[Forgot Password]
Login  Register Subscribe

24436

 
 

131815

 
 

115228

 
 

909

 
 

90122

 
 

140

Paid content will be excluded from the download.


Download | Alert*


CCE-43275-7
Specify the 'DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax' value (SDDL String) This policy setting determines which users or groups might access DCOM application remotely or locally. This setting is used to control the attack surface of the computer for ...

CCE-43844-0
Specify the 'Interactive logon: Machine inactivity limit' value (timeout in seconds 15-900) Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. Counter Measure: Configure this p ...

CCE-41647-9
Disable: 'Network Security: Configure encryption types allowed for Kerberos' for SupportedEncryptionTypes This policy setting allows you to set the encryption types that Kerberos is allowed to use. This policy is supported on at least Windows 7 or Windows Server 2008 R2. Counter Measure: ...

CCE-42778-1
Reset account lockout counter after This policy setting determines the length of time before the Account lockout threshold resets to zero. The default value for this policy setting is Not Defined. If the Account lockout threshold is defined, this reset time must be less than or equal to the value f ...

CCE-43050-4
Impersonate a client after authentication The policy setting allows programs that run on behalf of a user to impersonate that user (or another specified account) so that they can act on behalf of the user. If this user right is required for this kind of impersonation, an unauthorized user will not ...

CCE-41763-4
Disable: 'System cryptography: Force strong key protection for user keys stored on the computer' for ForceKeyProtection This policy setting determines whether users' private keys (such as their S-MIME keys) require a password to be used. If you configure this policy setting so that users must provi ...

CCE-42586-8
Disable: 'MSS: (SynAttackProtect) Syn attack protection level (protects against DoS)' MSS: (SynAttackProtect) Syn attack protection level (protects against DoS) Counter Measure: Enable and configure this setting. Potential Impact: TCP/IP traffic could be inaccurately detected as a ...

CCE-44148-5
Disable: 'Interactive logon: Number of previous logons to cache (in case domain controller is not available)' for cachedlogonscount This policy setting determines whether a user can log on to a Windows domain using cached account information. Logon information for domain accounts can be cached loca ...

CCE-42695-7
Disable: 'MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments)' for Hidden MSS: (Hidden) Hide Computer From the Browse List (not recommended except for highly secure environments) Counter Measure: Do not configure the MSS: (Hidden) Hide C ...

CCE-41582-8
'Specify the maximum log file size (KB)' (System Log) (Min:1024 Max:2147483647 kb) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabyte ...

CCE-43340-9
Disable: 'Shutdown: Allow system to be shut down without having to log on' This policy setting determines whether a computer can be shut down when a user is not logged on. If this policy setting is enabled, the shutdown command is available on the Windows logon screen. Microsoft recommends to disab ...

CCE-44438-0
'Choose drive encryption method and cipher strength (Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10 [Version 1507])' to AES 128-bit This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting ...

CCE-43517-2
Disable: 'Network access: Do not allow anonymous enumeration of SAM accounts' for RestrictAnonymousSAM This policy setting controls the ability of anonymous users to enumerate the accounts in the Security Accounts Manager (SAM). If you enable this policy setting, users with anonymous connections ca ...

CCE-43894-5
Account lockout threshold This policy setting determines the number of failed logon attempts before a lock occurs. Authorized users can lock themselves out of an account by mistyping their password or by remembering it incorrectly, or by changing their password on one computer while logged on to an ...

CCE-42781-5
Disable: 'Interactive logon: Do not require CTRL+ALT+DEL' This policy setting determines whether users must press CTRL+ALT+DEL before they log on. If you enable this policy setting, users can log on without this key combination. If you disable this policy setting, users must press CTRL+ALT+DEL befo ...

CCE-44027-1
Disable: 'Microsoft network server: Digitally sign communications (if client agrees)' for enablesecuritysignature This policy setting determines if the server side SMB service is able to sign SMB packets if it is requested to do so by a client that attempts to establish a connection. If no signing ...

CCE-42070-3
Disable: 'Configure TPM platform validation profile for BIOS-based firmware configurations' for Enabled This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the comp ...

CCE-43472-0
Disable: 'Control Event Log behavior when the log file reaches its maximum size' for Retention This policy setting controls Event Log behavior when the log file reaches its maximum size. If you enable this policy setting and a log file reaches its maximum size, new events are not written to the ...

