018
Version
WN12-AU-000020
Vuln IDs
V-226091
Rule IDs
SV-226091r852068_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.
Fix: F-27781r475597_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Failure" selected.

b
The system must be configured to audit Detailed Tracking - Process Creation successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000023
Vuln IDs
V-226092
Rule IDs
SV-226092r794343_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Process Creation records events related to the creation of a process and the source.
Fix: F-27782r475600_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> "Audit Process Creation" with "Success" selected.

b
Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000031
Vuln IDs
V-226094
Rule IDs
SV-226094r794361_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Account Lockout events can be used to identify potentially malicious logon attempts.
Fix: F-27784r475606_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.

b
The system must be configured to audit DS Access - Directory Service Access successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000031-DC
Vuln IDs
V-226095
Rule IDs
SV-226095r852069_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit directory service access records events related to users accessing an Active Directory object.
Fix: F-27785r794781_fix

Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Access" with "Success" selected.

b
The system must be configured to audit DS Access - Directory Service Access failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000032-DC
Vuln IDs
V-226096
Rule IDs
SV-226096r852070_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit directory service access records events related to users accessing an Active Directory object.
Fix: F-27786r794783_fix

Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Access" with "Failure" selected.

b
The system must be configured to audit DS Access - Directory Service Changes successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000035-DC
Vuln IDs
V-226097
Rule IDs
SV-226097r852071_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit directory service changes records events related to changes made to objects in Active Directory Domain Services.
Fix: F-27787r794785_fix

Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Changes" with "Success" selected.

b
The system must be configured to audit Logon/Logoff - Logoff successes.
RMF Control
AC-17
Severity
Medium
CCI
CCI-000067
Version
WN12-AU-000045
Vuln IDs
V-226099
Rule IDs
SV-226099r794279_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.
Fix: F-27789r475621_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logoff" with "Success" selected.

b
The system must be configured to audit Logon/Logoff - Logon successes.
RMF Control
AC-17
Severity
Medium
CCI
CCI-000067
Version
WN12-AU-000047
Vuln IDs
V-226100
Rule IDs
SV-226100r794280_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.
Fix: F-27790r475624_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Success" selected.

b
The system must be configured to audit Logon/Logoff - Logon failures.
RMF Control
AC-17
Severity
Medium
CCI
CCI-000067
Version
WN12-AU-000048
Vuln IDs
V-226101
Rule IDs
SV-226101r794281_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.
Fix: F-27791r475627_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Failure" selected.

b
The system must be configured to audit Logon/Logoff - Special Logon successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000053
Vuln IDs
V-226102
Rule IDs
SV-226102r794335_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Special Logon records special logons which have administrative privileges and can be used to elevate processes.
Fix: F-27792r475630_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Special Logon" with "Success" selected.

b
The system must be configured to audit Policy Change - Audit Policy Change successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000085
Vuln IDs
V-226107
Rule IDs
SV-226107r794336_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit Policy Change records events related to changes in audit policy.
Fix: F-27797r475645_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Success" selected.

b
The system must be configured to audit Policy Change - Audit Policy Change failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000086
Vuln IDs
V-226108
Rule IDs
SV-226108r852073_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit Policy Change records events related to changes in audit policy.
Fix: F-27798r475648_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Failure" selected.

b
The system must be configured to audit Policy Change - Authentication Policy Change successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000087
Vuln IDs
V-226109
Rule IDs
SV-226109r852074_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.
Fix: F-27799r475651_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authentication Policy Change" with "Success" selected.

b
The system must be configured to audit Policy Change - Authorization Policy Change successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000089
Vuln IDs
V-226110
Rule IDs
SV-226110r794366_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Authorization Policy Change records events related to changes in user rights, such as Create a token object.
Fix: F-27800r475654_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authorization Policy Change" with "Success" selected.

b
The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000101
Vuln IDs
V-226111
Rule IDs
SV-226111r852075_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".
Fix: F-27801r475657_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Success" selected.

b
The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000102
Vuln IDs
V-226112
Rule IDs
SV-226112r852076_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".
Fix: F-27802r475660_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Failure" selected.

b
The system must be configured to audit System - IPsec Driver successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000103
Vuln IDs
V-226113
Rule IDs
SV-226113r794367_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. IPsec Driver records events related to the IPSec Driver such as dropped packets.
Fix: F-27803r475663_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Success" selected.

b
The system must be configured to audit System - IPsec Driver failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000104
Vuln IDs
V-226114
Rule IDs
SV-226114r794368_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. IPsec Driver records events related to the IPsec Driver such as dropped packets.
Fix: F-27804r475666_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Failure" selected.

b
Windows Server 2012/2012 R2 must be configured to audit System - Other System Events successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000105
Vuln IDs
V-226115
Rule IDs
SV-226115r852077_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. Satisfies: SRG-OS-000458-GPOS-00203
Fix: F-27805r475669_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.

b
Windows Server 2012/2012 R2 must be configured to audit System - Other System Events failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000106
Vuln IDs
V-226116
Rule IDs
SV-226116r852078_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. Satisfies: SRG-OS-000458-GPOS-00203
Fix: F-27806r475672_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.

b
The system must be configured to audit System - Security State Change successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000107
Vuln IDs
V-226117
Rule IDs
SV-226117r852079_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Security State Change records events related to changes in the security state, such as startup and shutdown of the system.
Fix: F-27807r475675_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security State Change" with "Success" selected.

b
The system must be configured to audit System - Security System Extension successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000109
Vuln IDs
V-226118
Rule IDs
SV-226118r852080_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Security System Extension records events related to extension code being loaded by the security subsystem.
Fix: F-27808r475678_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security System Extension" with "Success" selected.

b
The system must be configured to audit System - System Integrity successes.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000111
Vuln IDs
V-226119
Rule IDs
SV-226119r852081_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. System Integrity records events related to violations of integrity to the security subsystem.
Fix: F-27809r475681_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Success" selected.

b
The system must be configured to audit System - System Integrity failures.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
WN12-AU-000112
Vuln IDs
V-226120
Rule IDs
SV-226120r852082_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. System Integrity records events related to violations of integrity to the security subsystem.
Fix: F-27810r475684_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Failure" selected.

b
Event Viewer must be protected from unauthorized modification and deletion.
RMF Control
AU-9
Severity
Medium
CCI
CCI-001494
Version
WN12-AU-000213
Vuln IDs
V-226134
Rule IDs
SV-226134r794458_rule
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools.
Fix: F-27824r475726_fix

Ensure only TrustedInstaller has permissions to change or modify Event Viewer ("%SystemRoot%\SYSTEM32\Eventvwr.exe). The default permissions below satisfy this requirement. TrustedInstaller - Full Control Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute

b
The Mapper I/O network protocol (LLTDIO) driver must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000001
Vuln IDs
V-226135
Rule IDs
SV-226135r794411_rule
The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.
Fix: F-27825r475729_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Mapper I/O (LLTDIO) driver" to "Disabled".

b
The Responder network protocol driver must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000002
Vuln IDs
V-226136
Rule IDs
SV-226136r794412_rule
The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.
Fix: F-27826r475732_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Responder (RSPNDR) driver" to "Disabled".

b
Windows Peer-to-Peer networking services must be turned off.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000003
Vuln IDs
V-226137
Rule IDs
SV-226137r794413_rule
Peer-to-Peer applications can allow unauthorized access to a system and exposure of sensitive data. This setting will turn off the Microsoft Peer-to-Peer Networking Service.
Fix: F-27827r475735_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Microsoft Peer-to-Peer Networking Services -> "Turn off Microsoft Peer-to-Peer Networking Services" to "Enabled".

b
Network Bridges must be prohibited in Windows.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000004
Vuln IDs
V-226138
Rule IDs
SV-226138r794414_rule
A Network Bridge can connect two or more network segments, allowing unauthorized access or exposure of sensitive data. This setting prevents a Network Bridge from being installed and configured.
Fix: F-27828r475738_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Prohibit installation and configuration of Network Bridge on your DNS domain network" to "Enabled".

a
Domain users must be required to elevate when setting a networks location.
RMF Control
SC-3
Severity
Low
CCI
CCI-001084
Version
WN12-CC-000005
Vuln IDs
V-226139
Rule IDs
SV-226139r794452_rule
Selecting an incorrect network location may allow greater exposure of a system. Elevation is required by default on nondomain systems to change network location. This setting configures elevation to also be required on domain-joined systems.
Fix: F-27829r475741_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Require domain users to elevate when setting a network's location" to "Enabled".

