Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide

Checks: C-32862r1_chk

Interview the SA to determine if equipment is located in an access controlled area. Servers will be located in rooms, or locked cabinets, that are accessible only to authorized systems personnel. Authorized user access should be verified at two points (i.e. building access and server room).

Fix: F-31r1_fix

Relocate equipment to a controlled access area.

Generate Mitigation Statement:

Checks: C-78955r2_chk

Determine whether any shared accounts exist. If no shared accounts exist, this is NA. Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. If unapproved shared accounts exist, this is a finding.

Fix: F-86113r1_fix

Remove unapproved shared accounts from the system. Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

Generate Mitigation Statement:

Checks: C-62251r3_chk

Verify the permissions on the event logs. Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. Navigate to the log file location. The default location is the "%SystemRoot%\System32\winevt\Logs" directory. For each log file below, right click the file and select "Properties". Select the "Security" tab. Select the "Advanced" button. Log Files: Application.evtx Security.evtx System.evtx Permissions: Eventlog - Full Control SYSTEM - Full Control Administrators - Full Control If the permissions for the file are not as restrictive as those listed, this is a finding. If the organization has an "Auditors" group from previous requirements, the assignment of Full Control permissions to this group would not be a finding.

Fix: F-67167r2_fix

Maintain the permissions on the event logs. Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. Navigate to the log file location. The default location is the "%SystemRoot%\System32\winevt\Logs" directory. For each log file below, right click the file and select "Properties". Select the "Security" tab. Select the "Advanced" button. Log Files: Application.evtx Security.evtx System.evtx Permissions: Eventlog - Full Control SYSTEM - Full Control Administrators - Full Control If the organization has an "Auditors" group from previous requirements, this group may be assigned Full Control. If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".

Generate Mitigation Statement:

Checks: C-60967r3_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies >> Security Options. If the value for "Interactive Logon: Message text for users attempting to log on" is not set to the following, this is a finding. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeText Value Type: REG_SZ Value: See message text above

Fix: F-65699r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Generate Mitigation Statement:

Checks: C-60969r2_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Account Lockout Policy. If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.

Fix: F-65701r3_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0", which is unacceptable).

Generate Mitigation Statement:

Checks: C-74335r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Account Lockout Policy. If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.

Fix: F-81007r1_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.

Generate Mitigation Statement:

Checks: C-74333r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Account Lockout Policy. If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.

Fix: F-81005r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. A value of "0" is also acceptable, requiring an administrator to unlock the account.

Generate Mitigation Statement:

Checks: C-60977r2_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.

Fix: F-65707r3_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum password age" to "60" days or less (excluding "0", which is unacceptable).

Generate Mitigation Statement:

Checks: C-60979r2_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Password Policy. If the value for the "Minimum password age" is not at least "1" day, this is a finding.

Fix: F-65709r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password age" to at least "1" day.

Generate Mitigation Statement:

Checks: C-60981r3_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Password Policy. If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.

Fix: F-65711r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.

Generate Mitigation Statement:

Checks: C-60985r2_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies >> Security Options. If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding.

Fix: F-65715r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled".

Generate Mitigation Statement:

Checks: C-403r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Accounts: Rename guest account” is not set to a value other than “Guest”, then this is a finding.

Fix: F-28806r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Accounts: Rename guest account” to a value other than “Guest”.

Generate Mitigation Statement:

Checks: C-411r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Accounts: Rename administrator account” is not set to a value other than “Administrator”, then this is a finding.

Fix: F-28807r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Accounts: Rename administrator account” to a value other than “Administrator”.

Generate Mitigation Statement:

Checks: C-32850r1_chk

Open the Control. Panel Double-click on the “System” applet. Click on the “Advanced System Settings” link. Click the Startup and Recovery “Settings” button. If the drop-down listbox in System Startup shows any operating system other than the current Windows OS, this may be a finding. If all additional operating systems are STIG compliant, then this is not a finding.

Fix: F-28961r1_fix

Remove any non STIG compliant alternate operating systems.

Generate Mitigation Statement:

Checks: C-74337r2_chk

If FTP is not installed on the system, this is NA. Determine the IP address and port number assigned to FTP sites from documentation or configuration. If Microsoft FTP is used, open "Internet Information Services (IIS) Manager". Select "Sites" under the server name. For any sites that reference FTP, view the Binding information for IP address and port. The standard port for FTP is 21, however this may be changed. Open a "Command Prompt". Attempt to log on as the user "anonymous" with the following commands: Note: Returned results may vary depending on the FTP server software. C:\> "ftp" ftp> "Open IP Address Port" (Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) (Connected to IP Address 220 Microsoft FTP Service) User (IP Address): "anonymous" (331 Anonymous access allowed, send identity (e-mail name) as password.) Password: "password" (230 User logged in.) ftp> If the response indicates that an anonymous FTP login was permitted, this is a finding. If accounts with administrator privileges are used to access FTP, this is a CAT I finding.

Fix: F-81009r1_fix

Configure the FTP service to prevent anonymous logons.

