Win Server 2012

BASELINE CONFIGURATION FOR WINDOW SE
1 1 1 Account Policies
1
1 Set 'Account lockout threshold' to '5 invalid logon attempt(s)' (Scored)
2 Set 'Account lockout duration' to '15 or more minute(s)' (Scored)
3 Set 'Reset account lockout counter after' to '15 minute(s)' (Scored)
4 Set 'Minimum password length' to '14 or more character(s)' (Scored)
5 Set 'Enforce password history' to '24 or more password(s)' (Scored)
6 Set 'Password must meet complexity requirements' to 'Enabled' (Scored)
7 Set 'Store passwords using reversible encryption' to 'Disabled' (Scored)
8 Set 'Minimum password age' to '1 or more day(s)' (Scored)
1 1 1 9 Set 'Maximum password age' to '60 or fewer days' (Scored)

1 1 2 Advanced Audit Policy Configuration
1 Set 'Audit Policy: Account Logon: Credential Validation' to 'Success and Failure' (Scored)
2 Set 'Audit Policy: Account Logon: Kerberos Authentication Service' to 'No Auditing' (Scored
3 Set 'Audit Policy: Account Logon: Kerberos Service Ticket Operations' to 'No Auditing' (Scor
4 Set 'Audit Policy: Account Logon: Other Account Logon Events' to 'No Auditing' (Scored)
5 Set 'Audit Policy: Account Management: Application Group Management' to 'No Auditing' (
6 Configure 'Audit Policy: Account Management: Computer Account Management' (Scored)
7 Set 'Audit Policy: Account Management: Distribution Group Management' to 'No Auditing' (
8 Set 'Audit Policy: Account Management: Other Account Management Events' to 'Success a
9 Set 'Audit Policy: Account Management: Security Group Management' to 'Success and Failu
10 Set 'Audit Policy: Account Management: User Account Management' to 'Success and Failu
11 Set 'Audit Policy: Detailed Tracking: DPAPI Activity' to 'No Auditing' (Scored)
12 Set 'Audit Policy: Detailed Tracking: Process Creation' to 'Success' (Scored)
13 Set 'Audit Policy: Detailed Tracking: Process Termination' to 'No Auditing' (Scored)
14 Set 'Audit Policy: Detailed Tracking: RPC Events' to 'No Auditing' (Scored)
15 Set 'Audit Policy: DS Access: Detailed Directory Service Replication' to 'No Auditing' (Scor
16 Set 'Audit Policy: DS Access: Directory Service Access' to 'Success and Failure' (Scored)
17 Set 'Audit Policy: DS Access: Directory Service Changes' to 'Success and Failure' (Scored)
18 Set 'Audit Policy: DS Access: Directory Service Replication' to 'No Auditing' (Scored)
19 Set 'Audit Policy: Logon-Logoff: Account Lockout' to 'No Auditing' (Scored)
20 Set 'Audit Policy: Logon-Logoff: IPsec Extended Mode' to 'No Auditing' (Scored)
21 Set 'Audit Policy: Logon-Logoff: IPsec Main Mode' to 'No Auditing' (Scored)
22 Set 'Audit Policy: Logon-Logoff: IPsec Quick Mode' to 'No Auditing' (Scored)
23 Set 'Audit Policy: Logon-Logoff: Logoff' to 'Success' (Scored)
24 Set 'Audit Policy: Logon-Logoff: Logon' to 'Success and Failure' (Scored)
25 Set 'Audit Policy: Logon-Logoff: Network Policy Server' to 'No Auditing' (Scored)
26 Set 'Audit Policy: Logon-Logoff: Other Logon/Logoff Events' to 'No Auditing' (Scored)
27 Set 'Audit Policy: Logon-Logoff: Special Logon' to 'Success' (Scored)
28 Set 'Audit Policy: Object Access: Application Generated' to 'No Auditing' (Scored)
29 Set 'Audit Policy: Object Access: Central Access Policy Staging' to 'No Auditing' (Scored)
30 Set 'Audit Policy: Object Access: Certification Services' to 'No Auditing' (Scored)
31 Set 'Audit Policy: Object Access: Detailed File Share' to 'No Auditing' (Scored)
32 Set 'Audit Policy: Object Access: File Share' to 'No Auditing' (Scored)
33 Set 'Audit Policy: Object Access: File System' to 'No Auditing' (Scored)
34 Set 'Audit Policy: Object Access: Filtering Platform Connection' to 'No Auditing' (Scored)
35 Set 'Audit Policy: Object Access: Filtering Platform Packet Drop' to 'No Auditing' (Scored)
36 Set 'Audit Policy: Object Access: Handle Manipulation' to 'No Auditing' (Scored)
37 Set 'Audit Policy: Object Access: Kernel Object' to 'No Auditing' (Scored)
38 Set 'Audit Policy: Object Access: Other Object Access Events' to 'No Auditing' (Scored)
39 Set 'Audit Policy: Object Access: Registry' to 'No Auditing' (Scored)
40 Set 'Audit Policy: Object Access: Removable Storage' to 'No Auditing' (Scored)
41 Set 'Audit Policy: Object Access: SAM' to 'No Auditing' (Scored)
42 Set 'Audit Policy: Policy Change: Audit Policy Change' to 'Success and Failure' (Scored)
43 Set 'Audit Policy: Policy Change: Authentication Policy Change' to 'Success' (Scored)
44 Set 'Audit Policy: Policy Change: Authorization Policy Change' to 'No Auditing' (Scored)
45 Set 'Audit Policy: Policy Change: Filtering Platform Policy Change' to 'No Auditing' (Scored
46 Set 'Audit Policy: Policy Change: MPSSVC Rule-Level Policy Change' to 'No Auditing' (Scor
47 Set 'Audit Policy: Policy Change: Other Policy Change Events' to 'No Auditing' (Scored)
48 Set 'Audit Policy: Privilege Use: Non Sensitive Privilege Use' to 'No Auditing' (Scored)
49 Set 'Audit Policy: Privilege Use: Other Privilege Use Events' to 'No Auditing' (Scored)
50 Set 'Audit Policy: Privilege Use: Sensitive Privilege Use' to 'Success and Failure' (Scored)
51 Set 'Audit Policy: System: IPsec Driver' to 'Success and Failure' (Scored)
52 Set 'Audit Policy: System: Other System Events' to 'No Auditing' (Scored)
53 Set 'Audit Policy: System: Security State Change' to 'Success and Failure' (Scored)
54 Set 'Audit Policy: System: Security System Extension' to 'Success and Failure' (Scored)
1 1 2 55 Set 'Audit Policy: System: System Integrity' to 'Success and Failure' (Scored)
1 1 3 Security Options
1 1 3 1 Accounts
1 Configure 'Accounts: Rename administrator account' (Scored)
2 Configure 'Accounts: Rename guest account' (Scored)
1 1 3
1 1 3
1 3 Set 'Accounts: Limit local account use of blank passwords to console logon only' to 'En
2 Audit
3 Set 'Audit: Force audit policy subcategory settings (Windows Vista or later) to override
1 1 3
1 1 3
1 1 3
2 4 Set 'Audit: Shut down system immediately if unable to log security audits' to 'Disabled
3 DCOM 130
4 Devices
4 Set 'Devices: Allowed to format and eject removable media' to 'Administrators' (Scored
1 1 3
1 1 3
4 5 Set 'Devices: Prevent users from installing printer drivers' to 'Enabled' (Scored)
5 Domain controller
1 Set 'Domain controller: Allow server operators to schedule tasks' to 'Disabled' (Scored)
2 Set 'Domain controller: LDAP server signing requirements' to 'Require signing' (Scored)
1 1 3
1 1 3
5 3 Set 'Domain controller: Refuse machine account password changes' to 'Disabled' (Scor
6 Domain member
1 Set 'Domain member: Digitally encrypt or sign secure channel data (always)' to 'Enable
2 Set 'Domain member: Digitally encrypt secure channel data (when possible)' to 'Enable
3 Set 'Domain member: Digitally sign secure channel data (when possible)' to 'Enabled'
4 Set 'Domain member: Disable machine account password changes' to 'Disabled' (Score
5 Set 'Domain member: Maximum machine account password age' to '30 or fewer day(s
1 1 3
1 1 3
6 6 Set 'Domain member: Require strong (Windows 2000 or later) session key' to 'Enabled
7 Interactive logon
2 Configure 'Interactive logon: Message text for users attempting to log on' (Scored)
5 Set 'Interactive logon: Do not display last user name' to 'Enabled' (Scored)
6 Set 'Interactive logon: Do not require CTRL+ALT+DEL' to 'Disabled' (Scored)
7 Set 'Interactive logon: Machine inactivity limit' to '900 or fewer seconds' (Scored)
8 Set 'Interactive logon: Number of previous logons to cache (in case domain controller i
9 Set 'Interactive logon: Prompt user to change password before expiration' to '14 or mo
10 Set 'Interactive logon: Require Domain Controller authentication to unlock workstatio
11 Set 'Interactive logon: Smart card removal behavior' to 'Lock Workstation' (Scored)
1 1 3
1 1 3
7 12 Set 'Interactive logon: Machine account lockout threshold' to 10 or fewer invalid logon
8 Microsoft network client
1 Set 'Microsoft network client: Digitally sign communications (always)' to 'Enabled' (Sco
2 Set 'Microsoft network client: Digitally sign communications (if server agrees)' to 'Enab
1 1 3
1 1 3
8 3 Set 'Microsoft network client: Send unencrypted password to third-party SMB servers' t
9 Microsoft network server
2 Set 'Microsoft network server: Amount of idle time required before suspending session
3 Set 'Microsoft network server: Digitally sign communications (always)' to 'Enabled' (Sco
4 Set 'Microsoft network server: Digitally sign communications (if client agrees)' to 'Enab
1 1 3
1 1 3
9 5 Set 'Microsoft network server: Disconnect clients when logon hours expire' to 'Enabled
10 MSS
10 11 Set 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' to 'Disable
10 12 Set 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects a
10 13 Set 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects agains
10 14 Set 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' to 'Ena
10 15 Set 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver gra
1 1 3
1 1 3
10 16 Set 'MSS: (WarningLevel) Percentage threshold for the security event log at which the
11 Network access
11 4 Set 'Network access: Allow anonymous SID/Name translation' to 'Disabled' (Scored)
11 5 Set 'Network access: Do not allow anonymous enumeration of SAM accounts and share
11 6 Set 'Network access: Do not allow anonymous enumeration of SAM accounts' to 'Enabl
11 7 Set 'Network access: Let Everyone permissions apply to anonymous users' to 'Disabled
11 8 Set 'Network access: Remotely accessible registry paths and sub-paths' to 'System\Cur
11 9 Set 'Network access: Remotely accessible registry paths' to 'System\CurrentControlSet
11 10 Set 'Network access: Restrict anonymous access to Named Pipes and Shares' to 'Enab
1 1 3
1 1 3
11 11 Set 'Network access: Sharing and security model for local accounts' to 'Classic - local
12 Network security
12 11 Set 'Network security: Allow Local System to use computer identity for NTLM' to 'Enab
12 12 Set 'Network security: Allow LocalSystem NULL session fallback' to 'Disabled' (Scored
12 13 Set 'Network security: Do not store LAN Manager hash value on next password chang
12 14 Set 'Network security: LAN Manager authentication level' to 'Send NTLMv2 response o
12 15 Set 'Network security: LDAP client signing requirements' to 'Negotiate signing' (Score
12 16 Set 'Network security: Minimum session security for NTLM SSP based (including secur
1 1 3
1 1 3
12 17 Set 'Network security: Minimum session security for NTLM SSP based (including secur
13 Recovery console
13 1 Set 'Recovery console: Allow automatic administrative logon' to 'Disabled' (Scored)
1 1 3
1 1 3
13 2 Set 'Recovery console: Allow floppy copy and access to all drives and all folders' to 'Dis
14 Shutdown
14 1 Set 'Shutdown: Allow system to be shut down without having to log on' to 'Disabled' (S
1 1 3
1 1 3
14 2 Set 'Shutdown: Clear virtual memory pagefile' to 'Disabled' (Scored)