a
All Direct Access traffic must be routed through the internal network.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000006
Vuln IDs
V-226140
Rule IDs
SV-226140r794494_rule
Routing all Direct Access traffic through the internal network allows monitoring and prevents split tunneling.
Fix: F-27830r475744_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Route all traffic through the internal network" to "Enabled: Enabled State".

a
IP stateless autoconfiguration limits state must be enabled.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000011
Vuln IDs
V-226145
Rule IDs
SV-226145r794495_rule
IP stateless autoconfiguration could configure routes that circumvent preferred routes if not limited.
Fix: F-27835r475759_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> Parameters -> "Set IP Stateless Autoconfiguration Limits State" to "Enabled".

b
The configuration of wireless devices using Windows Connect Now must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000012
Vuln IDs
V-226146
Rule IDs
SV-226146r794417_rule
Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.
Fix: F-27836r475762_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Configuration of wireless settings using Windows Connect Now" to "Disabled".

b
The Windows Connect Now wizards must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000013
Vuln IDs
V-226147
Rule IDs
SV-226147r794418_rule
Windows Connect Now provides wizards for tasks such as "Set up a wireless router or access point" and must not be available to users. Functions such as these may allow unauthorized connections to a system and the potential for sensitive information to be compromised.
Fix: F-27837r475765_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Prohibit access of the Windows Connect Now wizards" to "Enabled".

a
Windows Update must be prevented from searching for point and print drivers.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000016
Vuln IDs
V-226148
Rule IDs
SV-226148r852091_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.
Fix: F-27838r475768_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Printers -> "Extend Point and Print connection to search Windows Update" to "Disabled".

a
Optional component installation and component repair must be prevented from using Windows Update.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000018
Vuln IDs
V-226149
Rule IDs
SV-226149r852092_rule
Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Optional component installation or repair must be obtained from an internal source.
Fix: F-27839r475771_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> "Specify settings for optional component installation and component repair" to "Enabled" and with "Never attempt to download payload from Windows Update" selected.

b
Remote access to the Plug and Play interface must be disabled for device installation.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000019
Vuln IDs
V-226150
Rule IDs
SV-226150r794419_rule
Remote access to the Plug and Play interface could potentially allow connections by unauthorized devices. This setting configures remote access to the Plug and Play interface and must be disabled.
Fix: F-27840r475774_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Allow remote access to the Plug and Play interface" to "Disabled".

a
An Error Report must not be sent when a generic device driver is installed.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000020
Vuln IDs
V-226151
Rule IDs
SV-226151r794420_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents an error report from being sent when a generic device driver is installed.
Fix: F-27841r475777_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Do not send a Windows error report when a generic driver is installed on a device" to "Enabled".

a
A system restore point must be created when a new device driver is installed.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000021
Vuln IDs
V-226152
Rule IDs
SV-226152r794496_rule
A system restore point allows a rollback if an issue is encountered when a new device driver is installed.
Fix: F-27842r475780_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point" to "Disabled".

a
Device metadata retrieval from the Internet must be prevented.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000022
Vuln IDs
V-226153
Rule IDs
SV-226153r794421_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from retrieving device metadata from the Internet.
Fix: F-27843r475783_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Installation >> "Prevent device metadata retrieval from the Internet" to "Enabled".

a
Windows must be prevented from sending an error report when a device driver requests additional software during installation.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000023
Vuln IDs
V-226154
Rule IDs
SV-226154r794422_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.
Fix: F-27844r475786_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent Windows from sending an error report when a device driver requests additional software during installation" to "Enabled".

a
Device driver searches using Windows Update must be prevented.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000024
Vuln IDs
V-226155
Rule IDs
SV-226155r852093_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent the system from searching Windows Update for device drivers.
Fix: F-27845r475789_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify search order for device driver source locations" to "Enabled: Do not search Windows Update".

a
Device driver updates must only search managed servers, not Windows Update.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000025
Vuln IDs
V-226156
Rule IDs
SV-226156r852094_rule
Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Device driver updates must be obtained from an internal source.
Fix: F-27846r475792_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify the search server for device driver updates" to "Enabled" with "Search Managed Server" selected.

a
Users must not be prompted to search Windows Update for device drivers.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000026
Vuln IDs
V-226157
Rule IDs
SV-226157r852095_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from being prompted to search Windows Update for device drivers.
Fix: F-27847r475795_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Driver Installation -> "Turn off Windows Update device driver search prompt" to "Enabled".

b
Early Launch Antimalware, Boot-Start Driver Initialization Policy must be enabled and configured to only Good and Unknown.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000027
Vuln IDs
V-226158
Rule IDs
SV-226158r794497_rule
Compromised boot drivers can introduce malware prior to some protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.
Fix: F-27848r475798_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Early Launch Antimalware -> "Boot-Start Driver Initialization Policy" to "Enabled" with "Good and Unknown" selected.

b
Group Policy objects must be reprocessed even if they have not changed.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000028
Vuln IDs
V-226159
Rule IDs
SV-226159r794498_rule
Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.
Fix: F-27849r475801_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".

b
Group Policies must be refreshed in the background if the user is logged on.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000029
Vuln IDs
V-226160
Rule IDs
SV-226160r794499_rule
If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.
Fix: F-27850r475804_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Turn off background refresh of Group Policy" to "Disabled".

b
Access to the Windows Store must be turned off.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000030
Vuln IDs
V-226161
Rule IDs
SV-226161r794423_rule
Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.
Fix: F-27851r475807_fix

If the \Windows\WinStore directory exists, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off access to the Store" to "Enabled". Alternately, uninstall the "Desktop Experience" feature from Windows 2012. This is located under "User Interfaces and Infrastructure" in the "Add Roles and Features Wizard". The \Windows\WinStore directory may need to be manually deleted after this.

b
Downloading print driver packages over HTTP must be prevented.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000032
Vuln IDs
V-226162
Rule IDs
SV-226162r794424_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the computer from downloading print driver packages over HTTP.
Fix: F-27852r475810_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off downloading of print drivers over HTTP" to "Enabled".

a
Event Viewer Events.asp links must be turned off.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000033
Vuln IDs
V-226163
Rule IDs
SV-226163r794425_rule
Viewing events is a function of administrators, who must not access the internet with privileged accounts. This setting will disable Events.asp hyperlinks in Event Viewer to prevent links to the internet from within events.
Fix: F-27853r475813_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Event Viewer "Events.asp" links" to "Enabled".

a
Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000035
Vuln IDs
V-226164
Rule IDs
SV-226164r794426_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.
Fix: F-27854r475816_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off handwriting recognition error reporting" to "Enabled".

b
The Internet File Association service must be turned off.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000038
Vuln IDs
V-226165
Rule IDs
SV-226165r794427_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents unhandled file associations from using the Microsoft Web service to find an application.
Fix: F-27855r475819_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Internet File Association service" to "Enabled".

b
Printing over HTTP must be prevented.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000039
Vuln IDs
V-226166
Rule IDs
SV-226166r794428_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.
Fix: F-27856r475822_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off printing over HTTP" to "Enabled".

b
The Windows Customer Experience Improvement Program must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000045
Vuln IDs
V-226167
Rule IDs
SV-226167r794429_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.
Fix: F-27857r475825_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Windows Customer Experience Improvement Program" to "Enabled".

b
Windows must be prevented from using Windows Update to search for drivers.
RMF Control
CM-11
Severity
Medium
CCI
CCI-001812
Version
WN12-CC-000047
Vuln IDs
V-226168
Rule IDs
SV-226168r852096_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.
Fix: F-27858r475828_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Windows Update device driver searching" to "Enabled".

b
Copying of user input methods to the system account for sign-in must be prevented.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000048
Vuln IDs
V-226169
Rule IDs
SV-226169r794430_rule
Allowing different input methods for sign-in could open different avenues of attack. User input methods must be restricted to those enabled for the system account at sign-in.
Fix: F-27859r475831_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Locale Services -> "Disallow copying of user input methods to the system account for sign-in" to "Enabled".

b
Local users on domain-joined computers must not be enumerated.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000051
Vuln IDs
V-226170
Rule IDs
SV-226170r794431_rule
The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.
Fix: F-27860r475834_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Enumerate local users on domain-joined computers" to "Disabled".