Generate Mitigation Statement:

Checks: C-32919r1_chk

If any of the registry values don’t exist or are not configured as follows, then this is a finding: Registry Hive: HKEY_CURRENT_USER Subkey: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ Value Name: ScreenSaveActive Type: REG_SZ Value: 1 Value Name: ScreenSaverIsSecure Type: REG_SZ Value: 1 Value Name: ScreenSaveTimeOut Type: REG_SZ Value: 900 (or less) Documentable Explanation: Terminal servers and applications requiring continuous, real-time screen display (i.e., network management products) require the following and need to be documented with the IAO. -The logon session does not have administrator rights. -The display station (i.e., keyboard, monitor, etc.) is located in a controlled access area.

Fix: F-28808r1_fix

Configure the policy values for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> as follows: “Enable Screen Saver” will be set to “Enabled”. “Password protect the screen saver” will be set to “Enabled”. “Screen Saver timeout” will be set to “Enabled: 900 seconds” (or less).

Generate Mitigation Statement:

Checks: C-32815r1_chk

The default ACL settings are adequate when the Security Option “Network access: Let everyone permissions apply to anonymous users” is set to “Disabled” (V-3377). If the default ACLs are maintained and the referenced option is set to “Disabled”, this check should normally be marked “Not a Finding”. Note: If an ACL setting prevents a site’s applications from performing properly, the site can modify that specific setting. Settings should only be changed to the minimum necessary for the application to function. Each exception to the recommended settings should be documented and kept on file by the IAO.

Fix: F-28932r1_fix

Maintain the default file ACLs and configure the Security Option: “Network access: Let everyone permissions apply to anonymous users” to “Disabled” (V-3377).

Generate Mitigation Statement:

Checks: C-62029r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies >> Security Options. If the value for "Microsoft Network Client: Send unencrypted password to third-party SMB servers" is not set to "Disabled", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnablePlainTextPassword Value Type: REG_DWORD Value: 0

Fix: F-66927r1_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".

Generate Mitigation Statement:

Checks: C-45836r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" is not set to "Disabled", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: AutoAdminLogon Type: REG_SZ Value: 0

Fix: F-43227r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" to "Disabled". Ensure no passwords are stored in the "DefaultPassword" registry value noted below. Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: DefaultPassword

Generate Mitigation Statement:

Checks: C-66215r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies >> Password Policy. If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.

Fix: F-71581r1_fix

Configure the policy value for Computer Configuration -> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".

Generate Mitigation Statement:

Checks: C-88r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Interactive Logon: Do not require CTRL+ALT+DEL” is not set to “Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableCAD Value Type: REG_DWORD Value: 0

Fix: F-92r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Interactive Logon: Do not require CTRL ALT DEL” to “Disabled”.

Generate Mitigation Statement:

Checks: C-44727r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> User Rights Assignment. If the following accounts or groups are not defined for the "Deny access to this computer from the network" right, this is a finding: Guests Group

Fix: F-41027r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny access to this computer from the network" to include the following. Guests Group

Generate Mitigation Statement:

Checks: C-27008r1_chk

Servers - Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Interactive logon: Smart card removal behavior” is not set to “Lock Workstation”, or “Force Logoff”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: SCRemoveOption Value Type: REG_SZ Value: 1 (Lock Workstation) or 2 (Force Logoff) Documentable Explanation: If configuring this on servers causes issues such as terminating users’ remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons are manually locked or logged off when unattended or not in use, this would be acceptable. This will be documented with the IAO.

Fix: F-105r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Interactive logon: Smart card removal behavior” to “Lock Workstation” or “Force Logoff”.

Generate Mitigation Statement:

Checks: C-121r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Microsoft Network Server: Digitally sign communications (if client agrees)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableSecuritySignature Value Type: REG_DWORD Value: 1

Fix: F-104r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Microsoft Network Server: Digitally sign communications (if Client agrees)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-114r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Domain Member: Digitally encrypt secure channel data (when possible)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SealSecureChannel Value Type: REG_DWORD Value: 1 Note: If the value for “Domain Member: Digitally encrypt or sign secure channel data (always)” is set to “Enabled”, then this would not be a finding.

Fix: F-101r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Domain Member: Digitally encrypt secure channel data (when possible)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-112r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Domain Member: Digitally sign secure channel data (when possible)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SignSecureChannel Value Type: REG_DWORD Value: 1 Note: If the value for “Domain Member: Digitally encrypt or sign secure channel data (always)” is set to “Enabled”, then this would not be a finding.

Fix: F-100r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Domain Member: Digitally sign secure channel data (when possible)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-4361r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Microsoft Network Client: Digitally sign communications (if server agrees)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnableSecuritySignature Value Type: REG_DWORD Value: 1

Fix: F-103r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Microsoft Network Client: Digitally sign communications (if server agrees)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-13595r1_chk

Review the Backup Operators group in Computer Management and/or Active Directory Users and Computers. If the group contains no accounts, this is not a finding. If the group does contain any accounts, this must be documented as specified below. Documentable Explanation: Any accounts that are members of the Backup Operators group must be documented with the IAO including application accounts. Each Backup Operator will have a separate user account for backing up the system and for performing normal user tasks.