CCE-42974-6
Disable: 'Network access: Do not allow storage of passwords and credentials for network authentication' for DisableDomainCreds This policy setting determines whether the Stored User Names and Passwords feature may save passwords or credentials for later use when it gains domain authentication. If y ...

CCE-41676-8
Disable: 'Require a Password When a Computer Wakes (Plugged In)' Specifies whether or not the user is prompted for a password when the system resumes from sleep. Counter Measure: Configure Require a Password When a Computer Wakes (Plugged In) to Enabled. Potential Impact: If you e ...

CCE-43773-1
'Set time limit for active but idle Remote Desktop Services sessions' to never This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected. If you enable this policy ...

CCE-41474-8
Disable: 'Domain member: Require strong (Windows 2000 or later) session key' for requirestrongkey When this policy setting is enabled, a secure channel can only be established with domain controllers that are capable of encrypting secure channel data with a strong (128-bit) session key. To enab ...

CCE-41557-0
Disable: 'Microsoft network client: Send unencrypted password to third-party SMB servers' for EnablePlainTextPassword Disable this policy setting to prevent the SMB redirector from sending plaintext passwords during authentication to third-party SMB servers that do not support password encryption. ...

CCE-42501-7
Disable: 'Support device authentication using certificate' Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. This policy setting allows you to set support for Kerbe ...

CCE-43700-4
Disable: 'Always prompt for password upon connection' This policy setting specifies whether Terminal Services always prompts the client computer for a password upon connection. You can use this policy setting to enforce a password prompt for users who log on to Terminal Services, even if they alrea ...

CCE-42219-6
Disable: 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' for AutoAdminLogon MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) Counter Measure: Do not configure the MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) entry except on highly secure com ...

CCE-42710-4
Disable: 'Require secure RPC communication' Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication. You can use this setting to strengthen the security of RPC communication with clients by allowing only authent ...

CCE-43930-7
Disable: 'Deny write access to removable drives not protected by BitLocker' for RDVDenyWriteAccess This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. If you enable this policy setting, all removable data dri ...

CCE-43953-9
Disable: 'Network access: Shares that can be accessed anonymously' for NullSessionShares This policy setting determines which network shares can be accessed by anonymous users. The default configuration for this policy setting has little effect because all users have to be authenticated before they ...

CCE-43916-6
Enable: 'Turn off Automatic Download and Install of updates' for AutoDownload Enables or disables the automatic download and installation of app updates. If you enable this setting, the automatic download and installation of app updates is turned off. If you disable this setting, the automa ...

CCE-42139-6
Disable: 'Prevent memory overwrite on restart' This policy setting controls computer restart performance at the risk of exposing BitLocker secrets. This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material used to encrypt data. This policy setting applies onl ...

CCE-41735-2
Disable: 'Enable use of BitLocker authentication requiring preboot keyboard input on slates' This policy setting allows users to enable authentication options that require user input from the pre-boot environment even if the platform indicates lack of pre-boot input capability. The Windows on-s ...

CCE-42842-5
Disable: 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' for NTLMMinServerSec This policy setting determines which behaviors are allowed for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications t ...

CCE-43458-9
Disable: 'Network security: LDAP client signing requirements' for LDAPClientIntegrity This policy setting determines the level of data signing that is requested on behalf of clients that issue LDAP BIND requests, as follows: - None. The LDAP BIND request is issued with the caller-specified opti ...

CCE-44311-9
Disable: 'Shutdown: Clear virtual memory pagefile' for ClearPageFileAtShutdown This policy setting determines whether the virtual memory pagefile is cleared when the system is shut down. When this policy setting is enabled, the system pagefile is cleared each time that the system shuts down properl ...

CCE-41773-3
Disable: 'Domain member: Digitally sign secure channel data (when possible)' for signsecurechannel This policy setting determines whether a domain member should attempt to negotiate whether all secure channel traffic that it initiates must be digitally signed. Digital signatures protect the traffic ...

CCE-41750-1
Disable: 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)' for TcpMaxDataRetransmissions MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) Counter Measure: Co ...

CCE-43628-7
Disable: 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' for RestrictAnonymous This policy setting controls the ability of anonymous users to enumerate SAM accounts as well as shares. If you enable this policy setting, anonymous users will not be able to enumerate do ...