b
App notifications on the lock screen must be turned off.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000052
Vuln IDs
V-226171
Rule IDs
SV-226171r794432_rule
App notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.
Fix: F-27861r475837_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Turn off app notifications on the lock screen" to "Enabled".

b
Users must be prompted to authenticate on resume from sleep (on battery).
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-CC-000054
Vuln IDs
V-226172
Rule IDs
SV-226172r852097_rule
Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).
Fix: F-27862r475840_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (on battery)" to "Enabled".

b
The user must be prompted to authenticate on resume from sleep (plugged in).
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-CC-000055
Vuln IDs
V-226173
Rule IDs
SV-226173r852098_rule
Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).
Fix: F-27863r475843_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (plugged in)" to "Enabled".

b
The system must be configured to prevent unsolicited remote assistance offers.
RMF Control
SC-4
Severity
Medium
CCI
CCI-001090
Version
WN12-CC-000058
Vuln IDs
V-226174
Rule IDs
SV-226174r794454_rule
Remote assistance allows another user to view or take control of the local session of a user. Unsolicited remote assistance is help that is offered by the remote user. This may allow unauthorized parties access to the resources on the computer.
Fix: F-27864r475846_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Offer Remote Assistance" to "Disabled".

c
Solicited Remote Assistance must not be allowed.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-CC-000059
Vuln IDs
V-226175
Rule IDs
SV-226175r794455_rule
Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.
Fix: F-27865r475849_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Solicited Remote Assistance" to "Disabled".

a
Remote Assistance log files must be generated.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000062
Vuln IDs
V-226176
Rule IDs
SV-226176r794500_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. This setting will turn on session logging for Remote Assistance connections.
Fix: F-27866r475852_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Turn on session logging" to "Enabled".

a
The detection of compatibility issues for applications and drivers must be turned off.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000065
Vuln IDs
V-226177
Rule IDs
SV-226177r794433_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.
Fix: F-27867r475855_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Application Compatibility Diagnostics -> "Detect compatibility issues for applications and drivers" to "Disabled".

a
Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000066
Vuln IDs
V-226178
Rule IDs
SV-226178r794434_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.
Fix: F-27868r475858_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Microsoft Support Diagnostic Tool -> "Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider" to "Disabled".

a
Access to Windows Online Troubleshooting Service (WOTS) must be prevented.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000067
Vuln IDs
V-226179
Rule IDs
SV-226179r794435_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.
Fix: F-27869r475861_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics -> "Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)" to "Disabled".

a
Responsiveness events must be prevented from being aggregated and sent to Microsoft.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000068
Vuln IDs
V-226180
Rule IDs
SV-226180r794436_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents responsiveness events from being aggregated and sent to Microsoft.
Fix: F-27870r475864_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Windows Performance PerfTrack -> "Enable/Disable PerfTrack" to "Disabled".

a
Trusted app installation must be enabled to allow for signed enterprise line of business apps.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000070
Vuln IDs
V-226182
Rule IDs
SV-226182r794437_rule
Enabling trusted app installation allows for enterprise line of business Windows 8 type apps. A trusted app package is one that is signed with a certificate chain that can be successfully validated in the enterprise. Configuring this ensures enterprise line of business apps are accessible.
Fix: F-27872r475870_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> App Package Deployment -> "Allow all trusted apps to install" to "Enabled".

a
The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-CC-000071
Vuln IDs
V-226183
Rule IDs
SV-226183r794438_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.
Fix: F-27873r475873_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Application Compatibility -> "Turn off Inventory Collector" to "Enabled".

c
Autoplay must be turned off for non-volume devices.
RMF Control
CM-7
Severity
High
CCI
CCI-001764
Version
WN12-CC-000072
Vuln IDs
V-226184
Rule IDs
SV-226184r852100_rule
Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable Autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).
Fix: F-27874r475876_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Disallow Autoplay for non-volume devices" to "Enabled".

c
The default Autorun behavior must be configured to prevent Autorun commands.
RMF Control
CM-7
Severity
High
CCI
CCI-001764
Version
WN12-CC-000073
Vuln IDs
V-226185
Rule IDs
SV-226185r852101_rule
Allowing Autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents Autorun commands from executing.
Fix: F-27875r475879_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".

c
Autoplay must be disabled for all drives.
RMF Control
CM-7
Severity
High
CCI
CCI-001764
Version
WN12-CC-000074
Vuln IDs
V-226186
Rule IDs
SV-226186r852102_rule
Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables Autoplay on all drives.
Fix: F-27876r475882_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Turn off AutoPlay" to "Enabled:All Drives".

b
The use of biometrics must be disabled.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000075
Vuln IDs
V-226187
Rule IDs
SV-226187r794439_rule
Allowing biometrics may bypass required authentication methods. Biometrics may only be used as an additional authentication factor where an enhanced strength of identity credential is necessary or desirable. Additional factors must be met per DoD policy.
Fix: F-27877r475885_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Biometrics -> "Allow the use of biometrics" to "Disabled".

b
The password reveal button must not be displayed.
RMF Control
IA-6
Severity
Medium
CCI
CCI-000206
Version
WN12-CC-000076
Vuln IDs
V-226188
Rule IDs
SV-226188r794410_rule
Visible passwords may be seen by nearby persons, compromising them. The password reveal button can be used to display an entered password and must not be allowed.
Fix: F-27878r475888_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Credential User Interface -> "Do not display the password reveal button" to "Enabled".

b
Administrator accounts must not be enumerated during elevation.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-CC-000077
Vuln IDs
V-226189
Rule IDs
SV-226189r794453_rule
Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to enter in a username and password to elevate a running application.
Fix: F-27879r475891_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".

b
The Application event log size must be configured to 32768 KB or greater.
RMF Control
AU-4
Severity
Medium
CCI
CCI-001849
Version
WN12-CC-000084
Vuln IDs
V-226190
Rule IDs
SV-226190r877391_rule
Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.
Fix: F-27880r475894_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.

b
The Security event log size must be configured to 196608 KB or greater.
RMF Control
AU-4
Severity
Medium
CCI
CCI-001849
Version
WN12-CC-000085
Vuln IDs
V-226191
Rule IDs
SV-226191r877391_rule
Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.
Fix: F-27881r475897_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater.

b
The Setup event log size must be configured to 32768 KB or greater.
RMF Control
AU-4
Severity
Medium
CCI
CCI-001849
Version
WN12-CC-000086
Vuln IDs
V-226192
Rule IDs
SV-226192r877391_rule
Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.
Fix: F-27882r475900_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Setup >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.

b
The System event log size must be configured to 32768 KB or greater.
RMF Control
AU-4
Severity
Medium
CCI
CCI-001849
Version
WN12-CC-000087
Vuln IDs
V-226193
Rule IDs
SV-226193r877391_rule
Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.
Fix: F-27883r475903_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.

b
Windows SmartScreen must be enabled on Windows 2012/2012 R2.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000088
Vuln IDs
V-226194
Rule IDs
SV-226194r794440_rule
Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.
Fix: F-27884r475906_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with either "Give user a warning before running downloaded unknown software" or "Require approval from an administrator before running downloaded unknown software" selected. Microsoft has changed this setting several times in the Windows 10 administrative templates, which will affect group policies in a domain if later templates are used. v1607 of Windows 10 and Windows Server 2016 changed the setting to only Enabled or Disabled without additional selections. Enabled is effectively "Give user a warning…". v1703 of Windows 10 or later administrative templates changed the policy name to "Configure Windows Defender SmartScreen", and the selectable options are "Warn" and "Warn and prevent bypass". When either of these are applied to a Windows 2012/2012 R2 system, it will configure the registry equivalent of "Give user a warning…").

b
Explorer Data Execution Prevention must be enabled.
RMF Control
SI-16
Severity
Medium
CCI
CCI-002824
Version
WN12-CC-000089
Vuln IDs
V-226195
Rule IDs
SV-226195r852107_rule
Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.
Fix: F-27885r475909_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off Data Execution Prevention for Explorer" to "Disabled".

a
Turning off File Explorer heap termination on corruption must be disabled.
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-CC-000090
Vuln IDs
V-226196
Rule IDs
SV-226196r852108_rule
Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.
Fix: F-27886r475912_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off heap termination on corruption" to "Disabled".

b
File Explorer shell protocol must run in protected mode.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000091
Vuln IDs
V-226197
Rule IDs
SV-226197r794501_rule
The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.
Fix: F-27887r475915_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off shell protocol protected mode" to "Disabled".