15 System cryptography
1 1 3
1 1 3
15 2 Set 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and
16 System objects
16 1 Set 'System objects: Require case insensitivity for non-Windows subsystems' to 'Enable
1 1 3
1 1 3
16 2 Set 'System objects: Strengthen default permissions of internal system objects (e.g Sy
17 System settings
1 1 3
1 1 3
17 2 Set 'System settings: Use Certificate Rules on Windows Executables for Software Restr
18 User Account Control
18 1 Set 'User Account Control: Admin Approval Mode for the Built-in Administrator account
18 2 Set 'User Account Control: Allow UIAccess applications to prompt for elevation without
18 3 Set 'User Account Control: Behavior of the elevation prompt for administrators in Admi
18 4 Set 'User Account Control: Behavior of the elevation prompt for standard users' to 'Prom
18 5 Set 'User Account Control: Detect application installations and prompt for elevation' to
18 6 Set 'User Account Control: Only elevate executables that are signed and validated' to '
18 7 Set 'User Account Control: Only elevate UIAccess applications that are installed in secu
18 8 Set 'User Account Control: Run all administrators in Admin Approval Mode' to 'Enabled'
18 9 Set 'User Account Control: Switch to the secure desktop when prompting for elevation'
1 1 3 18 10 Set 'User Account Control: Virtualize file and registry write failures to per-user location
1 1 4 User Rights Assignments
3 Set 'Access Credential Manager as a trusted caller' to 'No One' (Scored)
4 Configure 'Access this computer from the network' (Scored)
5 Set 'Act as part of the operating system' to 'No One' (Scored)
6 Set 'Add workstations to domain' to 'Administrators' (Scored)
7 Set 'Adjust memory quotas for a process' to 'Administrators, Local Service, Network Servic
8 Set 'Allow log on locally' to 'Administrators' (Scored)
9 Set 'Allow log on through Remote Desktop Services' to 'Administrators' (Scored)
10 Set 'Back up files and directories' to 'Administrators' (Scored)
11 Configure 'Bypass traverse checking' (Scored)
12 Set 'Change the system time' to 'LOCAL SERVICE, Administrators' (Scored)
13 Set 'Change the time zone' to 'LOCAL SERVICE, Administrators' (Scored)
14 Set 'Create a pagefile' to 'Administrators' (Scored)
15 Set 'Create a token object' to 'No One' (Scored)
16 Set 'Create global objects' to 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVI
17 Set 'Create permanent shared objects' to 'No One' (Scored)
18 Set 'Create symbolic links' to 'Administrators' (Scored)
19 Set 'Debug programs' to 'Administrators' (Scored)
20 Set 'Deny access to this computer from the network' to 'Guests' (Scored)
21 Set 'Deny log on as a batch job' to 'Guests' (Scored)
22 Set 'Deny log on as a service' to 'No One' (Scored)
23 Set 'Deny log on locally' to 'Guests' (Scored)
24 Configure 'Enable computer and user accounts to be trusted for delegation' (Scored)
25 Set 'Force shutdown from a remote system' to 'Administrators' (Scored)
26 Set 'Generate security audits' to 'Local Service, Network Service' (Scored)
27 Set 'Impersonate a client after authentication' to 'Administrators, SERVICE, Local Service
28 Set 'Increase a process working set' to 'Administrators, Local Service' (Scored)
29 Set 'Increase scheduling priority' to 'Administrators' (Scored)
30 Set 'Load and unload device drivers' to 'Administrators' (Scored)
31 Set 'Lock pages in memory' to 'No One' (Scored)
32 Set 'Log on as a batch job' to 'Administrators' (Scored)
33 Set 'Manage auditing and security log' to 'Administrators' (Scored)
34 Set 'Modify an object label' to 'No One' (Scored)
35 Set 'Modify firmware environment values' to 'Administrators' (Scored)
36 Set 'Perform volume maintenance tasks' to 'Administrators' (Scored)
37 Set 'Profile single process' to 'Administrators' (Scored)
38 Set 'Profile system performance' to 'Administrators,NT SERVICE\WdiServiceHost' (Scored)
39 Set 'Remove computer from docking station' to 'Administrators' (Scored)
40 Set 'Replace a process level token' to 'Local Service, Network Service' (Scored)
41 Set 'Restore files and directories' to 'Administrators' (Scored)
42 Set 'Shut down the system' to 'Administrators' (Scored)
43 Set 'Synchronize directory service data' to 'No One' (Scored)
1 1 4 44 Set 'Take ownership of files or other objects' to 'Administrators' (Scored)