Fix: F-32r2_fix

Create the necessary documentation that identifies the members of this privileged group. Ensure each member has a separate account for user duties and one for his privileged duties and the other requirements outlined in the manual check are met.

Generate Mitigation Statement:

Checks: C-32922r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Devices: Allowed to Format and Eject Removable Media” is not set to “Administrators”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon Value Name: AllocateDASD Value Type: REG_SZ Value: 0

Fix: F-113r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Devices: Allowed to Format and Eject Removable Media” to “Administrators”.

Generate Mitigation Statement:

Checks: C-32887r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies -> Password Policy. If the value for “Store password using reversible encryption” is not disabled, then this is a finding.

Fix: F-28816r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> “Store password using reversible encryption” to "Disabled".

Generate Mitigation Statement:

Checks: C-32082r1_chk

1. Analyze the system using the Security Configuration and Analysis snap-in. 2. Expand the Security Configuration and Analysis tree view. 3. Navigate to Local Policies and select Security Options. 4. If the value for “Domain Controller: Allow server operators to schedule tasks” is not set to “Disabled”, then this is a finding.

Fix: F-28439r1_fix

Set the value for “Domain Controller: Allow server operators to schedule tasks” to “Disabled”. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\LSA\ Value Name: SubmitControl Value Type: REG_DWORD Value: 0

Generate Mitigation Statement:

Checks: C-71079r2_chk

Verify the following is configured in the Default Domain Policy. Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right click on the "Default Domain Policy", select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the policy "Enforce user logon restrictions" is not set to "Enabled", this is a finding.

Fix: F-76923r1_fix

Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Enforce user logon restrictions" to "Enabled".

Generate Mitigation Statement:

Checks: C-71081r2_chk

Verify the following is configured in the Default Domain Policy. Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right click on the "Default Domain Policy", select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding.

Fix: F-76925r1_fix

Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for service ticket" to a maximum of "600" minutes, but not "0" which equates to "Ticket doesn't expire".

Generate Mitigation Statement:

Checks: C-71083r2_chk

Verify the following is configured in the Default Domain Policy. Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right click on the "Default Domain Policy", select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding.

Fix: F-76927r1_fix

Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket" to a maximum of "10" hours, but not "0" which equates to "Ticket doesn't expire".

Generate Mitigation Statement:

Checks: C-71085r1_chk

Verify the following is configured in the Default Domain Policy. Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right click on the "Default Domain Policy", select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.

Fix: F-76929r1_fix

Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket renewal" to "7" days or less.

Generate Mitigation Statement:

Checks: C-71087r1_chk

Verify the following is configured in the Default Domain Policy. Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). Right click on the "Default Domain Policy", select "Edit". Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding.

Fix: F-76931r1_fix

Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum tolerance for computer clock synchronization" to "5" minutes or less.

Generate Mitigation Statement:

Checks: C-7891r1_chk

Interview the SA to determine if the site uses a tool to compare system files (*.exe, *.bat, *.com, *.cmd and *.dll) on servers against a baseline, on a weekly basis. Note: A properly configured HBSS Policy Auditor 5.2 or later, File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix: F-42r1_fix

The site should use a tool to compare system files (*.exe, *.bat, *.com, *.cmd and *.dll) on servers against a baseline, on a weekly basis.

Generate Mitigation Statement:

Checks: C-32711r1_chk

Open the Computer Management Console. Expand the “System Tools” object in the Tree window. Expand the “Shared Folders” object. Select the “Shares” object. Right click any user-created shares (ignore administrative shares; the system will prompt you if Properties are selected for administrative shares). Select Properties. Select the Share Permissions tab. If user-created file shares have not been reconfigured to remove ACL permissions from the “Everyone” group, then this is a finding. Documentable Explanation: If shares created by applications require the “Everyone” group, this should be documented with the IAO.

Fix: F-59r1_fix

Remove permissions from the Everyone group from locally-created file shares and assign them to authorized groups.

Generate Mitigation Statement:

Checks: C-32923r1_chk

Interview the SA to determine if there is a host-based Intrusion Detection System on each server. Severity Override: This finding can be downgraded to a Category III, if there is an active JIDS or Firewall protecting the network. If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. A HID device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the site IAO.

Fix: F-29051r1_fix

Install a host-based Intrusion Detection System on each server.

Generate Mitigation Statement:

Checks: C-32837r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Devices: Allow Undock Without Having to Log On” is not set to "Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System Value Name: UndockWithoutLogon Value Type: REG_DWORD Value: 0

Fix: F-130r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Devices: Allow Undock Without Having to Log On” to “Disabled”.

Generate Mitigation Statement:

Checks: C-502r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Domain Member: Require Strong (Windows 2000 or Later) Session Key” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireStrongKey Value Type: REG_DWORD Value: 1 Warning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.

Fix: F-5801r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Domain Member: Require Strong (Windows 2000 or Later) Session Key” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32742r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network access: Do not allow storage of passwords and credentials for network authentication” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: DisableDomainCreds Value Type: REG_DWORD Value: 1

Fix: F-28821r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Do not allow storage of passwords and credentials for network authentication” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32743r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network access: Let everyone permissions apply to anonymous users” is not set to “Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous Value Type: REG_DWORD Value: 0

Fix: F-28822r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Let everyone permissions apply to anonymous users” to “Disabled”.