b
The location feature must be turned off.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000095
Vuln IDs
V-226198
Rule IDs
SV-226198r794441_rule
The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.
Fix: F-27888r475918_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Location and Sensors -> "Turn off location" to "Enabled". If location services are approved by the organization for a device, this must be documented.

b
Passwords must not be saved in the Remote Desktop Client.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-CC-000096
Vuln IDs
V-226199
Rule IDs
SV-226199r852109_rule
Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.
Fix: F-27889r475921_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Connection Client -> "Do not allow passwords to be saved" to "Enabled".

b
Local drives must be prevented from sharing with Remote Desktop Session Hosts. (Remote Desktop Services Role).
RMF Control
SC-4
Severity
Medium
CCI
CCI-001090
Version
WN12-CC-000098
Vuln IDs
V-226200
Rule IDs
SV-226200r794456_rule
Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.
Fix: F-27890r475924_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow drive redirection" to "Enabled".

b
Remote Desktop Services must always prompt a client for passwords upon connection.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-CC-000099
Vuln IDs
V-226201
Rule IDs
SV-226201r852110_rule
This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.
Fix: F-27891r475927_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Always prompt for password upon connection" to "Enabled".

b
Remote Desktop Services must be configured with the client connection encryption set to the required level.
RMF Control
AC-17
Severity
Medium
CCI
CCI-000068
Version
WN12-CC-000100
Vuln IDs
V-226202
Rule IDs
SV-226202r877398_rule
Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.
Fix: F-27892r475930_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Set client connection encryption level" to "Enabled" and "High Level".

b
Remote Desktop Services must delete temporary folders when a session is terminated.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000103
Vuln IDs
V-226203
Rule IDs
SV-226203r794502_rule
Remote desktop session temporary folders must always be deleted after a session is over to prevent hard disk clutter and potential leakage of information. This setting controls the deletion of the temporary folders when the session is terminated.
Fix: F-27893r475933_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not delete temp folder upon exit" to "Disabled".

b
Remote Desktop Services must be configured to use session-specific temporary folders.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000104
Vuln IDs
V-226204
Rule IDs
SV-226204r794503_rule
If a communal temporary folder is used for remote desktop sessions, it might be possible for users to access other users' temporary folders. If this setting is enabled, only one temporary folder is used for all remote desktop sessions. Per session temporary folders must be established.
Fix: F-27894r475936_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not use temporary folders per session" to "Disabled".

b
Attachments must be prevented from being downloaded from RSS feeds.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000105
Vuln IDs
V-226205
Rule IDs
SV-226205r794504_rule
Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.
Fix: F-27895r475939_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Prevent downloading of enclosures" to "Enabled".

b
Basic authentication for RSS feeds over HTTP must be turned off.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000106
Vuln IDs
V-226206
Rule IDs
SV-226206r794442_rule
Basic authentication uses plain text passwords that could be used to compromise a system.
Fix: F-27896r475942_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Turn on Basic feed authentication over HTTP" to "Disabled".

b
Users must be prevented from changing installation options.
RMF Control
CM-11
Severity
Medium
CCI
CCI-001812
Version
WN12-CC-000115
Vuln IDs
V-226209
Rule IDs
SV-226209r852112_rule
Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.
Fix: F-27899r475951_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Allow user control over installs" to "Disabled".

c
The Windows Installer Always install with elevated privileges option must be disabled.
RMF Control
CM-11
Severity
High
CCI
CCI-001812
Version
WN12-CC-000116
Vuln IDs
V-226210
Rule IDs
SV-226210r852113_rule
Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.
Fix: F-27900r475954_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Always install with elevated privileges" to "Disabled".

b
Users must be notified if a web-based program attempts to install software.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-CC-000117
Vuln IDs
V-226211
Rule IDs
SV-226211r794505_rule
Users must be aware of attempted program installations. This setting ensures users are notified if a web-based program attempts to install software.
Fix: F-27901r475957_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Disabled".

a
Nonadministrators must be prevented from applying vendor-signed updates.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-CC-000118
Vuln IDs
V-226212
Rule IDs
SV-226212r852114_rule
Uncontrolled system updates can introduce issues to a system. This setting will prevent users from applying vendor-signed updates (though they may be from a trusted source).
Fix: F-27902r475960_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prohibit non-administrators from applying vendor signed updates" to "Enabled".

b
Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-CC-000120
Vuln IDs
V-226213
Rule IDs
SV-226213r794445_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This check verifies that Windows Media DRM will be prevented from accessing the Internet.
Fix: F-27903r475963_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Digital Rights Management -> "Prevent Windows Media DRM Internet Access" to "Enabled".

a
Users must not be presented with Privacy and Installation options on first use of Windows Media Player.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-CC-000121
Vuln IDs
V-226214
Rule IDs
SV-226214r794506_rule
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.
Fix: F-27904r475966_fix

If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Do Not Show First Use Dialog Boxes" to "Enabled".

b
Windows Media Player must be configured to prevent automatic checking for updates.
RMF Control
CM-11
Severity
Medium
CCI
CCI-001812
Version
WN12-CC-000122
Vuln IDs
V-226215
Rule IDs
SV-226215r852115_rule
Uncontrolled system updates can introduce issues to a system. The automatic check for updates performed by Windows Media Player must be disabled to ensure a constant platform and to prevent the introduction of unknown\untested software on the system.
Fix: F-27905r475969_fix

If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Prevent Automatic Updates" to "Enabled".

c
The Windows Remote Management (WinRM) client must not use Basic authentication.
RMF Control
MA-4
Severity
High
CCI
CCI-000877
Version
WN12-CC-000123
Vuln IDs
V-226216
Rule IDs
SV-226216r877395_rule
Basic authentication uses plain text passwords that could be used to compromise a system.
Fix: F-27906r475972_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow Basic authentication" to "Disabled".

b
The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
RMF Control
MA-4
Severity
Medium
CCI
CCI-002890
Version
WN12-CC-000124
Vuln IDs
V-226217
Rule IDs
SV-226217r877382_rule
Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.
Fix: F-27907r475975_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow unencrypted traffic" to "Disabled".

b
The Windows Remote Management (WinRM) client must not use Digest authentication.
RMF Control
MA-4
Severity
Medium
CCI
CCI-000877
Version
WN12-CC-000125
Vuln IDs
V-226218
Rule IDs
SV-226218r877395_rule
Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.
Fix: F-27908r475978_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Disallow Digest authentication" to "Enabled".

c
The Windows Remote Management (WinRM) service must not use Basic authentication.
RMF Control
MA-4
Severity
High
CCI
CCI-000877
Version
WN12-CC-000126
Vuln IDs
V-226219
Rule IDs
SV-226219r877395_rule
Basic authentication uses plain text passwords that could be used to compromise a system.
Fix: F-27909r475981_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow Basic authentication" to "Disabled".

b
The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
RMF Control
MA-4
Severity
Medium
CCI
CCI-002890
Version
WN12-CC-000127
Vuln IDs
V-226220
Rule IDs
SV-226220r877382_rule
Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.
Fix: F-27910r475984_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow unencrypted traffic" to "Disabled".

b
The Windows Remote Management (WinRM) service must not store RunAs credentials.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-CC-000128
Vuln IDs
V-226221
Rule IDs
SV-226221r852118_rule
Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.
Fix: F-27911r475987_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Disallow WinRM from storing RunAs credentials" to "Enabled".

b
The Remote Desktop Session Host must require secure RPC communications.
RMF Control
AC-17
Severity
Medium
CCI
CCI-001453
Version
WN12-CC-000130
Vuln IDs
V-226222
Rule IDs
SV-226222r877394_rule
Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.
Fix: F-27912r475990_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Require secure RPC communication" to "Enabled".

b
Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).
RMF Control
AC-17
Severity
Medium
CCI
CCI-002314
Version
WN12-CC-000132
Vuln IDs
V-226224
Rule IDs
SV-226224r852119_rule
Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.
Fix: F-27914r475996_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow COM port redirection" to "Enabled".

b
Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).
RMF Control
AC-17
Severity
Medium
CCI
CCI-002314
Version
WN12-CC-000133
Vuln IDs
V-226225
Rule IDs
SV-226225r852120_rule
Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.
Fix: F-27915r475999_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow LPT port redirection" to "Enabled".

b
The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).
RMF Control
AC-17
Severity
Medium
CCI
CCI-002314
Version
WN12-CC-000134
Vuln IDs
V-226226
Rule IDs
SV-226226r852121_rule
Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.
Fix: F-27916r476002_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow smart card device redirection" to "Disabled".