CCE-41561-2
Disable: 'Interactive logon: Machine account lockout threshold' for MaxDevicePasswordFailedAttempts The machine lockout policy is enforced only on those machines that have Bitlocker enabled for protecting OS volumes. Please ensure that appropriate recovery password backup policies are enabled. ...

CCE-42600-7
Select the 'Enforce drive encryption type on operating system drives' to allow_user_to_choose This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if ...

CCE-42438-2
Select the 'Enforce drive encryption type on removable data drives' to allow_user_to_choose This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if th ...

CCE-42010-9
Specify the 'Network access: Remotely accessible registry paths' for Machine This policy setting determines which registry paths will be accessible after referencing the WinReg key to determine access permissions to the paths. Note: This setting does not exist in Windows XP. There was a setting ...

CCE-44052-9
Disable: 'Require a Password When a Computer Wakes (On Battery)' Specifies whether or not the user is prompted for a password when the system resumes from sleep. Counter Measure: Configure Require a Password When a Computer Wakes (On Battery) to Enabled. Potential Impact: If you e ...

CCE-42120-6
Disable: 'Interactive logon: Smart card removal behavior' for scremoveoption This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. Counter Measure: Configure the Smart card removal behavior setting to Lock Workstation. ...

CCE-41972-1
'Specify the maximum log file size (KB) (Application Log)' for MaxSize (Min:1024 Max:2147483647 kb) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobyte ...

CCE-43557-8
Disable: 'Network access: Named Pipes that can be accessed anonymously' for NullSessionPipes This policy setting determines which communication sessions, or pipes, will have attributes and permissions that allow anonymous access. Note: When you configure this setting you specify a list of one o ...

CCE-41874-9
Disable: 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' for DisableIPSourceRouting MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) Counter Measure: Configure the MSS: (Disab ...

CCE-41682-6
Disable: 'User Account Control: Switch to the secure desktop when prompting for elevation' for PromptOnSecureDesktop This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. The options are: - Enabled: (Default) ...

CCE-42730-2
Disable: 'Disallow standard users from changing the PIN or password' This policy setting allows you to configure whether or not standard users are allowed to change BitLocker volume PINs, provided they are able to provide the existing PIN first. This policy setting is applied when you turn on B ...

CCE-42847-4
Force shutdown from a remote system This policy setting allows users to shut down Windows Vista-based computers from remote locations on the network. Anyone who has been assigned this user right can cause a denial of service (DoS) condition, which would make the computer unavailable to service user ...

CCE-41528-1
Accounts: Guest account status This policy setting determines whether the Guest account is enabled or disabled. The Guest account allows unauthenticated network users to gain access to the system. Note that this setting will have no impact when applied to the domain controller organizational unit v ...

CCE-42327-7
Disable: 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' for NoNameReleaseOnDemand MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers Counter Measure: Configure ...

CCE-42155-2
'Set time limit for disconnected sessions' to never This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By defa ...

CCE-41595-0
Disable: 'Configure use of hardware-based encryption for fixed data drives' for FDVHardwareEncryption This policy setting allows you to manage BitLocker's use of hardware-based encryption on fixed data drives and specify which encryption algorithms it can use with hardware-based encryption. Using h ...

CCE-43606-3
Disable: 'Allow all trusted apps to install' This policy setting allows you to manage the installation of app packages that do not originate from the Windows Store. If you enable this policy setting, you can install any trusted app package. A trusted app package is one that is signed with a cer ...

CCE-43854-9
Deny log on locally This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the Allow log on locally policy setting if an account is subject to both policies.Important:If you apply this security policy to the Everyone group, no one ...

CCE-42221-2
Disable: 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' for SafeDllSearchMode MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) Counter Measure: Configure the MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) entry to a value of Enabl ...

CCE-42437-4
Specify the 'Configure minimum PIN length for startup' (MinimumPIN Length Min:4 Max:20) This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length ...

CCE-43546-1
Disable: 'Network security: LAN Manager authentication level' for LmCompatibilityLevel LAN Manager (LM) is a family of early Microsoft client/server software that allows users to link personal computers together on a single network. Network capabilities include transparent file and print sharing, u ...

CCE-42995-1
Disable: 'User Account Control: Run all administrators in Admin Approval Mode' for EnableLUA This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: - En ...