Generate Mitigation Statement:

Checks: C-32744r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network access: Sharing and security model for local accounts” is not set to “Classic – local users authenticate as themselves”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: ForceGuest Value Type: REG_DWORD Value: 0

Fix: F-28823r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Sharing and security model for local accounts” to “Classic – local users authenticate as themselves”.

Generate Mitigation Statement:

Checks: C-32786r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network security: Force logoff when logon hours expire” is not set to “Enabled”, then this is a finding. This setting does not have a corresponding registry update.

Fix: F-28862r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network security: Force logoff when logon hours expire” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32746r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network security: LDAP client signing requirements” is not set to at least “Negotiate signing”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity Value Type: REG_DWORD Value: 1

Fix: F-28825r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network security: LDAP client signing requirements” to “Negotiate signing”.

Generate Mitigation Statement:

Checks: C-32747r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network security: Minimum session security for NTLM SSP based (including secure RPC) clients” is not set to “Require NTLMv2 session security” and “Require 128-bit encryption”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec Value Type: REG_DWORD Value: 0x20080000 (537395200) Warnings: Microsoft warns that setting these may prevent the client from communicating with legacy servers that do not support them. “Require NTLMv2 session security” will prevent authentication, if the “Network security: LAN Manager Authentication level” is set to permit NTLM or LM authentication. Documentable Explanation: If these settings need to be modified in a mixed Windows environment, the changes should be documented with the IAO.

Fix: F-28826r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network security: Minimum session security for NTLM SSP based (including secure RPC) clients” to “Require NTLMv2 session security”, ”Require 128-bit encryption” (all options selected).

Generate Mitigation Statement:

Checks: C-32748r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ Value Name: Enabled Value Type: REG_DWORD Value: 1 Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site.

Fix: F-28827r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing” to “Enabled”.

Generate Mitigation Statement:

Checks: C-60909r2_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies >> Security Options. If the value for "System Objects: Require case insensitivity for non-Windows subsystems" is not set to "Enabled", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\ Value Name: ObCaseInsensitive Value Type: REG_DWORD Value: 1

Fix: F-65641r2_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System Objects: Require case insensitivity for non-Windows subsystems" to "Enabled".

Generate Mitigation Statement:

Checks: C-32895r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fSingleSessionPerUser Type: REG_DWORD Value: 1 Documentable Explanation: If the system has the role as a Terminal/Remote Desktop Server or the site is using remote desktop services for remote administration, this requirement needs to be documented with the IAO.

Fix: F-28894r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections “Restrict Remote Desktop Services users to a Single Remote Desktop Services Session” to “Enabled”.

Generate Mitigation Statement:

Checks: C-1880r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fPromptForPassword Type: REG_DWORD Value: 1

Fix: F-28877r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> “Always prompt for password upon connection” to “Enabled”.

Generate Mitigation Statement:

Checks: C-1883r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: MinEncryptionLevel Type: REG_DWORD Value: 3

Fix: F-28878r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security “Set client connection encryption level” to “Enabled” and “High Level”.

Generate Mitigation Statement:

Checks: C-1899r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: PerSessionTempDir Type: REG_DWORD Value: 1

Fix: F-28879r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders “Do not use temporary folders per session” to “Disabled”.

Generate Mitigation Statement:

Checks: C-1906r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DeleteTempDirsOnExit Type: REG_DWORD Value: 1

Fix: F-28880r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders “Do not delete temp folder upon exit” to “Disabled”.

Generate Mitigation Statement:

Checks: C-40666r1_chk

Review the registry. If the following registry value does not exist, this is not a finding (This is the expected result from configuring the policy as outlined in the Fix section). If the following registry value does exist but is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\system\ Value Name: DisableBkGndGroupPolicy Type: REG_DWORD Value: 0

Fix: F-5684r1_fix

Configure the system to require Group Policy background refresh by setting the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy “Turn Off Background Refresh of Group Policy” to “Disabled”.

Generate Mitigation Statement:

Checks: C-4087r1_chk

If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD Value: 0

Fix: F-6776r1_fix

Configure the system to prevent unsolicited remote assistance offers by setting the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance “Offer Remote Assistance” to “Disabled”.

Generate Mitigation Statement:

Checks: C-221r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Session Manager\ Value Name: SafeDllSearchMode Value Type: REG_DWORD Value: 1

Fix: F-5699r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-46906r1_chk

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: DisableAutoupdate Type: REG_DWORD Value: 1

Fix: F-45027r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Prevent Automatic Updates" to "Enabled".