b
Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).
RMF Control
AC-17
Severity
Medium
CCI
CCI-002314
Version
WN12-CC-000135
Vuln IDs
V-226227
Rule IDs
SV-226227r852122_rule
Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.
Fix: F-27917r476005_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".

b
Windows 2012 R2 must include command line data in process creation events.
RMF Control
AU-3
Severity
Medium
CCI
CCI-000135
Version
WN12-CC-000139
Vuln IDs
V-226230
Rule IDs
SV-226230r794409_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system. Satisfies: SRG-OS-000042-GPOS-00021
Fix: F-27920r476535_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".

c
Systems must be maintained at a supported service pack level.
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
WN12-GE-000001
Vuln IDs
V-226237
Rule IDs
SV-226237r794611_rule
Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.
Fix: F-27927r476556_fix

Update the system to a supported release or service pack level.

b
The DoD Root CA certificates must be installed in the Trusted Root Store.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000185
Version
WN12-PK-000001
Vuln IDs
V-226261
Rule IDs
SV-226261r890480_rule
To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.
Fix: F-27951r890479_fix

Install the DoD Root CA certificates: DoD Root CA 3 DoD Root CA 4 DoD Root CA 5 The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.

b
The DoD Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000185
Version
WN12-PK-000003
Vuln IDs
V-226262
Rule IDs
SV-226262r890483_rule
To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.
Fix: F-27952r890482_fix

Install the DoD Interoperability Root CA cross-certificates on unclassified systems. Issued To - Issued By - Thumbprint DoD Root CA 3 - DoD Interoperability Root CA 2 - 49CBE933151872E17C8EAE7F0ABA97FB610F6477 The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.

b
The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000185
Version
WN12-PK-000004
Vuln IDs
V-226263
Rule IDs
SV-226263r894351_rule
To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.
Fix: F-27953r894347_fix

Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. Issued To - Issued By - Thumbprint DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 9B74964506C7ED9138070D08D5F8B969866560C8 The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.

c
Standard user accounts must only have Read permissions to the Winlogon registry key.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-RG-000001
Vuln IDs
V-226268
Rule IDs
SV-226268r877392_rule
Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.
Fix: F-27958r476649_fix

Maintain permissions at least as restrictive as the defaults listed below for the "WinLogon" registry key. It is recommended to not change the permissions from the defaults. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ The following are the same for each permission listed: Type - Allow Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Applies to - This key and subkeys Columns: Principal - Access TrustedInstaller - Full Control SYSTEM - Full Control Administrators - Full Control Users - Read ALL APPLICATION PACKAGES - Read

c
Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-RG-000002
Vuln IDs
V-226269
Rule IDs
SV-226269r877392_rule
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.
Fix: F-27959r476652_fix

Maintain the default permissions of the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only) Users - Read Administrators - Full Control SYSTEM - Full Control CREATOR OWNER - Full Control (Subkeys only) ALL APPLICATION PACKAGES - Read

c
Anonymous access to the registry must be restricted.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-RG-000004
Vuln IDs
V-226270
Rule IDs
SV-226270r877392_rule
The registry is integral to the function, security, and stability of the Windows system. Some processes may require anonymous access to the registry. This must be limited to properly protect the system.
Fix: F-27960r476655_fix

Maintain permissions at least as restrictive as the defaults listed below for the "winreg" registry key. It is recommended to not change the permissions from the defaults. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ The following are the same for each permission listed: Type - Allow Inherited from - None Columns: Principal - Access - Applies to Administrators - Full Control - This key and subkeys Backup Operators - Read - This key only LOCAL SERVICE - Read - This key and subkeys

b
The built-in guest account must be disabled.
RMF Control
IA-8
Severity
Medium
CCI
CCI-000804
Version
WN12-SO-000003
Vuln IDs
V-226271
Rule IDs
SV-226271r794540_rule
A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.
Fix: F-27961r476658_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Guest account status" to "Disabled".

c
Local accounts with blank passwords must be restricted to prevent access from the network.
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
WN12-SO-000004
Vuln IDs
V-226272
Rule IDs
SV-226272r794580_rule
An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.
Fix: F-27962r476661_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".

b
The built-in administrator account must be renamed.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000005
Vuln IDs
V-226273
Rule IDs
SV-226273r794581_rule
The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.
Fix: F-27963r476664_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename administrator account" to a name other than "Administrator".

b
The built-in guest account must be renamed.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000006
Vuln IDs
V-226274
Rule IDs
SV-226274r794582_rule
The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.
Fix: F-27964r476667_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename guest account" to a name other than "Guest".

b
Auditing the Access of Global System Objects must be turned off.
RMF Control
SC-5
Severity
Medium
CCI
CCI-001095
Version
WN12-SO-000007
Vuln IDs
V-226275
Rule IDs
SV-226275r794551_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.
Fix: F-27965r476670_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".

b
Auditing of Backup and Restore Privileges must be turned off.
RMF Control
SC-5
Severity
Medium
CCI
CCI-001095
Version
WN12-SO-000008
Vuln IDs
V-226276
Rule IDs
SV-226276r794552_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.
Fix: F-27966r476673_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the use of Backup and Restore privilege" to "Disabled".

b
Audit policy using subcategories must be enabled.
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
WN12-SO-000009
Vuln IDs
V-226277
Rule IDs
SV-226277r794513_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting allows administrators to enable more precise auditing capabilities.
Fix: F-27967r476676_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".

b
Ejection of removable NTFS media must be restricted to Administrators.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000011
Vuln IDs
V-226278
Rule IDs
SV-226278r794583_rule
Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.
Fix: F-27968r476679_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Allowed to format and eject removable media" to "Administrators".

b
Outgoing secure channel traffic must be encrypted or signed.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000012
Vuln IDs
V-226279
Rule IDs
SV-226279r852134_rule
Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.
Fix: F-27969r476682_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".

b
Outgoing secure channel traffic must be encrypted when possible.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000013
Vuln IDs
V-226280
Rule IDs
SV-226280r852135_rule
Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.
Fix: F-27970r476685_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".

b
Outgoing secure channel traffic must be signed when possible.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000014
Vuln IDs
V-226281
Rule IDs
SV-226281r852136_rule
Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.
Fix: F-27971r476688_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".

a
The computer account password must not be prevented from being reset.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000015
Vuln IDs
V-226282
Rule IDs
SV-226282r794584_rule
Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.
Fix: F-27972r476691_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Disable machine account password changes" to "Disabled".

a
The maximum age for machine account passwords must be set to requirements.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000016
Vuln IDs
V-226283
Rule IDs
SV-226283r794585_rule
Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.
Fix: F-27973r476694_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Maximum machine account password age" to "30" or less (excluding "0" which is unacceptable).

b
The system must be configured to require a strong session key.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000017
Vuln IDs
V-226284
Rule IDs
SV-226284r852137_rule
A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.
Fix: F-27974r476697_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".

a
The system must be configured to prevent the display of the last username on the logon screen.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000018
Vuln IDs
V-226285
Rule IDs
SV-226285r794586_rule
Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.
Fix: F-27975r476700_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Do not display last user name" to "Enabled".

b
The Ctrl+Alt+Del security attention sequence for logons must be enabled.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000019
Vuln IDs
V-226286
Rule IDs
SV-226286r794587_rule
Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.
Fix: F-27976r476703_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Do not require CTRL+ALT+DEL" to "Disabled".

b
The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
RMF Control
AC-11
Severity
Medium
CCI
CCI-000057
Version
WN12-SO-000021
Vuln IDs
V-226287
Rule IDs
SV-226287r794511_rule
Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.
Fix: F-27977r476706_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.

a
Caching of logon credentials must be limited.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000024
Vuln IDs
V-226290
Rule IDs
SV-226290r794588_rule
The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.
Fix: F-27980r476715_fix

If the system is not a member of a domain, this is NA. Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.

a
Users must be warned in advance of their passwords expiring.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000025
Vuln IDs
V-226291
Rule IDs
SV-226291r794589_rule
Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.
Fix: F-27981r476718_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Prompt user to change password before expiration" to "14" days or more.

b
The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000027
Vuln IDs
V-226292
Rule IDs
SV-226292r794590_rule
Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.
Fix: F-27982r476721_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".

b
The Windows SMB client must be configured to always perform SMB packet signing.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000028
Vuln IDs
V-226293
Rule IDs
SV-226293r852138_rule
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.
Fix: F-27983r476724_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (always)" to "Enabled".