CCE-42545-4
'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) for EncryptionMethodWithXtsFdv' for XTS-AES 128-bit This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you tur ...

CCE-42852-4
Disable: 'Configure Solicited Remote Assistance' for fAllowToGetHelp This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Al ...

CCE-41787-3
Disable: 'Accounts: Limit local account use of blank passwords to console logon only' This policy setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If you enable this policy setting, local account ...

CCE-44305-1
Disable: 'Interactive logon: Require Domain Controller authentication to unlock workstation' for ForceUnlockLogon Logon information is required to unlock a locked computer. For domain accounts, the Interactive logon: Require Domain Controller authentication to unlock workstation setting determines ...

CCE-43671-7
Disable: 'User Account Control: Behavior of the elevation prompt for standard users' for ConsentPromptBehaviorUser This policy setting controls the behavior of the elevation prompt for standard users. The options are: - Prompt for credentials: When an operation requires elevation of privile ...

CCE-43744-2
Disable: 'User Account Control: Only elevate executables that are signed and validated' for ValidateAdminCodeSignatures This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can c ...

CCE-41583-6
Disable: 'Prevent the computer from joining a homegroup' By default, users can add their computer to a homegroup on a home network. If you enable this policy setting, a user on this computer will not be able to add this computer to a homegroup. This setting does not affect other network sharin ...

CCE-43389-6
Disable: 'Turn off the Windows Messenger Customer Experience Improvement Program' This policy setting specifies whether Windows Messenger can collect anonymous information about how the Windows Messenger software and service is used. Counter Measure: Enable this policy setting to ensure th ...

CCE-42069-5
Create symbolic links This policy setting determines which users can create symbolic links. In Windows Vista, existing NTFS file system objects, such as files and folders, can be accessed by referring to a new kind of file system object called a symbolic link. A symbolic link is a pointer (much lik ...

CCE-42900-1
Disable: 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings' for scenoapplylegacyauditpolicy This policy setting allows administrators to enable the more precise auditing capabilities present in Windows Vista. The Audit Policy se ...

CCE-43535-4
Maximum password age This policy setting defines how long a user can use their password before it expires. Values for this policy setting range from 0 to 999 days. If you set the value to 0, the password will never expire. The default value for this policy setting is 42 days. Because attackers can ...

CCE-44442-2
'Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)' to AES 128-bit This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn ...

CCE-44049-5
Disable: 'User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop' for EnableUIADesktopToggle This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation pr ...

CCE-42788-0
Disable: 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)' for TcpMaxDataRetransmissions MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) Counter Measu ...

CCE-43913-3
Disable: 'User Account Control: Detect application installations and prompt for elevation' for EnableInstallerDetection This policy setting controls the behavior of application installation detection for the computer. The options are: - Enabled: (Default for home) When an application instal ...

CCE-41594-3
Specify the 'Allow access to BitLocker-protected removable data drives from earlier versions of Windows' for RDVDiscoveryVolumeType This policy setting configures whether or not removable data drives formatted with the FAT file system can be unlocked and viewed on computers running Windows Server 2 ...

CCE-43793-9
Disable: 'Configure use of hardware-based encryption for operating system drives' for OSHardwareEncryption This policy setting allows you to manage BitLocker's use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encrypti ...

CCE-43619-6
Disable: 'Enumerate administrator accounts on elevation' By default, all administrator accounts are displayed when you attempt to elevate a running application. Counter Measure: Enable this policy. Potential Impact: If you enable this policy setting, all local administrator accoun ...

CCE-42621-3
Deny access to this computer from the network This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on ...

CCE-43086-8
Disable: 'Allow remote access to the Plug and Play interface' This policy setting allows you to allow or deny remote access to the Plug and Play interface. If you enable this policy setting, remote connections to the Plug and Play interface are allowed. If you disable or do not c ...

CCE-42220-4
Disable: 'MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic.' for NoDefaultExempt MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic. Counter Measure: Do not configure the MSS: (NoDefaultExempt) Enable NoDefaultExempt ...

CCE-42459-8
Disable: 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing' for Enabled This policy setting determines whether the Transport Layer Security/Secure Sockets Layer (TLS/SSL) Security Provider supports only the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite. Although ...

CCE-42024-0
Disable: 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)' for PerformRouterDiscovery MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS) Counter Measure: Configure the ...