Generate Mitigation Statement:

Checks: C-32898r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_Current_User Subkey: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: PreventCodecDownload Type: REG_DWORD Value: 1

Fix: F-5993r1_fix

Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback “Prevent Codec Download” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32712r2_chk

Required services will vary between organizations, and on the role of the individual system. Organizations will develop their own list of services which will be documented and justified with the IAO. The Site’s list will be provided for any security review. Services common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system. Individual services specifically required to be disabled per the STIG are identified in separate requirements. If the site has not documented the services required for their system(s), this is a finding. The following can be used to view the services on a system: Select “Start”. Select “Run”. Enter "Services.msc" in the run box. Respond to any User Account Control prompts. Services for Windows Server 2008 R2 roles are managed automatically, adding those necessary for a particular role. The following tables list the default services for a baseline installation and those for common roles as a reference. This can be used as a basis for documenting the services necessary. Default Installation Name - Startup Type Application Experience - Manual Application Identity - Manual Application Information - Manual Application Layer Gateway Service - Manual Application Management - Manual Background Intelligent Transfer Service - Manual Base Filtering Engine - Automatic Certificate Propagation - Manual CNG Key Isolation - Manual COM+ Event System - Automatic COM+ System Application - Manual Computer Browser - Disabled Credential Manager - Manual Cryptographic Services - Automatic DCOM Server Process Launcher - Automatic Desktop Window Manager Session Manager - Automatic DHCP Client - Automatic Diagnostic Policy Service – Automatic (Delayed Start) Diagnostic Service Host - Manual Diagnostic System Host – Manual Disk Defragmenter - Manual Distributed Link Tracking Client - Automatic Distributed Transaction Coordinator - Automatic (Delayed Start) DNS Client - Automatic Encrypting File System (EFS) - Manual Extensible Authentication Protocol - Manual Function Discovery Provider Host - Manual Function Discovery Resource Publication - Manual Group Policy Client - Automatic Health Key and Certificate Management - Manual Human Interface Device Access - Manual IKE and AuthIP IPsec Keying Modules - Manual Interactive Services Detection - Manual Internet Connection Sharing (ICS) - Disabled IP Helper - Automatic IPsec Policy Agent - Manual KtmRm for Distributed Transaction Coordinator - Manual Link-Layer Topology Discovery Mapper - Manual Microsoft .NET Framework NGEN v2.0.50727_X64 - Manual Microsoft .NET Framework NGEN v2.0.50727_X86 - Manual Microsoft Fibre Channel Platform Registration Service - Manual Microsoft iSCSI Initiator Service - Manual Microsoft Software Shadow Copy Provider - Manual Multimedia Class Scheduler - Manual Netlogon - Manual Network Access Protection Agent - Manual Network Connections - Manual Network List Service - Manual Network Location Awareness - Automatic Network Store Interface Service - Automatic Performance Counter DLL Host - Manual Performance Logs & Alerts - Manual Plug and Play - Automatic PnP-X IP Bus Enumerator - Disabled Portable Device Enumerator Service - Manual Power - Automatic Print Spooler - Automatic Problem Reports and Solutions Control Panel Support - Manual Protected Storage - Manual Remote Access Auto Connection Manager - Manual Remote Access Connection Manager - Manual Remote Desktop Configuration - Manual Remote Desktop Services - Manual Remote Desktop Services UserMode Port Redirector - Manual Remote Procedure Call (RPC) - Automatic Remote Procedure Call (RPC) Locator - Manual Remote Registry - Automatic Resultant Set of Policy Provider - Manual Routing and Remote Access - Disabled RPC Endpoint Mapper - Automatic Secondary Logon - Manual Secure Socket Tunneling Protocol Service - Manual Security Accounts Manager - Automatic Server - Automatic Shell Hardware Detection - Automatic Smart Card - Manual Smart Card Removal Policy - Automatic (Manual is the default) SNMP Trap - Manual Software Protection - Automatic (Delayed Start) Special Administration Console Helper - Manual SPP Notification Service - Manual SSDP Discovery - Disabled System Event Notification Service - Automatic Task Scheduler - Automatic TCP/IP NetBIOS Helper - Automatic Telephony - Manual Thread Ordering Server - Manual TP AutoConnect Service - Manual TPM Base Services - Manual UPnP Device Host - Disabled User Profile Service - Automatic Virtual Disk - Manual Volume Shadow Copy - Manual Windows Audio - Manual Windows Audio Endpoint Builder - Manual Windows Color System - Manual Windows Driver Foundation - User-mode Driver Framework - Manual Windows Error Reporting Service - Manual Windows Event Collector - Manual Windows Event Log - Automatic Windows Firewall - Automatic Windows Font Cache Service - Manual Windows Installer - Manual Windows Management Instrumentation - Automatic Windows Modules Installer - Manual Windows Remote Management (WS-Management) - Automatic (Delayed Start) Windows Time - Automatic Windows Update - Automatic (Delayed Start) WinHTTP Web Proxy Auto-Discovery Service - Manual Wired AutoConfig - Manual WMI Performance Adapter - Manual Workstation – Automatic The following services for roles are addressed in the Microsoft Windows Server 2008 R2 Security Guide, Windows Server 2008 R2 Attack Service Reference.xlsx. These major roles may include sub-roles not addressed here. Name - Startup Type Active Directory Certificate Services Active Directory Certificate Services - Automatic Active Directory Domain Services Active Directory Domain Services - Automatic Active Directory Web Services - Automatic DFS Namespace - Automatic DFS Replication - Automatic DNS Server - Automatic Intersite Messaging - Automatic Kerberos Key Distribution Center - Automatic Net.Tcp Port Sharing Service - Disabled Windows CardSpace - Manual Windows Presentation Foundation Font Cache 3.0.0.0 - Manual DHCP Server DHCP Server - Automatic DNS Server DNS Server - Automatic File Server Server - Automatic Workstation - Automatic Hyper-V Server Hyper-V Image Management Service - Automatic Hyper-V Networking Management Service - Automatic Virtual Machine Management Service - Automatic Network Policy and Access Server Network Policy Server - Automatic (Delayed Start) Print Server Print Spooler - Automatic Remote Desktop Services Server Remote Desktop Configuration - Manual Remote Desktop Services - Automatic Remote Desktop Services UserMode Port - Manual Web Server (IIS) Application Host Helper Service - Automatic Windows Process Activation - Manual World Wide Web Publishing Service - Automatic