1 1 5 Windows Firewall With Advanced Security
1 1 5 1 Public Profile
1 Set 'Inbound connections' to 'Enabled:Block (default)' (Scored)
2 Set 'Windows Firewall: Public: Allow unicast response' to 'No' (Scored)
3 Set 'Windows Firewall: Public: Apply local connection security rules' to 'Yes' (Scored)
4 Set 'Windows Firewall: Public: Apply local firewall rules' to 'Yes (default)' (Scored)
5 Set 'Windows Firewall: Public: Display a notification' to 'Yes' (Scored)
6 Set 'Windows Firewall: Public: Firewall state' to 'On (recommended)' (Scored)
1 1 5
1 1 5
1 7 Set 'Windows Firewall: Public: Outbound connections' to 'Allow (default)' (Scored)

2 Private Profile
2 Set 'Windows Firewall: Private: Allow unicast response' to 'No' (Scored)
3 Set 'Windows Firewall: Private: Apply local connection security rules' to 'Yes (default)' (
4 Set 'Windows Firewall: Private: Apply local firewall rules' to 'Yes (default)' (Scored)
5 Set 'Windows Firewall: Private: Display a notification' to 'Yes (default)' (Scored)
6 Set 'Windows Firewall: Private: Firewall state' to 'On (recommended)' (Scored)
7 Set 'Windows Firewall: Private: Outbound connections' to 'Allow (default)' (Scored)
1 1 5
3 Domain Profile
2 Set 'Windows Firewall: Domain: Allow unicast response' to 'No' (Scored)
3 Set 'Windows Firewall: Domain: Apply local connection security rules' to 'Yes (default)'
4 Set 'Windows Firewall: Domain: Apply local firewall rules' to 'Yes (default)' (Scored)
5 Set 'Windows Firewall: Domain: Display a notification' to 'Yes (default)' (Scored)
6 Set 'Windows Firewall: Domain: Firewall state' to 'On (recommended)' (Scored)
1
1
1
1
1
2
2
2
5 3 7 Set 'Windows Firewall: Domain: Outbound connections' to 'Allow (default)' (Scored)

Administrative Templates
1 Windows Components
1 1 AutoPlay Policies
1 2 1
1 2 1
1 1 Set 'Turn off Autoplay on:' to 'Enabled:All drives' (Scored)

2 Event Log
1 Set 'Security: Maximum Log Size (KB)' to 'Enabled:196608 or greater' (Scored)
2 Set 'System: Maximum Log Size (KB)' to 'Enabled:32768 or greater' (Scored)
3 Set 'Application: Maximum Log Size (KB)' to 'Enabled:32768 or greater' (Scored)
4 Set 'Security: Control Event Log behavior when the log file reaches its maximum size' t
5 Set 'System: Control Event Log behavior when the log file reaches its maximum size' to
1 2 1
1 2 1
1 2 1
2 6 Set 'Application: Control Event Log behavior when the log file reaches its maximum siz
3 Terminal Services
4 Windows Installer
1 Set 'Always install with elevated privileges' to 'Disabled' (Scored)
BASELINE CONFIGURATION FOR WINDOW SERVER 2012
nvalid logon attempt(s)' (Scored)
r more minute(s)' (Scored)
er' to '15 minute(s)' (Scored)

or more character(s)' (Scored)
r more password(s)' (Scored)
equirements' to 'Enabled' (Scored)
encryption' to 'Disabled' (Scored)
more day(s)' (Scored)