CCE-41537-2
Disable: 'Control use of BitLocker on removable drives' for RDVConfigureBDE This policy setting controls the use of BitLocker on removable data drives. This policy setting is applied when you turn on BitLocker. When this policy setting is enabled you can select property settings that control ho ...

CCE-43864-8
Disable: 'Provide the unique identifiers for your organization' for IdentificationField This policy setting allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker. These identifiers are stored as the identification field and allowed identification fi ...

CCE-42917-5
Disable: 'Turn off Internet download for Web publishing and online ordering wizards' This policy setting controls whether Windows will download a list of providers for the Web publishing and online ordering wizards. Counter Measure: Enable this setting Potential Impact: If this po ...

CCE-43657-6
Disable: 'Network security: Do not store LAN Manager hash value on next password change' for NoLMHash This policy setting determines whether the LAN Manager (LM) hash value for the new password is stored when the password is changed. The LM hash is relatively weak and prone to attack compared to th ...

CCE-42872-2
Password must meet complexity requirements This policy setting checks all new passwords to ensure that they meet basic requirements for strong passwords. When this policy is enabled, passwords must meet the following minimum requirements: - Not contain the user's account name or parts of the user's ...

CCE-41782-4
Disable: 'Allow Standby States (S1-S3) When Sleeping (On Battery)' Dictates whether or not Windows is allowed to use standby states when sleeping the computer. When this policy is enabled, Windows may use standby states to sleep the computer. If this policy is disabled, the only sleep st ...

CCE-42160-2
Specify the 'Network access: Remotely accessible registry paths and sub-paths' for Machine This policy setting determines which registry paths and sub-paths will be accessible when an application or process references the WinReg key to determine access permissions. Note: In Windows XP this sett ...

CCE-41623-0
Select the 'Enforce drive encryption type on fixed data drives' for FDVEncryptionType to allow_user_to_choose This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type h ...

CCE-43321-9
Disable: 'Deny write access to fixed drives not protected by BitLocker' This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. This policy setting is applied when you turn on BitLocker. If you enable this policy setting, all f ...

CCE-41830-1
Specify the 'Allow access to BitLocker-protected fixed data drives from earlier versions of Windows' for FDVDiscoveryVolumeType This policy setting configures whether or not fixed data drives formatted with the FAT file system can be unlocked and viewed on computers running Windows Server 2008, Win ...

CCE-42496-0
Disable: 'Do not allow password expiration time longer than required by policy' When you enable this setting, planned password expiration longer than password age dictated by "Password Settings" policy is NOT allowed. When such expiration is detected, password is changed immediately and password ex ...

CCE-41948-1
Disable: 'Network access: Let Everyone permissions apply to anonymous users' for EveryoneIncludesAnonymous This policy setting determines what additional permissions are assigned for anonymous connections to the computer. If you enable this policy setting, anonymous Windows users are allowed to per ...

CCE-44171-7
Disable: 'Turn off printing over HTTP' This policy setting allows you to disable the client computer's ability to print over HTTP, which allows the computer to print to printers on the intranet as well as the Internet. Counter Measure: Enable this setting to prevent users from submitting p ...

CCE-43898-6
Disable: 'Network security: Allow LocalSystem NULL session fallback' Allow NTLM to fall back to NULL session when used with LocalSystem. The default is TRUE up to Windows Vista and FALSE in Windows 7. Counter Measure: Configure Network security: Allow LocalSystem NULL session fallback ...

CCE-42134-7
Disable: 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients' for NTLMMinClientSec This policy setting determines which behaviors are allowed for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications t ...

CCE-43295-5
Disable: 'Allow enhanced PINs for startup' This policy setting allows you to configure whether or not enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is ...

CCE-43849-9
Disable: 'Do not process the legacy run list' This policy setting causes the run list, which is a list of programs that Windows runs automatically when it starts, to be ignored. The customized run lists for Windows Vista are stored in the registry at the following locations: - HKEY_LOCAL_MACHIN ...

CCE-44292-1
Disable: 'Do not process the run once list' This policy setting causes the run once list, which is the list of programs that Windows Vista runs automatically when it starts, to be ignored. This policy setting differs from the Do not process the legacy run list setting in that programs on this list ...