Fix: F-28959r1_fix

Document the services required for the system to operate. Remove or disable any services that are not required.

Generate Mitigation Statement:

Checks: C-3244r2_chk

The site will have a policy that requires servers and other critical systems be reviewed on a daily basis to identify possible security breaches and weakness. This can be accomplished with the use of monitoring software or other utilities for this purpose.

Fix: F-6578r1_fix

Create a site policy that mandates review of audit logs.

Generate Mitigation Statement:

Checks: C-32752r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Network security: Minimum session security for NTLM SSP based (including secure RPC) servers” is not set to “Require NTLMv2 session security” and “Require 128-bit encryption”, then this is a finding. Warning: Microsoft warns that setting these may prevent the client from communicating with legacy servers that do not support them. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec Value Type: REG_DWORD Value: 0x20080000 (537395200) Warning: “Require NTLMv2 session security” will prevent authentication, if the “Network security: LAN Manager Authentication level” is set to permit NTLM or LM authentication. Documentable Explanation: If the required settings must be modified to support operation in a mixed Windows environment, then this should be documented with the IAO.

Fix: F-28830r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network security: Minimum session security for NTLM SSP based (including secure RPC) servers” to “Require NTLMv2 session security”, ”Require 128-bit encryption (all options selected).

Generate Mitigation Statement:

Checks: C-35r1_chk

Verify that the site is applying all security-related patches released by Microsoft. Determine the local site method for doing this (e.g., connection to a WSUS server, local procedure, etc.). Severity Override: If any of the patches not installed are Microsoft ‘Critical’, then the category code should be elevated to ‘1’. Note: If a penetration scan has been run on the network, it will report findings if security-related updates are not applied. Then, this check may be marked as “Not Applicable”. Some applications (such as DMS and GCSS) use a system release process to keep systems current. If this is the case, then these systems should be at the current release.

Fix: F-63r1_fix

Apply all Microsoft security-related patches to the Windows system.

Generate Mitigation Statement:

Checks: C-51799r3_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for "Domain Controller: LDAP Server signing requirements" is not set to "Require signing", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\NTDS\Parameters\ Value Name: LDAPServerIntegrity Value Type: REG_DWORD Value: 2 Documentable Explanation: If LDAP Signing is not supported by a client, service or application, this must be documented with the IAO with supporting vendor information.

Fix: F-53593r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain controller: LDAP server signing requirements" to "Require signing".

Generate Mitigation Statement:

Checks: C-62041r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies >> Security Options. If the value for "System cryptography: Force strong key protection for user keys stored on the computer" is not set to "User must enter a password each time they use a key", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ Value Name: ForceKeyProtection Value Type: REG_DWORD Value: 2

Fix: F-66939r1_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".

Generate Mitigation Statement:

Checks: C-32899r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEncryptRPCTraffic Type: REG_DWORD Value: 1

Fix: F-28899r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security “Require secure RPC communication” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32762r1_chk

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} Value Name: NoGPOListChanges Type: REG_DWORD Value: 0

Fix: F-28955r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy “Registry Policy Processing” to “Enabled” and select the option “Process even if the Group Policy objects have not changed”.

Generate Mitigation Statement:

Checks: C-3108r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Domain Member: Digitally encrypt or sign secure channel data (always)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireSignOrSeal Value Type: REG_DWORD Value: 1

Fix: F-6518r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Domain Member: Digitally encrypt or sign secure channel data (always)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-3110r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Microsoft Network Client: Digitally sign communications (always)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: RequireSecuritySignature Value Type: REG_DWORD Value: 1

Fix: F-6519r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Microsoft Network Client: Digitally sign communications (always)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-3112r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Microsoft Network Server: Digitally sign communications (always)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RequireSecuritySignature Value Type: REG_DWORD Value: 1

Fix: F-6520r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Microsoft Network Server: Digitally sign communications (always)” to “Enabled”.

Generate Mitigation Statement:

Checks: C-3225r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Account Policies -> Password Policy. If the value for the “Minimum password length,” is less than 14 characters, then this is a finding.

Fix: F-28839r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Account Policies -> Password Policy -> “Minimum password length,” to 14 characters.