b
The Windows SMB client must be enabled to perform SMB packet signing when possible.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000029
Vuln IDs
V-226294
Rule IDs
SV-226294r852139_rule
The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.
Fix: F-27984r476727_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".

b
Unencrypted passwords must not be sent to third-party SMB Servers.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000197
Version
WN12-SO-000030
Vuln IDs
V-226295
Rule IDs
SV-226295r877396_rule
Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.
Fix: F-27985r476730_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".

a
The amount of idle time required before suspending a session must be properly set.
RMF Control
SC-10
Severity
Low
CCI
CCI-001133
Version
WN12-SO-000031
Vuln IDs
V-226296
Rule IDs
SV-226296r852140_rule
Open sessions can increase the avenues of attack on a system. This setting is used to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. This protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.
Fix: F-27986r476733_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Server: Amount of idle time required before suspending session" to "15" minutes or less.

b
The Windows SMB server must be configured to always perform SMB packet signing.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000032
Vuln IDs
V-226297
Rule IDs
SV-226297r852141_rule
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.
Fix: F-27987r476736_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (always)" to "Enabled".

b
The Windows SMB server must perform SMB packet signing when possible.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000033
Vuln IDs
V-226298
Rule IDs
SV-226298r852142_rule
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.
Fix: F-27988r476739_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".

a
Users must be forcibly disconnected when their logon hours expire.
RMF Control
SC-10
Severity
Low
CCI
CCI-001133
Version
WN12-SO-000034
Vuln IDs
V-226299
Rule IDs
SV-226299r794609_rule
Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.
Fix: F-27989r476742_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Disconnect clients when logon hours expire" to "Enabled".

b
The service principal name (SPN) target name validation level must be turned off.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000035
Vuln IDs
V-226300
Rule IDs
SV-226300r794591_rule
If a service principle name (SPN) is provided by the client, it is validated against the server's list of SPNs. Implementation may disrupt file and print sharing capabilities.
Fix: F-27990r476745_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Server SPN target name validation level" to "Off".

b
Automatic logons must be disabled.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000036
Vuln IDs
V-226301
Rule IDs
SV-226301r794593_rule
Allowing a system to automatically log on when the machine is booted could give access to any unauthorized individual who restarts the computer. Automatic logon with administrator privileges would give full access to an unauthorized individual.
Fix: F-27991r794592_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" to "Disabled". Ensure no passwords are stored in the "DefaultPassword" registry value noted below: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: DefaultPassword (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.) Severity Override Guidance: If the DefaultName or DefaultDomainName in the same registry path contain an administrator account name and the DefaultPassword contains a value, this is a CAT I finding.

a
IPv6 source routing must be configured to the highest protection level.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000037
Vuln IDs
V-226302
Rule IDs
SV-226302r794594_rule
Configuring the system to disable IPv6 source routing protects against spoofing.
Fix: F-27992r476751_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to prevent IP source routing.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000038
Vuln IDs
V-226303
Rule IDs
SV-226303r794595_rule
Configuring the system to disable IP source routing protects against spoofing.
Fix: F-27993r476754_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000039
Vuln IDs
V-226304
Rule IDs
SV-226304r794596_rule
Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.
Fix: F-27994r476757_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to limit how often keep-alive packets are sent.
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-SO-000041
Vuln IDs
V-226305
Rule IDs
SV-226305r852143_rule
This setting controls how often TCP sends a keep-alive packet in attempting to verify that an idle connection is still intact. A higher value could allow an attacker to cause a denial of service with numerous connections.
Fix: F-27995r476760_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds" to "300000 or 5 minutes (recommended)" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
IPSec Exemptions must be limited.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000042
Vuln IDs
V-226306
Rule IDs
SV-226306r794597_rule
IPSec exemption filters allow specific traffic that may be needed by the system for such things as Kerberos authentication. This setting configures Windows for specific IPSec exemptions.
Fix: F-27996r476763_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic" to "Only ISAKMP is exempt (recommended for Windows Server 2003)". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to ignore NetBIOS name release requests except from WINS servers.
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-SO-000043
Vuln IDs
V-226307
Rule IDs
SV-226307r852144_rule
Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.
Fix: F-27997r476766_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to disable the Internet Router Discovery Protocol (IRDP).
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-SO-000044
Vuln IDs
V-226308
Rule IDs
SV-226308r852145_rule
The Internet Router Discovery Protocol (IRDP) is used to detect and configure default gateway addresses on the computer. If a router is impersonated on a network, traffic could be routed through the compromised system.
Fix: F-27998r476769_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)" to "Disabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

b
The system must be configured to use Safe DLL Search Mode.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000045
Vuln IDs
V-226309
Rule IDs
SV-226309r794598_rule
The default search behavior, when an application calls a function in a Dynamic Link Library (DLL), is to search the current directory, followed by the directories contained in the system's path environment variable. An unauthorized DLL, inserted into an application's working directory, could allow malicious code to be run on the system. Setting this policy value forces the system to search the %Systemroot% for the DLL before searching the current directory or the rest of the path.
Fix: F-27999r476772_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)" to "Enabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must be configured to have password protection take effect within a limited time frame when the screen saver becomes active.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000046
Vuln IDs
V-226310
Rule IDs
SV-226310r794599_rule
Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log on to the system before the lock takes effect.
Fix: F-28000r476775_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)" to "5" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-SO-000047
Vuln IDs
V-226311
Rule IDs
SV-226311r852146_rule
Configuring Windows to limit the number of times that IPv6 TCP retransmits unacknowledged data segments before aborting the attempt helps prevent resources from becoming exhausted.
Fix: F-28001r476778_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must limit how many times unacknowledged TCP data is retransmitted.
RMF Control
SC-5
Severity
Low
CCI
CCI-002385
Version
WN12-SO-000048
Vuln IDs
V-226312
Rule IDs
SV-226312r852147_rule
In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.
Fix: F-28002r476781_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

a
The system must generate an audit event when the audit log reaches a percentage of full threshold.
RMF Control
AU-5
Severity
Low
CCI
CCI-000139
Version
WN12-SO-000049
Vuln IDs
V-226313
Rule IDs
SV-226313r852148_rule
When the audit log reaches a given percent full, an audit event is written to the security log. It is recorded as a successful audit event under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.
Fix: F-28003r476784_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning" to "90" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)

c
Anonymous enumeration of SAM accounts must not be allowed.
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
WN12-SO-000051
Vuln IDs
V-226315
Rule IDs
SV-226315r794601_rule
Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.
Fix: F-28005r476790_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".

c
Anonymous enumeration of shares must be restricted.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000052
Vuln IDs
V-226316
Rule IDs
SV-226316r794544_rule
Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.
Fix: F-28006r476793_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".

b
The system must be configured to prevent anonymous users from having the same rights as the Everyone group.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000054
Vuln IDs
V-226317
Rule IDs
SV-226317r794602_rule
Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.
Fix: F-28007r476796_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".

c
Named pipes that can be accessed anonymously must be configured with limited values on domain controllers.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000055-DC
Vuln IDs
V-226318
Rule IDs
SV-226318r794545_rule
Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.
Fix: F-28008r476799_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Named pipes that can be accessed anonymously" to only include "netlogon, samr, lsarpc".

c
Unauthorized remotely accessible registry paths must not be configured.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000056
Vuln IDs
V-226319
Rule IDs
SV-226319r794546_rule
The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.
Fix: F-28009r476802_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths" with the following entries: System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion

c
Unauthorized remotely accessible registry paths and sub-paths must not be configured.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000057
Vuln IDs
V-226320
Rule IDs
SV-226320r794547_rule
The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths and sub-paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.
Fix: F-28010r476805_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths and sub-paths" with the following entries: Software\Microsoft\OLAP Server Software\Microsoft\Windows NT\CurrentVersion\Perflib Software\Microsoft\Windows NT\CurrentVersion\Print Software\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration System\CurrentControlSet\Services\Eventlog System\CurrentControlSet\Services\Sysmonlog

c
Anonymous access to Named Pipes and Shares must be restricted.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000058
Vuln IDs
V-226321
Rule IDs
SV-226321r794548_rule
Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.
Fix: F-28011r476808_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".

c
Network shares that can be accessed anonymously must not be allowed.
RMF Control
SC-4
Severity
High
CCI
CCI-001090
Version
WN12-SO-000059
Vuln IDs
V-226322
Rule IDs
SV-226322r794549_rule
Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.
Fix: F-28012r476811_fix