fewer days' (Scored)
ential Validation' to 'Success and Failure' (Scored)
eros Authentication Service' to 'No Auditing' (Scored)
eros Service Ticket Operations' to 'No Auditing' (Scored)
r Account Logon Events' to 'No Auditing' (Scored)
t: Application Group Management' to 'No Auditing' (Scored)
gement: Computer Account Management' (Scored)
t: Distribution Group Management' to 'No Auditing' (Scored)
t: Other Account Management Events' to 'Success and Failure' (Scored)
t: Security Group Management' to 'Success and Failure' (Scored)
nt: User Account Management' to 'Success and Failure' (Scored)
DPAPI Activity' to 'No Auditing' (Scored)
rocess Creation' to 'Success' (Scored)
rocess Termination' to 'No Auditing' (Scored)
RPC Events' to 'No Auditing' (Scored)
d Directory Service Replication' to 'No Auditing' (Scored)
y Service Access' to 'Success and Failure' (Scored)
y Service Changes' to 'Success and Failure' (Scored)
y Service Replication' to 'No Auditing' (Scored)
unt Lockout' to 'No Auditing' (Scored)
Extended Mode' to 'No Auditing' (Scored)
Main Mode' to 'No Auditing' (Scored)
Quick Mode' to 'No Auditing' (Scored)
ff' to 'Success' (Scored)
n' to 'Success and Failure' (Scored)
ork Policy Server' to 'No Auditing' (Scored)
r Logon/Logoff Events' to 'No Auditing' (Scored)
al Logon' to 'Success' (Scored)
ication Generated' to 'No Auditing' (Scored)
tral Access Policy Staging' to 'No Auditing' (Scored)
ification Services' to 'No Auditing' (Scored)
ailed File Share' to 'No Auditing' (Scored)
Share' to 'No Auditing' (Scored)
System' to 'No Auditing' (Scored)
ring Platform Connection' to 'No Auditing' (Scored)
ring Platform Packet Drop' to 'No Auditing' (Scored)
dle Manipulation' to 'No Auditing' (Scored)
el Object' to 'No Auditing' (Scored)
er Object Access Events' to 'No Auditing' (Scored)
stry' to 'No Auditing' (Scored)
ovable Storage' to 'No Auditing' (Scored)
' to 'No Auditing' (Scored)
t Policy Change' to 'Success and Failure' (Scored)
hentication Policy Change' to 'Success' (Scored)
horization Policy Change' to 'No Auditing' (Scored)
ring Platform Policy Change' to 'No Auditing' (Scored)
SVC Rule-Level Policy Change' to 'No Auditing' (Scored)
er Policy Change Events' to 'No Auditing' (Scored)
Sensitive Privilege Use' to 'No Auditing' (Scored)
r Privilege Use Events' to 'No Auditing' (Scored)
tive Privilege Use' to 'Success and Failure' (Scored)
r' to 'Success and Failure' (Scored)
em Events' to 'No Auditing' (Scored)
ate Change' to 'Success and Failure' (Scored)
ystem Extension' to 'Success and Failure' (Scored)
egrity' to 'Success and Failure' (Scored)
inistrator account' (Scored)
t account' (Scored)
use of blank passwords to console logon only' to 'Enabled' (Scored)
ategory settings (Windows Vista or later) to override audit policy category settings' to 'Enabled' (Scored)
ediately if unable to log security audits' to 'Disabled' (Scored)
d eject removable media' to 'Administrators' (Scored)
nstalling printer drivers' to 'Enabled' (Scored)
er operators to schedule tasks' to 'Disabled' (Scored)
r signing requirements' to 'Require signing' (Scored)
chine account password changes' to 'Disabled' (Scored)
crypt or sign secure channel data (always)' to 'Enabled' (Scored)
crypt secure channel data (when possible)' to 'Enabled' (Scored)
n secure channel data (when possible)' to 'Enabled' (Scored)
hine account password changes' to 'Disabled' (Scored)
machine account password age' to '30 or fewer day(s)' (Scored)
ng (Windows 2000 or later) session key' to 'Enabled' (Scored)
age text for users attempting to log on' (Scored)
ay last user name' to 'Enabled' (Scored)
ire CTRL+ALT+DEL' to 'Disabled' (Scored)
ctivity limit' to '900 or fewer seconds' (Scored)
previous logons to cache (in case domain controller is not available)' to '4 or fewer logon(s)' (Scored)
to change password before expiration' to '14 or more day(s)' (Scored)
main Controller authentication to unlock workstation' to 'Disabled' (Scored)
removal behavior' to 'Lock Workstation' (Scored)
ccount lockout threshold' to 10 or fewer invalid logon attempts (Scored)
ally sign communications (always)' to 'Enabled' (Scored)
ally sign communications (if server agrees)' to 'Enabled' (Scored)
unencrypted password to third-party SMB servers' to 'Disabled' (Scored)
ount of idle time required before suspending session' to '15 or fewer minute(s)' (Scored)
tally sign communications (always)' to 'Enabled' (Scored)
tally sign communications (if client agrees)' to 'Enabled' (Scored)
onnect clients when logon hours expire' to 'Enabled' (Scored)
ble Automatic Logon (not recommended)' to 'Disabled' (Scored)
g IPv6) IP source routing protection level (protects against packet spoofing)' to 'Highest protection, source routin
g) IP source routing protection level (protects against packet spoofing)' to 'Highest protection, source routing is
nable Safe DLL search mode (recommended)' to 'Enabled' (Scored)
od) The time in seconds before the screen saver grace period expires (0 recommended)' to '0' (Scored)
age threshold for the security event log at which the system will generate a warning' to '09 or less' (Scored)
mous SID/Name translation' to 'Disabled' (Scored)
anonymous enumeration of SAM accounts and shares' to 'Enabled' (Scored)
anonymous enumeration of SAM accounts' to 'Enabled' (Scored)
permissions apply to anonymous users' to 'Disabled' (Scored)
essible registry paths and sub-paths' to 'System\CurrentControlSet\Control\Print\Printers System\CurrentControl
essible registry paths' to 'System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\S
nymous access to Named Pipes and Shares' to 'Enabled' (Scored)
security model for local accounts' to 'Classic - local users authenticate as themselves' (Scored)
System to use computer identity for NTLM' to 'Enabled' (Scored)
System NULL session fallback' to 'Disabled' (Scored)
e LAN Manager hash value on next password change' to 'Enabled' (Scored)
ger authentication level' to 'Send NTLMv2 response only Refuse LM & NTLM' (Scored)
t signing requirements' to 'Negotiate signing' (Scored)
ession security for NTLM SSP based (including secure RPC) clients' to 'Require NTLMv2 session security,Require
ession security for NTLM SSP based (including secure RPC) servers' to 'Require NTLMv2 session security,Require
matic administrative logon' to 'Disabled' (Scored)
y copy and access to all drives and all folders' to 'Disabled' (Scored)
shut down without having to log on' to 'Disabled' (Scored)
ry pagefile' to 'Disabled' (Scored)
S compliant algorithms for encryption, hashing, and signing' to 'Enabled' (Scored)
insensitivity for non-Windows subsystems' to 'Enabled' (Scored)
efault permissions of internal system objects (e.g Symbolic Links)' to 'Enabled' (Scored)
te Rules on Windows Executables for Software Restriction Policies' to 'Enabled' (Scored)
Approval Mode for the Built-in Administrator account' to 'Enabled' (Scored)
Access applications to prompt for elevation without using the secure desktop' to 'Disabled' (Scored)
r of the elevation prompt for administrators in Admin Approval Mode' to 'Prompt for consent for non-Windows bi
r of the elevation prompt for standard users' to 'Prompt for credentials' (Scored)
application installations and prompt for elevation' to 'Enabled' (Scored)
evate executables that are signed and validated' to 'Disabled' (Scored)
evate UIAccess applications that are installed in secure locations' to 'Enabled' (Scored)
administrators in Admin Approval Mode' to 'Enabled' (Scored)
o the secure desktop when prompting for elevation' to 'Enabled' (Scored)
ize file and registry write failures to per-user locations' to 'Enabled' (Scored)
rusted caller' to 'No One' (Scored)
the network' (Scored)
m' to 'No One' (Scored)
dministrators' (Scored)
ess' to 'Administrators, Local Service, Network Service' (Scored)
ators' (Scored)
ktop Services' to 'Administrators' (Scored)
'Administrators' (Scored)
(Scored)
CAL SERVICE, Administrators' (Scored)
L SERVICE, Administrators' (Scored)
tors' (Scored)
e' (Scored)
strators, SERVICE, LOCAL SERVICE, NETWORK SERVICE' (Scored)
s' to 'No One' (Scored)