CCE-41574-5
Disable: 'Interactive logon: Do not display last user name' for DontDisplayLastUserName This policy setting determines whether the account name of the last user to log on to the client computers in your organization will be displayed in each computer's respective Windows logon screen. Enable this p ...

CCE-43453-0
Disable: 'User Account Control: Admin Approval Mode for the Built-in Administrator account' for FilterAdministratorToken This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. The options are: - Enabled: The built-in Administrator account us ...

CCE-43043-9
Disable: 'Allow network unlock at startup' This policy setting controls whether a BitLocker-protected computer that is connected to a trusted wired Local Area Network (LAN) and joined to a domain can create and use Network Key Protectors on TPM-enabled computers to automatically unlock the operatin ...

CCE-42340-0
'Specify the maximum log file size (KB)' (Security Log) This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in ...

CCE-43428-2
Deny log on as a batch job This policy setting determines which accounts will not be able to log on to the computer as a batch job. A batch job is not a batch (.bat) file, but rather a batch-queue facility. Accounts that use the Task Scheduler to schedule jobs need this user right. The Deny log on ...

CCE-42812-8
Disable: 'Audit: Audit the use of Backup and Restore privilege' for fullprivilegeauditing This policy setting determines whether to audit the use of all user privileges, including Backup and Restore, when the Audit privilege use setting is in effect. If you enable both policies, an audit event will ...

CCE-42858-1
Disable: 'User Account Control: Virtualize file and registry write failures to per-user locations' This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and w ...

CCE-43886-1
Deny log on through Remote Desktop Services This policy setting determines whether users can log on as Terminal Services clients. After the baseline member server is joined to a domain environment, there is no need to use local accounts to access the server from the network. Domain accounts can acc ...

CCE-42775-7
Disable: 'Always install with elevated privileges' Directs Windows Installer to use system permissions when it installs any program on the system. This setting extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (of ...

CCE-43848-1
Select the 'Turn off Autoplay' for NoDriveTypeAutoRun to cd-rom_and_removable_media_drives Autoplay starts to read from a drive as soon as you insert media in the drive, which causes the setup file for programs or audio media to start immediately. An attacker could use this feature to launch a prog ...

CCE-42798-9
Disable: 'Devices: Restrict CD-ROM access to locally logged-on user only' for AllocateCDRoms This policy setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. If you enable this policy setting, only the interactively logged-on user is allowed to access rem ...

CCE-42313-7
Disable: 'Turn off Search Companion content file updates' This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches. Counter Measure: Configure this policy setting to Enabled to prevent Search Companion from down ...

CCE-41607-3
Disable: 'Choose how BitLocker-protected removable drives can be recovered' for RDVRecovery This policy setting allows you to control how BitLocker-protected removable data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. ...

CCE-44168-3
Disable: 'Allow user control over installs' This policy setting permits users to change installation options that typically are available only to system administrators. If you enable this policy setting, some of the security features of Windows Installer are bypassed. It permits installations t ...

CCE-43151-0
Disable: 'Configure use of smart cards on fixed data drives' for FDVAllowUserCert This policy setting allows you to specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer. If you enable this policy setting smart cards can b ...

CCE-41660-2
Disable: 'Allow Secure Boot for integrity validation' This policy setting allows you to configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives. Secure Boot ensures that the PC's pre-boot environment only loads firmware that is digi ...

CCE-42075-2
Disable: 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' for ScreenSaverGracePeriod MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended) Counter Measure: Configure the ...

CCE-42264-2
Disable: 'Network access: Sharing and security model for local accounts' for ForceGuest This policy setting determines how network logons that use local accounts are authenticated. The Classic option allows precise control over access to resources, including the ability to assign different types of ...

CCE-42112-3
Disable: 'Validate smart card certificate usage rule compliance' for CertificateOID This policy setting allows you to associate an object identifier from a smart card certificate to a BitLocker-protected drive. This policy setting is applied when you turn on BitLocker. The object identifier is ...

CCE-44085-9
Disable: 'Turn off Data Execution Prevention' for Explorer Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer. Counter Measure: We recommend that you disable this policy setting unless you have to support legacy busine ...

CCE-41901-0
Disable: 'Require additional authentication at startup' for UseAdvancedStartup This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This pol ...

CCE-41679-2
Minimum password length This policy setting determines the least number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps 'pass phrase' is a better term than 'password.' In Mic ...