Ensure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Shares that can be accessed anonymously" contains no entries (blank).

b
The system must be configured to use the Classic security model.
RMF Control
SC-4
Severity
Medium
CCI
CCI-001090
Version
WN12-SO-000060
Vuln IDs
V-226323
Rule IDs
SV-226323r794550_rule
Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.
Fix: F-28013r476814_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Sharing and security model for local accounts" to "Classic - local users authenticate as themselves".

b
Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.
RMF Control
IA-3
Severity
Medium
CCI
CCI-000778
Version
WN12-SO-000061
Vuln IDs
V-226324
Rule IDs
SV-226324r794537_rule
Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.
Fix: F-28014r476817_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".

b
NTLM must be prevented from falling back to a Null session.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000062
Vuln IDs
V-226325
Rule IDs
SV-226325r794603_rule
NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.
Fix: F-28015r476820_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".

b
PKU2U authentication using online identities must be prevented.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000063
Vuln IDs
V-226326
Rule IDs
SV-226326r794604_rule
PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.
Fix: F-28016r476823_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".

b
Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
WN12-SO-000064
Vuln IDs
V-226327
Rule IDs
SV-226327r794539_rule
Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.
Fix: F-28017r476826_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: AES128_HMAC_SHA1 AES256_HMAC_SHA1 Future encryption types Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.

c
The system must be configured to prevent the storage of the LAN Manager hash of passwords.
RMF Control
IA-5
Severity
High
CCI
CCI-000196
Version
WN12-SO-000065
Vuln IDs
V-226328
Rule IDs
SV-226328r877397_rule
The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.
Fix: F-28018r476829_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".

b
The system must be configured to force users to log off when their allowed logon hours expire.
RMF Control
SC-10
Severity
Medium
CCI
CCI-001133
Version
WN12-SO-000066
Vuln IDs
V-226329
Rule IDs
SV-226329r794610_rule
Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.
Fix: F-28019r476832_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Force logoff when logon hours expire" to "Enabled".

c
The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
WN12-SO-000067
Vuln IDs
V-226330
Rule IDs
SV-226330r794605_rule
The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.
Fix: F-28020r476835_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".

b
The system must be configured to the required LDAP client signing level.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000068
Vuln IDs
V-226331
Rule IDs
SV-226331r794606_rule
This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.
Fix: F-28021r476838_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.

b
The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000069
Vuln IDs
V-226332
Rule IDs
SV-226332r794678_rule
Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.
Fix: F-28022r476841_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).

b
The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000070
Vuln IDs
V-226333
Rule IDs
SV-226333r794679_rule
Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.
Fix: F-28023r476844_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).

a
The shutdown option must not be available from the logon dialog box.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000073
Vuln IDs
V-226334
Rule IDs
SV-226334r794680_rule
Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.
Fix: F-28024r476847_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Shutdown: Allow system to be shutdown without having to log on" to "Disabled".

b
The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
RMF Control
SC-13
Severity
Medium
CCI
CCI-002450
Version
WN12-SO-000074
Vuln IDs
V-226335
Rule IDs
SV-226335r877380_rule
This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.
Fix: F-28025r476850_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".

b
The system must be configured to require case insensitivity for non-Windows subsystems.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SO-000075
Vuln IDs
V-226336
Rule IDs
SV-226336r794681_rule
This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.
Fix: F-28026r476853_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Require case insensitivity for non-Windows subsystems" to "Enabled".

a
The default permissions of global system objects must be increased.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000076
Vuln IDs
V-226337
Rule IDs
SV-226337r794682_rule
Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.
Fix: F-28027r476856_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)" to "Enabled".

b
User Account Control approval mode for the built-in Administrator must be enabled.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-SO-000077
Vuln IDs
V-226338
Rule IDs
SV-226338r852150_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. Satisfies: SRG-OS-000373-GPOS-00158
Fix: F-28028r476859_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".

b
User Account Control must, at minimum, prompt administrators for consent.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000078
Vuln IDs
V-226339
Rule IDs
SV-226339r794642_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.
Fix: F-28029r476862_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent". More secure options for this setting would also be acceptable (e.g., Prompt for credentials, Prompt for consent (or credentials) on the secure desktop).

b
User Account Control must automatically deny standard user requests for elevation.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-SO-000079
Vuln IDs
V-226340
Rule IDs
SV-226340r852151_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. Satisfies: SRG-OS-000373-GPOS-00158
Fix: F-28030r476865_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".

b
User Account Control must be configured to detect application installations and prompt for elevation.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000080
Vuln IDs
V-226341
Rule IDs
SV-226341r794643_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.
Fix: F-28031r476868_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".

b
Windows must elevate all applications in User Account Control, not just signed ones.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000081
Vuln IDs
V-226342
Rule IDs
SV-226342r794644_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures whether Windows elevates all applications, or only signed ones.
Fix: F-28032r476871_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate executables that are signed and validated" to "Disabled".

b
User Account Control must only elevate UIAccess applications that are installed in secure locations.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000082
Vuln IDs
V-226343
Rule IDs
SV-226343r794645_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.
Fix: F-28033r476874_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".

b
User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
RMF Control
IA-11
Severity
Medium
CCI
CCI-002038
Version
WN12-SO-000083
Vuln IDs
V-226344
Rule IDs
SV-226344r852152_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. Satisfies: SRG-OS-000373-GPOS-00158
Fix: F-28034r476877_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".

b
User Account Control must switch to the secure desktop when prompting for elevation.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000084
Vuln IDs
V-226345
Rule IDs
SV-226345r794646_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode.
Fix: F-28035r476880_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Switch to the secure desktop when prompting for elevation" to "Enabled".

b
User Account Control must virtualize file and registry write failures to per-user locations.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000085
Vuln IDs
V-226346
Rule IDs
SV-226346r794647_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.
Fix: F-28036r476883_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".

b
UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
WN12-SO-000086
Vuln IDs
V-226347
Rule IDs
SV-226347r794648_rule
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.
Fix: F-28037r476886_fix

UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".

a
Optional Subsystems must not be permitted to operate on the system.
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
WN12-SO-000088
Vuln IDs
V-226348
Rule IDs
SV-226348r794632_rule
The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.
Fix: F-28038r476889_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System settings: Optional subsystems" to "Blank" (Configured with no entries).

a
The print driver installation privilege must be restricted to administrators.
RMF Control
CM-11
Severity
Low
CCI
CCI-001812
Version
WN12-SO-000089
Vuln IDs
V-226349
Rule IDs
SV-226349r852153_rule
Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.
Fix: F-28039r476892_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Prevent users from installing printer drivers" to "Enabled".

b
Domain controllers must require LDAP access signing.
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
WN12-SO-000090-DC
Vuln IDs
V-226350
Rule IDs
SV-226350r852154_rule
Unsigned network traffic is susceptible to man in the middle attacks where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. You can lower the risk of an attacker pulling this off in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPSec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man in the middle attacks extremely difficult.
Fix: F-28040r476895_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain controller: LDAP server signing requirements" to "Require signing".

a
Domain controllers must be configured to allow reset of machine account passwords.
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
WN12-SO-000091-DC
Vuln IDs
V-226351
Rule IDs
SV-226351r794683_rule
Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.
Fix: F-28041r476898_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain controller: Refuse machine account password changes" to "Disabled".

b
Users must be required to enter a password to access private keys stored on the computer.
RMF Control
IA-5
Severity
Medium
CCI
CCI-000186
Version
WN12-SO-000092
Vuln IDs
V-226352
Rule IDs
SV-226352r794622_rule
If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
Fix: F-28042r476901_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".

b
The Fax service must be disabled if installed.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-SV-000100
Vuln IDs
V-226353
Rule IDs
SV-226353r794633_rule
Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.
Fix: F-28043r476904_fix

Remove or disable the Fax (fax) service.

b
The Microsoft FTP service must not be installed unless required.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
WN12-SV-000101
Vuln IDs
V-226354
Rule IDs
SV-226354r794640_rule
Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.
Fix: F-28044r476907_fix

Remove or disable the "Microsoft FTP Service" (Service name: FTPSVC). To remove the "FTP Server" role from a system: Start "Server Manager" Select the server with the "FTP Server" role. Scroll down to "ROLES AND FEATURES" in the left pane. Select "Remove Roles and Features" from the drop down "TASKS" list. Select the appropriate server on the "Server Selection" page, click "Next". De-select "FTP Server" under "Web Server (IIS). Click "Next" and "Remove" as prompted.