strators' (Scored)
tors' (Scored)
om the network' to 'Guests' (Scored)
uests' (Scored)
One' (Scored)
r accounts to be trusted for delegation' (Scored)
ystem' to 'Administrators' (Scored)
al Service, Network Service' (Scored)
ntication' to 'Administrators, SERVICE, Local Service, Network Service' (Scored)
to 'Administrators, Local Service' (Scored)
Administrators' (Scored)
to 'Administrators' (Scored)
ne' (Scored)
istrators' (Scored)
g' to 'Administrators' (Scored)
e' (Scored)
lues' to 'Administrators' (Scored)
sks' to 'Administrators' (Scored)
strators' (Scored)
Administrators,NT SERVICE\WdiServiceHost' (Scored)
station' to 'Administrators' (Scored)
o 'Local Service, Network Service' (Scored)
Administrators' (Scored)
nistrators' (Scored)
ata' to 'No One' (Scored)
objects' to 'Administrators' (Scored)
led:Block (default)' (Scored)
w unicast response' to 'No' (Scored)
y local connection security rules' to 'Yes' (Scored)
y local firewall rules' to 'Yes (default)' (Scored)
lay a notification' to 'Yes' (Scored)
wall state' to 'On (recommended)' (Scored)
ound connections' to 'Allow (default)' (Scored)
w unicast response' to 'No' (Scored)
ply local connection security rules' to 'Yes (default)' (Scored)
ply local firewall rules' to 'Yes (default)' (Scored)
play a notification' to 'Yes (default)' (Scored)
wall state' to 'On (recommended)' (Scored)
bound connections' to 'Allow (default)' (Scored)
ow unicast response' to 'No' (Scored)
ply local connection security rules' to 'Yes (default)' (Scored)
ply local firewall rules' to 'Yes (default)' (Scored)
splay a notification' to 'Yes (default)' (Scored)
ewall state' to 'On (recommended)' (Scored)
tbound connections' to 'Allow (default)' (Scored)
led:All drives' (Scored)
KB)' to 'Enabled:196608 or greater' (Scored)
B)' to 'Enabled:32768 or greater' (Scored)
e (KB)' to 'Enabled:32768 or greater' (Scored)
havior when the log file reaches its maximum size' to 'Disabled' (Scored)
havior when the log file reaches its maximum size' to 'Disabled' (Scored)
behavior when the log file reaches its maximum size' to 'Disabled' (Scored)
rivileges' to 'Disabled' (Scored)
Config Location
Computer Configuration\Windows Settings\Security Settings\Account
Policies\Account Lockout Policy\Account lockout threshold
Policies\Account Lockout Policy\Account lockout duration
Policies\Account Lockout Policy\Reset account lockout counter after
Policies\Password Policy\Minimum password length
Policies\Password Policy\Enforce password history
Policies\Password Policy\Password must meet complexity requirements
Policies\Password Policy\Store passwords using reversible encryption
Policies\Password Policy\Minimum password age
Policies\Password Policy\Maximum password age
Computer Configuration\Windows Settings\Security Settings\Advanced
Audit Policy Configuration\Audit Policies\Account Logon\Audit Policy:
Account Logon: Credential Validation
Account Logon: Kerberos Authentication Service
Account Logon: Kerberos Service Ticket Operations
Account Logon: Other Account Logon Events
Audit Policy Configuration\Audit Policies\Account Management\Audit
Policy: Account Management: Application Group Managemen

Policy: Account Management: Computer Account Management

Policy: Account Management: Distribution Group Management
Policy: Account Management: Other Account Management Events
Policy: Account Management: Security Group Management
Policy: Account Management: User Account Management
Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit Policy:
Detailed Tracking: DPAPI Activity
Detailed Tracking: Process Creation
Detailed Tracking: Process Termination
Detailed Tracking: RPC Events
Audit Policy Configuration\Audit Policies\DS Access\Audit Policy: DS
Access: Detailed Directory Service Replication
Access: Directory Service Access
Access: Directory Service Changes
Access: Directory Service Replication
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Account Lockout
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: IPsec Extended Mode

Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: IPsec Main Mode
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: IPsec Quick Mode
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Logoff
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Logon
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Network Policy Server
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Other Logon/Logoff Events
Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Policy: LogonLogoff: Special Logon
Audit Policy Configuration\Audit Policies\Object Access\Audit Policy: Object
Access: Application Generated
Access: Central Access Policy Staging
Access: Certification Services
Access: Detailed File Share
Access: File Share
Access: File System
Access: Filtering Platform Connection
Access: Filtering Platform Packet Drop

Access: Handle Manipulation
Access: Kernel Object
Access: Other Object Access Events
Access: Registry
Access: Removable Storage
Access: SAM
Audit Policy Configuration\Audit Policies\Policy Change\Audit Policy: Policy
Change: Audit Policy Change
Change: Authentication Policy Change
Change: Authorization Policy Change
Change: Filtering Platform Policy Change
Change: MPSSVC Rule- Level Policy Change
Change: Other Policy Change Events
Audit Policy Configuration\Audit Policies\Privilege Use\Audit Policy:
Privilege Use: Non Sensitive Privilege Use
Privilege Use: Other Privilege Use Events
Privilege Use: Sensitive Privilege Use