CCE-42109-9
Specify the 'Server Authentication Certificate Template' value This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate an RD Session Host server. A certificate is needed to authenticate an RD Sess ...

CCE-41482-1
Disable: 'Turn off Windows Location Provider' This policy setting turns off the Windows Location Provider feature for this computer. If you enable this policy setting, the Windows Location Provider feature will be turned off, and all programs on this computer will not be able to use the ...

CCE-41953-1
Minimum password age This policy setting determines the number of days that you must use a password before you can change it. The range of values for this policy setting is between 1 and 999 days. (You may also set the value to 0 to allow immediate password changes.) The default value for this sett ...

CCE-41475-5
Disable: 'Recovery console: Allow automatic administrative logon' for securitylevel The recovery console is a command-line environment that is used to recover from system problems. If you enable this policy setting, the administrator account is automatically logged on to the recovery console when i ...

CCE-44180-8
Disable: 'Audit: Shut down system immediately if unable to log security audits' for crashonauditfail This policy setting determines whether the system shuts down if it is unable to log Security events. It is a requirement for Trusted Computer System Evaluation Criteria (TCSEC)-C2 and Common Criteri ...

CCE-41832-7
Allow log on through Remote Desktop Services This policy setting determines which users or groups have the right to log on as a Terminal Services client. Remote desktop users require this user right. If your organization uses Remote Assistance as part of its help desk strategy, create a group and a ...

CCE-41855-8
Disable: 'System objects: Require case insensitivity for non-Windows subsystems' This policy setting determines whether case insensitivity is enforced for all subsystems. The Microsoft Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as t ...

CCE-43703-8
Disable: 'Configure use of smart cards on removable data drives' for RDVAllowUserCert This policy setting specifies whether a password is required to unlock BitLocker-protected removable data drives. If you choose to allow use of a password, you can require a password to be used, enforce complexity ...

CCE-41501-8
Select the 'Set the default behavior for AutoRun' to do_not_execute_any_autorun_commands This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines. ...

CCE-42136-2
Enforce password history This policy setting determines the number of renewed, unique passwords that have to be associated with a user account before you can reuse an old password. The value for this policy setting must be between 0 and 24 passwords. The default value for Windows Vista is 0 passwor ...

CCE-41772-5
Disable: 'Allow users to connect remotely by using Remote Desktop Services' This policy setting allows you to configure remote access to computers by using Remote Desktop Services. If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer ...

CCE-44312-7
Disable: 'Allow Remote Shell Access' This policy setting allows you to manage configuration of remote access to all supported shells to execute scripts and commands. Counter Measure: Configure Allow Remote Shell Access to Disabled. Potential Impact: If you enable this policy setti ...

CCE-41795-6
Specify the 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' value MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning Counter Measure: Configure the MSS: (WarningLe ...

CCE-43873-9
Disable: 'Configure TPM platform validation profile for native UEFI firmware configurations' for Enabled This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the com ...

CCE-41562-0
Disable: 'Recovery console: Allow floppy copy and access to all drives and all folders' for setcommand This policy setting makes the Recovery Console SET command available, which allows you to set the following recovery console environment variables: - AllowWildCards. Enables wildcard support f ...

CCE-42433-3
Disable: 'Choose how BitLocker-protected fixed drives can be recovered' for FDVRecovery This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "A ...

CCE-43105-6
Disable: 'Network access: Restrict anonymous access to Named Pipes and Shares' for restrictnullsessaccess When enabled, this policy setting restricts anonymous access to only those shares and pipes that are named in the Network access: Named pipes that can be accessed anonymously and Network access ...

CCE-42494-5
Specify the 'Password Settings' (PasswordAgeDays: Min:1 Max:365) Configures password parameters Password complexity: which characters are used when generating a new password Default: Large letters + small letters + numbers + special characters Password length Minimum: 8 cha ...

CCE-41806-1
Access this computer from the network This policy setting allows other users on the network to connect to the computer and is required by various network protocols that include Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus ( ...

CCE-42685-8
Disable: 'Choose how BitLocker-protected operating system drives can be recovered' for OSRecovery This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you t ...

CCE-43189-0
Disable: 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' for AllowOnlineID Windows 7 and Windows Server 2008 R2 introduce an extension to the Negotiate authentication package, Spnego.dll. In previous versions of Windows, Negotiate decides whether to ...