Generate Mitigation Statement:

Checks: C-78967r3_chk

Review the password never expires status for enabled user accounts. Open "Windows PowerShell" with elevated privileges (run as administrator). Domain Controllers: Enter "Import-Module ActiveDirectory". (This only needs to be run once during a PowerShell session.) Enter 'Search-ADAccount -PasswordNeverExpires -UsersOnly | Where {$_.PasswordNeverExpires -eq "True" | FT Name, PasswordNeverExpires, Enabled -AutoSize'. Exclude application accounts and disabled accounts (e.g., Guest). Domain accounts requiring smart card (CAC/PIV) and the built-in Administrator account may also be excluded. If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. Member servers and standalone systems: Enter 'Get-WMIObject -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount -AutoSize'. Exclude application accounts and disabled accounts (e.g., Guest). The built-in Administrator account may also be excluded. If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. Note: Other queries or tools may be used. The organization must be able to demonstrate the results are valid and meet the intent of the requirement.

Fix: F-86125r1_fix

Configure all enabled user account passwords to expire. Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO.

Generate Mitigation Statement:

Checks: C-48684r2_chk

Refer to the AD database location obtained in check V-8316. Note the logical drive (e.g., C:) on which the files are located. Determine if the server is currently providing file sharing services to users with the following command. Enter "net share" at a command prompt. Note the logical drive(s) or file system partition for any site-created data shares. Ignore all system shares (e.g., Windows NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. If user shares are located on the same logical partition as the directory server data files, this is a finding.

Fix: F-47807r2_fix

Ensure files owned by users are stored on a different logical partition then the directory server data files.

Generate Mitigation Statement:

Checks: C-48687r3_chk

Determine if a time synchronization tool has been implemented on the Windows domain controller. If the Windows Time Service is used, verify the following registry values. If they are not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\ Value Name: Enabled Type: REG_DWORD Value: 1 Registry Path: \System\CurrentControlSet\Services\W32Time\Parameters\ Value Name: Type Type: REG_SZ Value: NT5DS (preferred), NTP, or Allsync If these Windows checks indicate a finding because the NtpClient is not enabled, determine if an alternate time synchronization tool is installed and enabled. If the Windows Time Service is not enabled and no alternate tool is enabled, this is a finding.

Fix: F-47810r3_fix

Ensure the Windows Time Service is configured as follows or install and enable another time synchronization tool. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\ Value Name: Enabled Type: REG_DWORD Value: 1 Registry Path: \System\CurrentControlSet\Services\W32Time\ Parameters\ Value Name: Type Type: REG_SZ Value: NT5DS (preferred), NTP, or Allsync

Generate Mitigation Statement:

Checks: C-48690r2_chk

Review the roles and services the domain controller is running. Run "services.msc" to display the Services console. Determine if any running services are application components. Examples of services indicating the presence of applications are: -DHCP Server for DHCP server -IIS Admin Service for IIS web server -Microsoft Exchange System Attendant for Exchange -MSSQLServer for SQL Server. If any application-related components have the "Started" status, this is a finding. Installed roles can be displayed by viewing Server Roles in the Add (or Remove) Roles and Features wizard. (Cancel before any changes are made.) Determine if any additional server roles are installed. A basic domain controller set up will include the following: -Active Directory Domain Services -DNS Server If any roles not requiring installation on a domain controller are installed, this is a finding. Supplemental Notes: A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. Some directory servers utilize specialized web servers for administrative functions and databases for data management. These web and database servers are permitted as long as they are dedicated to directory server support and only administrative users have access to them.

Fix: F-33233r2_fix

Remove additional roles or applications such as web, database, and email from the domain controller.

Generate Mitigation Statement:

Checks: C-48693r2_chk

Run "services.msc" to display the Services console. Verify the Startup Type for the following Windows services: - Active Directory Domain Services - DFS Replication - DNS Client - DNS server - Group Policy Client - Intersite Messaging - Kerberos Key Distribution Center - NetLogon - Windows Time (not required if another time synchronization tool is implemented to start automatically) If the Startup Type for any of these services is not Automatic, this is a finding.

Fix: F-47815r2_fix

Ensure the following services that are critical for directory server operation are configured for automatic startup. - Active Directory Domain Services - DFS Replication - DNS Client - DNS server - Group Policy Client - Intersite Messaging - Kerberos Key Distribution Center - NetLogon - Windows Time (not required if another time synchronization tool is implemented to start automatically)

Generate Mitigation Statement:

Checks: C-80173r2_chk

Review the password last set date for the built-in Administrator account. Domain controllers: Open "Windows PowerShell". Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | FL Name, SID, PasswordLastSet". If the "PasswordLastSet" date is greater than one year old, this is a finding. Member servers and standalone systems: Open "Windows PowerShell" or "Command Prompt". Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in Administrator account. (The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) If the "PasswordLastSet" date is greater than one year old, this is a finding.

Fix: F-87305r1_fix

Change the built-in Administrator account password at least annually or whenever an administrator leaves the organization. More frequent changes are recommended. Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.

Generate Mitigation Statement:

Checks: C-66305r2_chk

Determine whether audit data is retained for at least one year. If the audit data is not retained for at least one year, this is a finding.

Fix: F-71693r2_fix

Ensure the audit data is retained for at least one year.