b
The Peer Networking Identity Manager service must be disabled if installed.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-SV-000103
Vuln IDs
V-226355
Rule IDs
SV-226355r794634_rule
Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.
Fix: F-28045r476910_fix

Remove or disable the Peer Networking Identity Manager (p2pimsvc) service.

b
The Simple TCP/IP Services service must be disabled if installed.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
WN12-SV-000104
Vuln IDs
V-226356
Rule IDs
SV-226356r794635_rule
Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.
Fix: F-28046r476913_fix

Remove or disable the Simple TCP/IP Services (simptcp) service.

b
The Telnet service must be disabled if installed.
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
WN12-SV-000105
Vuln IDs
V-226357
Rule IDs
SV-226357r794641_rule
Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.
Fix: F-28047r476916_fix

Remove or disable the Telnet (tlntsvr) service.

b
The Smart Card Removal Policy service must be configured to automatic.
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
WN12-SV-000106
Vuln IDs
V-226358
Rule IDs
SV-226358r794684_rule
The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.
Fix: F-28048r476919_fix

Configure the Startup Type for the Smart Card Removal Policy service to "Automatic".

b
The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000001
Vuln IDs
V-226370
Rule IDs
SV-226370r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.
Fix: F-28060r476955_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).

b
Unauthorized accounts must not have the Access this computer from the network user right on domain controllers.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000002-DC
Vuln IDs
V-226371
Rule IDs
SV-226371r794624_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Access this computer from the network" right may access resources on the system and should be limited to those requiring it.
Fix: F-28061r794623_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Access this computer from the network" to only include the following accounts or groups: Administrators Authenticated Users Enterprise Domain Controllers Severity Override Guidance: If an application requires this user right, this can be downgraded to not a finding if the following conditions are met: - Vendor documentation must support the requirement for having the user right. - The requirement must be documented with the ISSO. - The application account must meet requirements for application account passwords, such as length (V-36661) and required changes frequency (V-36662).

c
The Act as part of the operating system user right must not be assigned to any groups or accounts.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-UR-000003
Vuln IDs
V-226372
Rule IDs
SV-226372r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.
Fix: F-28062r476961_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).

b
The Allow log on locally user right must only be assigned to the Administrators group.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000005
Vuln IDs
V-226373
Rule IDs
SV-226373r794625_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Allow log on locally" user right can log on interactively to a system.
Fix: F-28063r476964_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to only include the following accounts or groups: Administrators

b
The Back up files and directories user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000007
Vuln IDs
V-226374
Rule IDs
SV-226374r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.
Fix: F-28065r476969_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to only include the following accounts or groups: Administrators

b
The Create a pagefile user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000011
Vuln IDs
V-226375
Rule IDs
SV-226375r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.
Fix: F-28066r476972_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to only include the following accounts or groups: Administrators

c
The Create a token object user right must not be assigned to any groups or accounts.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-UR-000012
Vuln IDs
V-226376
Rule IDs
SV-226376r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.
Fix: F-28067r476975_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).

b
The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000013
Vuln IDs
V-226377
Rule IDs
SV-226377r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.
Fix: F-28068r476978_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to only include the following accounts or groups: Administrators Service Local Service Network Service

b
The Create permanent shared objects user right must not be assigned to any groups or accounts.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000014
Vuln IDs
V-226378
Rule IDs
SV-226378r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.
Fix: F-28069r476981_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).

b
The Create symbolic links user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000015
Vuln IDs
V-226379
Rule IDs
SV-226379r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.
Fix: F-28070r476984_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to only include the following accounts or groups: Administrators Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines".

c
The Debug programs user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
High
CCI
CCI-002235
Version
WN12-UR-000016
Vuln IDs
V-226380
Rule IDs
SV-226380r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.
Fix: F-28071r476987_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following accounts or groups: Administrators

b
The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000017-DC
Vuln IDs
V-226381
Rule IDs
SV-226381r794626_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. The Guests group must be assigned this right to prevent unauthenticated access.
Fix: F-28072r476990_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny access to this computer from the network" to include the following: Guests Group

b
The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000018-DC
Vuln IDs
V-226382
Rule IDs
SV-226382r794627_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. The Guests group must be assigned to prevent unauthenticated access.
Fix: F-28073r476993_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a batch job" to include the following: Guests Group

b
The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000019-DC
Vuln IDs
V-226383
Rule IDs
SV-226383r794628_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on as a service" user right defines accounts that are denied log on as a service. Incorrect configurations could prevent services from starting and result in a DoS.
Fix: F-28074r476996_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a service" to include no entries (blank).

b
The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000020-DC
Vuln IDs
V-226384
Rule IDs
SV-226384r794629_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. The Guests group must be assigned this right to prevent unauthenticated access.
Fix: F-28075r476999_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on locally" to include the following: Guests Group

b
The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000021-DC
Vuln IDs
V-226385
Rule IDs
SV-226385r794630_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. The Guests group must be assigned this right to prevent unauthenticated access.
Fix: F-28076r477002_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on through Remote Desktop Services" to include the following: Guests Group

b
Unauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on domain controllers.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000022-DC
Vuln IDs
V-226386
Rule IDs
SV-226386r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.
Fix: F-28077r477005_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Enable computer and user accounts to be trusted for delegation" to only include the following accounts or groups: Administrators

b
The Force shutdown from a remote system user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000023
Vuln IDs
V-226387
Rule IDs
SV-226387r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a DoS.
Fix: F-28078r477008_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following accounts or groups: Administrators

b
The Generate security audits user right must only be assigned to Local Service and Network Service.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000024
Vuln IDs
V-226388
Rule IDs
SV-226388r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.
Fix: F-28079r477011_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to only include the following accounts or groups: Local Service Network Service

b
The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000025
Vuln IDs
V-226389
Rule IDs
SV-226389r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.
Fix: F-28080r477014_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to only include the following accounts or groups: Administrators Service Local Service Network Service

b
The Increase scheduling priority user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000027
Vuln IDs
V-226390
Rule IDs
SV-226390r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.
Fix: F-28081r477017_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to only include the following accounts or groups: Administrators

b
The Load and unload device drivers user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000028
Vuln IDs
V-226391
Rule IDs
SV-226391r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.
Fix: F-28082r477020_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to only include the following accounts or groups: Administrators

b
The Lock pages in memory user right must not be assigned to any groups or accounts.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000029
Vuln IDs
V-226392
Rule IDs
SV-226392r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.
Fix: F-28083r477023_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).

b
The Manage auditing and security log user right must only be assigned to the Administrators group.
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
WN12-UR-000032
Vuln IDs
V-226393
Rule IDs
SV-226393r852172_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.
Fix: F-28084r477026_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to only include the following accounts or groups: Administrators

b
The Modify firmware environment values user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000034
Vuln IDs
V-226394
Rule IDs
SV-226394r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.
Fix: F-28085r477029_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to only include the following accounts or groups: Administrators

b
The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000035
Vuln IDs
V-226395
Rule IDs
SV-226395r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in data loss or a DoS.
Fix: F-28086r477032_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to only include the following accounts or groups: Administrators

b
The Profile single process user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000036
Vuln IDs
V-226396
Rule IDs
SV-226396r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Profile single process" user right can monitor nonsystem processes performance. An attacker could potentially use this to identify processes to attack.
Fix: F-28087r477035_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to only include the following accounts or groups: Administrators

b
The Restore files and directories user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000040
Vuln IDs
V-226397
Rule IDs
SV-226397r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.
Fix: F-28088r477038_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to only include the following accounts or groups: Administrators

b
The Take ownership of files or other objects user right must only be assigned to the Administrators group.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000042
Vuln IDs
V-226398
Rule IDs
SV-226398r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.
Fix: F-28089r477041_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to only include the following accounts or groups: Administrators

b
Unauthorized accounts must not have the Add workstations to domain user right.
RMF Control
AC-6
Severity
Medium
CCI
CCI-002235
Version
WN12-UR-000044-DC
Vuln IDs
V-226399
Rule IDs
SV-226399r877392_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.
Fix: F-28090r477044_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Add workstations to domain" to only include the following accounts or groups: Administrators

b
The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
WN12-UR-000006-DC
Vuln IDs
V-226400
Rule IDs
SV-226400r794631_rule
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.
Fix: F-28092r477050_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to only include the following accounts or groups: Administrators