Audit Policy Configuration\Audit Policies\System\Audit Policy: System:
IPsec Driver
Other System Events
Security State Change
Security System Extension
System Integrity
Computer Configuration\Windows Settings\Security Settings\Local

Policies\Security Options\Accounts: Limit local account use of blank
passwords to console logon only

Policies\Security Options\Audit: Force audit policy subcategory settings
(Windows Vista or later) to override audit policy category settings
Policies\Security Options\Audit: Shut down system immediately if unable
to log security audits

Policies\Security Options\Devices: Allowed to format and eject removable
media

Policies\Security Options\Devices: Prevent users from installing printer
drivers
Policies\Security Options\Domain controller: Allow server operators to
schedule tasks
Policies\Security Options\Domain controller: LDAP server signing
requirements
Policies\Security Options\Domain controller: Refuse machine account
password changes
Policies\Security Options\Domain member: Digitally encrypt or sign secure
channel data (always)
Policies\Security Options\Domain member: Digitally encrypt secure
channel data (when possible)
Policies\Security Options\Domain member: Digitally sign secure channel
data (when possible)
Policies\Security Options\Domain member: Disable machine account
password changes
Policies\Security Options\Domain member: Maximum machine account
password age
Policies\Security Options\Domain member: Require strong (Windows 2000
or later) session key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policie
s\System\LegalNoticeText
Policies\Security Options\Interactive logon: Do not display last user name
Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DEL

Policies\Security Options\Interactive logon: Machine inactivity limit
Policies\Security Options\Interactive logon: Number of previous logons to
cache (in case domain controller is not available)
Policies\Security Options\Interactive logon: Prompt user to change
password before expiration
Policies\Security Options\Interactive logon: Require Domain Controller
authentication to unlock workstation
Policies\Security Options\Interactive logon: Smart card removal behavior
Policies\Security Options\Interactive logon: Machine account lockout
threshold
Policies\Security Options\Microsoft network client: Digitally sign
communications (always)
Policies\Security Options\Microsoft network client: Digitally sign
communications (if server agrees)
Policies\Security Options\Microsoft network client: Send unencrypted
password to third-party SMB servers
Policies\Security Options\Microsoft network server: Amount of idle time
required before suspending session
Policies\Security Options\Microsoft network server: Digitally sign
communications (always)
Policies\Security Options\Microsoft network server: Digitally sign
communications (if client agrees)
Policies\Security Options\Microsoft network server: Disconnect clients
when logon hours expire
Policies\Security Options\MSS: (AutoAdminLogon) Enable Automatic Logon
(not recommended)
Policies\Security Options\MSS: (DisableIPSourceRouting IPv6) IP source
routing protection level (protects against packet spoofing)

Policies\Security Options\MSS: (DisableIPSourceRouting) IP source routing
protection level (protects against packet spoofing)
Policies\Security Options\MSS: (SafeDllSearchMode) Enable Safe DLL
search mode (recommended)
Policies\Security Options\MSS: (ScreenSaverGracePeriod) The time in
seconds before the screen saver grace period expires (0 recommended)
Policies\Security Options\MSS: (WarningLevel) Percentage threshold for
the security event log at which the system will generate a warning
Policies\Security Options\Network access: Allow anonymous SID/Name
translation
Policies\Security Options\Network access: Do not allow anonymous
enumeration of SAM accounts and shares
Policies\Security Options\Network access: Do not allow anonymous
enumeration of SAM accounts
Policies\Security Options\Network access: Let Everyone permissions apply
to anonymous users
Policies\Security Options\Network access: Remotely accessible registry
paths and sub-paths
Policies\Security Options\Network access: Remotely accessible registry
paths
Policies\Security Options\Network access: Restrict anonymous access to
Named Pipes and Shares
Policies\Security Options\Network access: Sharing and security model for
local accounts
Policies\Security Options\Network security: Allow Local System to use
computer identity for NTLM
Policies\Security Options\Network security: Allow LocalSystem NULL
session fallback

Policies\Security Options\Network security: Do not store LAN Manager
hash value on next password change
Policies\Security Options\Network security: LAN Manager authentication
level
Policies\Security Options\Network security: LDAP client signing
requirements
Policies\Security Options\Network security: Minimum session security for
NTLM SSP based (including secure RPC) clients
Policies\Security Options\Network security: Minimum session security for
NTLM SSP based (including secure RPC) servers
Policies\Security Options\Recovery console: Allow automatic
administrative logon
Policies\Security Options\Recovery console: Allow floppy copy and access
to all drives and all folders
Policies\Security Options\Shutdown: Allow system to be shut down without
having to log on
Policies\Security Options\Shutdown: Clear virtual memory pagefile
Policies\Security Options\System cryptography: Use FIPS compliant
algorithms for encryption, hashing, and signing
Policies\Security Options\System objects: Require case insensitivity for
non-Windows subsystems
Policies\Security Options\System objects: Strengthen default permissions
of internal system objects (e.g. Symbolic Links)
Policies\Security Options\System settings: Use Certificate Rules on
Windows Executables for Software Restriction Policies
Policies\Security Options\User Account Control: Admin Approval Mode for
the Built-in Administrator account

Policies\Security Options\User Account Control: Allow UIAccess
applications to prompt for elevation without using the secure desktop
Policies\Security Options\User Account Control: Behavior of the elevation
prompt for administrators in Admin Approval Mode
Policies\Security Options\User Account Control: Behavior of the elevation
prompt for standard users
Policies\Security Options\User Account Control: Detect application
installations and prompt for elevation
Policies\Security Options\User Account Control: Only elevate executables
that are signed and validated
Policies\Security Options\User Account Control: Only elevate UIAccess
applications that are installed in secure locations
Policies\Security Options\User Account Control: Run all administrators in
Admin Approval Mode
Policies\Security Options\User Account Control: Switch to the secure
desktop when prompting for elevation
Policies\Security Options\User Account Control: Virtualize file and registry
write failures to per-user locations
Policies\User Rights Assignment\Access Credential Manager as a trusted
caller
Policies\User Rights Assignment\Access this computer from the network
Policies\User Rights Assignment\Act as part of the operating system
Policies\User Rights Assignment\Add workstations to domain
Policies\User Rights Assignment\Adjust memory quotas for a process
Policies\User Rights Assignment\Allow log on locally
Policies\User Rights Assignment\Allow log on through Remote Desktop
Services