Generate Mitigation Statement:

Checks: C-46900r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for "Audit: Audit the access of global system objects" is not set to "Disabled", this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa Value Name: AuditBaseObjects Value Type: REG_DWORD Value: 0

Fix: F-45021r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".

Generate Mitigation Statement:

Checks: C-11574r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Audit: Audit the use of Backup and Restore privilege” is not set to “Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa Value Name: FullPrivilegeAuditing Value Type: REG_Binary Value: 0

Fix: F-13553r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Audit: Audit the use of Backup and Restore privilege” to “Disabled”.

Generate Mitigation Statement:

Checks: C-11575r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy Value Type: REG_DWORD Value: 1

Fix: F-13554r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32766r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Admin Approval Mode for the Built-in Administrator account” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: FilterAdministratorToken Value Type: REG_DWORD Value: 1

Fix: F-28841r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Admin Approval Mode for the Built-in Administrator account” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32767r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode” is not set to “Prompt for consent”, then this is a finding. More secure options for this setting would also be acceptable (e.g., Prompt for credentials, Prompt for consent (or credentials) on the secure desktop). The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorAdmin Value Type: REG_DWORD Value: 4 (Prompt for consent) 3 (Prompt for credentials) 2 (Prompt for consent on the secure desktop) 1 (Prompt for credentials on the secure desktop)

Fix: F-28842r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode” to “Prompt for consent”. Note: More secure options for this setting would also be acceptable (e.g., Prompt for credentials, Prompt for consent (or credentials) on the secure desktop).

Generate Mitigation Statement:

Checks: C-32900r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Behavior of the elevation prompt for standard users” is not set to “Automatically deny elevation requests”, then this is a finding. The policy referenced configures the following registry value: Registry Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorUser Value Type: REG_DWORD Value: 0

Fix: F-28843r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Behavior of the elevation prompt for standard users” to “Automatically deny elevation requests”.

Generate Mitigation Statement:

Checks: C-32772r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Detect application installations and prompt for elevation” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableInstallerDetection Value Type: REG_DWORD Value: 1

Fix: F-28844r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Detect application installations and prompt for elevation” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32773r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Only elevate UIAccess applications that are installed in secure locations” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableSecureUIAPaths Value Type: REG_DWORD Value: 1

Fix: F-28845r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Only elevate UIAccess applications that are installed in secure locations” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32775r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Run all administrators in Admin Approval Mode” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableLUA Value Type: REG_DWORD Value: 1

Fix: F-28846r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Run all administrators in Admin Approval Mode” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32776r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Switch to the secure desktop when prompting for elevation” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: PromptOnSecureDesktop Value Type: REG_DWORD Value: 1

Fix: F-28847r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Switch to the secure desktop when prompting for elevation” to “Enabled”.

Generate Mitigation Statement:

Checks: C-32777r1_chk

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “User Account Control: Virtualize file and registry write failures to per-user locations” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableVirtualization Value Type: REG_DWORD Value: 1

Fix: F-28848r1_fix

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “User Account Control: Virtualize file and registry write failures to per-user locations” to “Enabled”.

Generate Mitigation Statement:

Checks: C-74329r1_chk

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ Value Name: EnumerateAdministrators Type: REG_DWORD Value: 0x00000000 (0)

Fix: F-80999r1_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".

Generate Mitigation Statement:

Checks: C-11593r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DisablePasswordSaving Type: REG_DWORD Value: 1

Fix: F-28883r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Connection Client “Do not allow passwords to be saved” to “Enabled”.

Generate Mitigation Statement:

Checks: C-11595r1_chk

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCdm Type: REG_DWORD Value: 1

Fix: F-28884r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection “Do not allow drive redirection” to “Enabled”.

Generate Mitigation Statement:

Checks: C-11602r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Value Name: NoWebServices Type: REG_DWORD Value: 1

Fix: F-13581r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication setting ‘Turn off Internet download for Web publishing and online ordering wizards’ to “Enabled”.

Generate Mitigation Statement:

Checks: C-11606r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Printers Value Name: DisableHTTPPrinting Type: REG_DWORD Value: 1

Fix: F-13584r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication setting ‘Turn off printing over HTTP’ to “Enabled”.

Generate Mitigation Statement:

Checks: C-11607r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Printers Value Name: DisableWebPnPDownload Type: REG_DWORD Value: 1

Fix: F-13585r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication setting ‘Turn off downloading of print drivers over HTTP’ to “Enabled”.

Generate Mitigation Statement:

Checks: C-11608r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows\DriverSearching Value Name: DontSearchWindowsUpdate Type: REG_DWORD Value: 1

Fix: F-13586r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication setting ‘Turn off Windows Update device driver searching’ to “Enabled”.

Generate Mitigation Statement:

Checks: C-11758r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_Current_User Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: SaveZoneInformation Type: REG_DWORD Value: 2

Fix: F-13606r1_fix

Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> “Do not preserve zone information in file attachments” to “Disabled”.

Generate Mitigation Statement:

Checks: C-11759r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_Current_User Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: HideZoneInfoOnProperties Type: REG_DWORD Value: 1

Fix: F-13607r1_fix