CCE-43468-8
Select the 'Devices: Allowed to format and eject removable media' to administrators_only This policy setting determines who is allowed to format and eject removable media. You can use this policy setting to prevent unauthorized users from removing data on one computer to access it on another comput ...

CCE-42856-5
Disable: 'Domain member: Disable machine account password changes' for disablepasswordchange This policy setting determines whether a domain member can periodically change its computer account password. If you enable this policy setting, the domain member will be prevented from changing its compute ...

CCE-41998-6
Disable: 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' for DisableIPSourceRouting MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) Counter Measure: Configure the MSS: (DisableIPSource ...

CCE-43929-9
Disable: 'Configure use of passwords for operating system drives' for OSPassphrase This policy setting specifies the constraints for passwords used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enfo ...

CCE-42311-1
Disable: 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' for EnableSecureUIAPaths This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location i ...

CCE-42481-2
Specify the 'Configure pre-boot recovery message and URL' value for RecoveryKeyMessage This policy setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. If you select the "Use defaul ...

CCE-43259-1
Disable: 'Configure use of passwords for removable data drives' for RDVPassphrase This policy setting allows you to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer. If you enable this policy setting smart cards can b ...

CCE-43078-5
Accounts: Rename guest account The built-in local guest account is another well-known name to attackers. Microsoft recommends to rename this account to something that does not indicate its purpose. Even if you disable this account, which is recommended, ensure that you rename it for added security. ...

CCE-42690-8
'Configure use of passwords for fixed data drives for FDVPassphrase' to false This policy setting specifies whether a password is required to unlock BitLocker-protected fixed data drives. If you choose to permit the use of a password, you can require that a password be used, enforce complexity requ ...

CCE-44287-1
Disable: 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)' for ProtectionMode This policy setting determines the strength of the default discretionary access control list (DACL) for objects. The setting helps secure objects that can be located and sha ...

CCE-42675-9
Disable: 'Turn off the offer to update to the latest version of Windows' Enables or disables the Store offer to update to the latest version of Windows. If you enable this setting, the Store application will not offer updates to the latest version of Windows. If you disable or do not config ...

CCE-43748-3
Account lockout duration This policy setting determines the length of time that must pass before a locked account is unlocked and a user can try to log on again. The setting does this by specifying the number of minutes a locked out account will remain unavailable. If the value for this policy sett ...

CCE-41710-5
Domain member: Maximum machine account password age This policy setting determines the maximum allowable age for a computer account password. By default, domain members automatically change their domain passwords every 30 days. If you increase this interval significantly or set it to 0 so that the ...

CCE-42114-9
Disable: 'Reset platform validation data after BitLocker recovery' This policy setting allows you to control whether or not platform validation data is refreshed when Windows is started following BitLocker recovery. If you enable this policy setting, platform validation data will be refreshed w ...

CCE-41525-7
Disable: 'Configure use of hardware-based encryption for removable data drives' for RDVHardwareEncryption This policy setting allows you to manage BitLocker's use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption. ...

CCE-41794-9
Disable: 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' for EnableICMPRedirect MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes Counter Measure: Configure the MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF ...

CCE-43456-3
Disable: 'Enable RPC Endpoint Mapper Client Authentication' This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service p ...

CCE-42686-6
Disable: 'Use enhanced Boot Configuration Data validation profile' This policy setting allows you to choose specific Boot Configuration Data (BCD) settings to verify during platform validation. If you enable this policy setting, you will be able to add additional settings, remove the default se ...

CCE-42894-6
Select the 'Set client connection encryption level' to low_level This policy setting specifies whether the computer that is about to host the remote connection will enforce an encryption level for all data sent between it and the client computer for the remote session. Counter Measure: Con ...

CCE-43921-6
Disable: 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode' for ConsentPromptBehaviorAdmin This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Elevate without prompting: Allows privileged ac ...

CPE    1
cpe:/o:microsoft:windows_10
*XCCDF
xccdf_org.secpod_benchmark_HIPAA_45CFR_164_Windows_10
OVAL    164
oval:org.secpod.oval:def:35258
oval:org.secpod.oval:def:35334
oval:org.secpod.oval:def:35003
oval:org.secpod.oval:def:35335
...

© SecPod Technologies