Policies\User Rights Assignment\Allow log on through Remote Desktop
Services
Policies\User Rights Assignment\Bypass traverse checking
Policies\User Rights Assignment\Change the system time
Policies\User Rights Assignment\Change the time zone
Policies\User Rights Assignment\Create a pagefile
Policies\User Rights Assignment\Create a token object
Policies\User Rights Assignment\Create global objects
Policies\User Rights Assignment\Create permanent shared objects
Policies\User Rights Assignment\Create symbolic links
Policies\User Rights Assignment\Debug programs
Policies\User Rights Assignment\Deny access to this computer from the
network
Policies\User Rights Assignment\Deny log on as a batch job
Policies\User Rights Assignment\Deny log on as a service
Policies\User Rights Assignment\Deny log on locally
Policies\User Rights Assignment\Enable computer and user accounts to be
trusted for delegation
Policies\User Rights Assignment\Force shutdown from a remote system
Policies\User Rights Assignment\Generate security audits
Policies\User Rights Assignment\Impersonate a client after authentication
Policies\User Rights Assignment\Increase a process working set
Policies\User Rights Assignment\Increase scheduling priority
Policies\User Rights Assignment\Load and unload device drivers

Policies\User Rights Assignment\Lock pages in memory
Policies\User Rights Assignment\Log on as a batch job
Policies\User Rights Assignment\Manage auditing and security log
Policies\User Rights Assignment\Modify an object label
Policies\User Rights Assignment\Modify firmware environment values
Policies\User Rights Assignment\Perform volume maintenance tasks
Policies\User Rights Assignment\Profile single process
Policies\User Rights Assignment\Profile system performance
Policies\User Rights Assignment\Remove computer from docking station
Policies\User Rights Assignment\Replace a process level token
Policies\User Rights Assignment\Restore files and directories
Policies\User Rights Assignment\Shut down the system
Policies\User Rights Assignment\Synchronize directory service data
Policies\User Rights Assignment\Take ownership of files or other objects
Computer Configuration\Windows Settings\Security Settings\Windows

Firewall with Advanced Security\Windows Firewall with Advanced
Security\Windows Firewall Properties\Public Profile\Windows Firewall:
Public: Inbound connections\Windows Firewall: Public: Inbound
connections
Public: Allow unicast response
Public: Apply local connection security rules

Public: Apply local firewall rules
Public: Display a notification
Public: Firewall state
Public: Outbound connections
Security\Windows Firewall Properties\Private Profile\Windows Firewall:
Private: Inbound connections\Windows Firewall: Private: Inbound
connections
Private: Allow unicast response
Private: Apply local connection security rules
Private: Apply local firewall rule
Private: Display a notification
Private: Firewall state
Private: Outbound connections

Security\Windows Firewall Properties\Domain Profile\Windows Firewall:
Domain: Inbound connections\Windows Firewall: Domain: Inbound
connections
Domain: Allow unicast response
Domain: Apply local connection security rules
Domain: Apply local firewall rules
Domain: Display a notification
Domain: Firewall state
Domain: Outbound connections
Computer Configuration\Administrative Templates\Windows

Components\AutoPlay Policies\Turn off Autoplay\Turn off Autoplay
Components\Event Log Service\Security\Specify the maximum log file size
(KB)\Specify the maximum log file size (KB)
Components\Event Log Service\System\Specify the maximum log file size
(KB)\Specify the maximum log file size (KB)
Components\Event Log Service\Application\Specify the maximum log file
size (KB)\Specify the maximum log file size (KB)

Components\Event Log Service\Security\Control Event Log behavior when
the log file reaches its maximum size
Components\Event Log Service\System\Control Event Log behavior when
the log file reaches its maximum size
Components\Event Log Service\Application\Control Event Log behavior
when the log file reaches its maximum size

Components\Windows Installer\Always install with elevated privileges
Recommended
Domain Controller
Member Server
5 invalid logon attempt(s)
Yes
Yes
15 or more minute(s).
Yes
Yes
15 minute(s)
Yes
Yes
14 or more character
Yes
Yes
24 or more password
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
1 or more day(s)
Yes
Yes
60 or fewer days
Yes
Yes
Success and Failure
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
Level 1 - Domain Controller. The

recommended state for this setting is:
Success and Failure. Level 1 - Member
Server. The recommended state for this
setting is: Success.
Yes
Yes
No Auditing
Yes
Yes
Success and Failure
Yes
Yes
Success and Failure
Yes
Yes
Success and Failure
Yes
Yes
No Auditing
Yes
Yes
Success
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
No
Success and Failure
Yes
No
Success and Failure
Yes
No
No Auditing
Yes
No
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
Success
Yes
Yes
Success and Failure
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
Success
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
Success and Failure
Yes
Yes
Success
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
No Auditing
Yes
Yes
Success and Failure
Yes
Yes
Success and Failure
Yes
Yes
No Auditing
Yes
Yes
Success and Failure
Yes
Yes
Success and Failure
Yes
Yes
Success and Failure
Yes
Yes
No
Yes
No
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
Administrators
Yes
Yes
Configure the following Group Policy setting

in a manner that is consistent with the
security and operational requirements of
your organization
Rename Administrator account
your organization
Rename guest account and disable
Enabled
Yes
Yes
Disabled
Yes
No
Require signing
Yes
No
Disabled
Yes
No
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
30 or fewer day(s)
Yes
Yes
Enabled
Yes
Yes
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes

your organization
Prescribed Banner Message - example:
Authorized users only.
900 or fewer seconds
Yes
Yes
4 or fewer logon(s)
Yes
Yes
14 or more day(s)
Yes
Yes
Disabled
Yes
Yes
Lock Workstation
Yes
Yes
10 or fewer invalid logon attempts
No
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
15 or fewer minute(s)
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
Highest protection, source routing is completely disabled
Yes
Yes
Highest protection, source routing is completely disabled
Yes
Yes
Enabled
Yes
Yes
Yes
Yes
0.9 or less
Yes
Yes
Disabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
rolSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal
Yes
Server System\CurrentControlSet\Contro
Yes
ptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows

Yes
Yes NT\CurrentVersion
Enabled
Yes
Yes
Classic - local users authenticate as themselves
Yes
Yes
Enabled
Yes
No
Disabled
Yes
No
Enabled
Yes
Yes
Send NTLMv2 response only. Refuse LM & NTLM
Yes
Yes
Negotiate signing
Yes
Yes
Require NTLMv2 session security,Require 128-bit encryption
Yes
Yes
Require NTLMv2 session security,Require 128-bit encryption
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
Prompt for consent for non-Windows binaries
Yes
Yes
Prompt for credentials
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
No One
Yes
Yes
nticated Users, ENTERPRISE DOMAIN CONTROLLERS. Level 1 - Member

Yes
Server. The recommended
Yes
state for this s
No One
Yes
Yes
Administrators
Yes
No
Administrators, Local Service, Network Service
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
rvice, Network Service. Level - Member Server. The recommended state for this setting is: Administrators, Authe
Yes
Yes
LOCAL SERVICE, Administrators
Yes
Yes
LOCAL SERVICE, Administrators
Yes
Yes
Administrators
Yes
Yes
No One
Yes
Yes
Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE Yes
Yes
No One
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
Guests
Yes
Yes
Guests
Yes
Yes
No One
Yes
Yes
Guests
Yes
Yes
ate for this setting is: Administrators. Level 1 - Member Server. The recommended state for this setting is: No On
Yes
Yes
Administrators
Yes
Yes
Local Service, Network Service
Yes
Yes
Administrators, SERVICE, Local Service, Network Service
Yes
Yes
Administrators, Local Service
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
No One
Yes
Yes
Administrators
Yes
No
Administrators
Yes
Yes
No One
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
Administrators,NT SERVICE\WdiServiceHost
Yes
Yes
Administrators
Yes
Yes
Local Service, Network Service
Yes
Yes
Administrators
Yes
Yes
Administrators
Yes
Yes
No One
Yes
No
Administrators
Yes
Yes
Enabled
Yes
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes (default)
Yes
Yes
Yes
Yes
Yes
On (recommended)
Yes
Yes
Allow (default)
Yes
Yes
Enabled
Yes
Yes
No
Yes
Yes
Yes (default)
Yes
Yes
Yes (default)
Yes
Yes
Yes (default)
Yes
Yes
On (recommended)
Yes
Yes
Allow (default)
Yes
Yes
Enabled
Yes
Yes
No
Yes
Yes
Yes (default)
Yes
Yes
Yes (default)
Yes
Yes
Yes (default)
Yes
Yes
On (recommended)
Yes
Yes
Allow (default)
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Enabled
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Disabled
Yes
Yes
Current Value
Justification if Recommended
Config will not be adopted

Win Server 2012

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Win Server 2012

Uploaded by

Copyright:

Available Formats

BASELINE CONFIGURATION FOR WINDOW SE

1 Set 'Account lockout threshold' to '5 invalid logon attempt(s)' (Scored)

2 Set 'Account lockout duration' to '15 or more minute(s)' (Scored)

3 Set 'Reset account lockout counter after' to '15 minute(s)' (Scored)

4 Set 'Minimum password length' to '14 or more character(s)' (Scored)

5 Set 'Enforce password history' to '24 or more password(s)' (Scored)

6 Set 'Password must meet complexity requirements' to 'Enabled' (Scored)

7 Set 'Store passwords using reversible encryption' to 'Disabled' (Scored)

8 Set 'Minimum password age' to '1 or more day(s)' (Scored)

1 1 1 9 Set 'Maximum password age' to '60 or fewer days' (Scored)

6 Configure 'Audit Policy: Account Management: Computer Account Management' (Scored)

12 Set 'Audit Policy: Detailed Tracking: Process Creation' to 'Success' (Scored)

19 Set 'Audit Policy: Logon-Logoff: Account Lockout' to 'No Auditing' (Scored)

23 Set 'Audit Policy: Logon-Logoff: Logoff' to 'Success' (Scored)

24 Set 'Audit Policy: Logon-Logoff: Logon' to 'Success and Failure' (Scored)

27 Set 'Audit Policy: Logon-Logoff: Special Logon' to 'Success' (Scored)

39 Set 'Audit Policy: Object Access: Registry' to 'No Auditing' (Scored)

41 Set 'Audit Policy: Object Access: SAM' to 'No Auditing' (Scored)

1 Configure 'Accounts: Rename administrator account' (Scored)

2 Configure 'Accounts: Rename guest account' (Scored)

6 Set 'Interactive logon: Do not require CTRL+ALT+DEL' to 'Disabled' (Scored)

10 Set 'Interactive logon: Require Domain Controller authentication to unlock workstatio

10 11 Set 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' to 'Disable

10 12 Set 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects a

10 13 Set 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects agains

11 4 Set 'Network access: Allow anonymous SID/Name translation' to 'Disabled' (Scored)

11 9 Set 'Network access: Remotely accessible registry paths' to 'System\CurrentControlSet

13 1 Set 'Recovery console: Allow automatic administrative logon' to 'Disabled' (Scored)

14 2 Set 'Shutdown: Clear virtual memory pagefile' to 'Disabled' (Scored)

3 Set 'Access Credential Manager as a trusted caller' to 'No One' (Scored)

4 Configure 'Access this computer from the network' (Scored)

5 Set 'Act as part of the operating system' to 'No One' (Scored)

6 Set 'Add workstations to domain' to 'Administrators' (Scored)

8 Set 'Allow log on locally' to 'Administrators' (Scored)

9 Set 'Allow log on through Remote Desktop Services' to 'Administrators' (Scored)

10 Set 'Back up files and directories' to 'Administrators' (Scored)

11 Configure 'Bypass traverse checking' (Scored)

12 Set 'Change the system time' to 'LOCAL SERVICE, Administrators' (Scored)

13 Set 'Change the time zone' to 'LOCAL SERVICE, Administrators' (Scored)

14 Set 'Create a pagefile' to 'Administrators' (Scored)

15 Set 'Create a token object' to 'No One' (Scored)

17 Set 'Create permanent shared objects' to 'No One' (Scored)

18 Set 'Create symbolic links' to 'Administrators' (Scored)

19 Set 'Debug programs' to 'Administrators' (Scored)

21 Set 'Deny log on as a batch job' to 'Guests' (Scored)

22 Set 'Deny log on as a service' to 'No One' (Scored)

23 Set 'Deny log on locally' to 'Guests' (Scored)

25 Set 'Force shutdown from a remote system' to 'Administrators' (Scored)

26 Set 'Generate security audits' to 'Local Service, Network Service' (Scored)

27 Set 'Impersonate a client after authentication' to 'Administrators, SERVICE, Local Service

28 Set 'Increase a process working set' to 'Administrators, Local Service' (Scored)

29 Set 'Increase scheduling priority' to 'Administrators' (Scored)

30 Set 'Load and unload device drivers' to 'Administrators' (Scored)

31 Set 'Lock pages in memory' to 'No One' (Scored)

32 Set 'Log on as a batch job' to 'Administrators' (Scored)

33 Set 'Manage auditing and security log' to 'Administrators' (Scored)

34 Set 'Modify an object label' to 'No One' (Scored)

35 Set 'Modify firmware environment values' to 'Administrators' (Scored)

36 Set 'Perform volume maintenance tasks' to 'Administrators' (Scored)

37 Set 'Profile single process' to 'Administrators' (Scored)

38 Set 'Profile system performance' to 'Administrators,NT SERVICE\WdiServiceHost' (Scored)

39 Set 'Remove computer from docking station' to 'Administrators' (Scored)

41 Set 'Restore files and directories' to 'Administrators' (Scored)

42 Set 'Shut down the system' to 'Administrators' (Scored)