Of course I asked the twitters and frankly they did not give me the answers I sought. I was looking for answers such as "Of course we harden our systems." or, "Naturally most of the clients I work with harden their external systems." Well I didn't get those answers. The best I got was "I am just happy if they patch."
So I now have to ask the question, in a very serious way, should be we give up on the concept of hardening? For me personally it is a very sore spot and a point of irritation, should I let it go?
I ask these questions because I have been on both sides of the fence. I have hardened systems, and I have broken into *many* systems that have not been hardened. The latter represents far more than the former. So, what's a girl to do? Give up? Or keep fighting the good fight?
Don't get me wrong, I *absolutely* believe in the vendors providing default out of the box configurations that reduce the threat surface, but at the end of the day I do not feel we can depend on them wholly given the variety of systems we deploy. There are still too many poorly configured systems out there and I think we need to take ownership of this.
Outlined below are some recommendations I have made in terms of hardening a Windows server. This is obviously a specific scenario related to the OS specified, but I am of the school of the thought that hardening a system is just work. That is because I have done it. Numerous times. I have earned my stripes. I am not asking any more of you than I have delivered myself.
What, you have an aversion to work? Is it too hard for you? Figure it out. I did. Man up. It's just work. Afraid something will break? Well test it first silly! This doesn't have to be that hard, why is it so hard?
PLEASE POST COMMENTS!!! I want to hear from you! I probably will never give up this concept but I will at least listen to your argument if you disagree with me.
./Hardening Recommendations To Follow:
Based On CIS Benchmark Available Here:
http://benchmarks.cisecurity.org/downloads/show-single/?file=windows2008.110
Legend:
·
Green – Not required and/or may impact
functionality; do not change default
·
Blue – Desirable
if no impact; these may require discussion, I am happy to jump on the phone
·
Red – Required; *Many* of these settings
are enabled by default
·
Red Bold – These are settings that are critical for which either I have
personally used during a compromise or there are attack signatures that take
advantage of these weaknesses, but it is important to read and understand what
the change is doing.
Overview ...............................................................................................................................................................
17
Recommendations
.............................................................................................................................................
20
1 Computer Configuration
.........................................................................................................................
20
1.1 Security Settings
.....................................................................................................................................
20
1.1.1 Account
Policies
..................................................................................................................................
20
1.1.1.1 Set 'Account
lockout threshold' to '5 invalid logon attempt(s)' (Scored) ............. 20
1.1.1.2 Set 'Account
lockout duration' to '15 or more minute(s)' (Scored)........................ 22
1.1.1.3 Set 'Reset
account lockout counter after' to '15 minute(s)' (Scored) ....................
23
1.1.1.4 Set 'Minimum
password length' to '14 or more character(s)' (Scored) ................ 24
1.1.1.5 Set 'Enforce
password history' to '24 or more password(s)' (Scored) ................. 26
1.1.1.6 Set 'Password
must meet complexity requirements' to 'Enabled' (Scored) ........ 27
1.1.1.7 Set 'Store
passwords using reversible encryption' to 'Disabled' (Scored)........... 29
1.1.1.8 Set 'Minimum
password age' to '1 or more day(s)' (Scored)
.................................... 30
1.1.1.9 Set 'Maximum
password age' to '60 or fewer days'
(Scored).................................... 31
1.1.2 Advanced Audit
Policy Configuration
.........................................................................................
33
1.1.2.1 Set 'Audit
Policy: Account Logon: Credential Validation' to 'Success and Failure' (Scored)
.........................................................................................................................................................
33
1.1.2.2 Set
'Audit Policy: Account Logon: Kerberos Authentication Service' to 'No Auditing'
(Scored)
.....................................................................................................................................
34
1.1.2.3 Set
'Audit Policy: Account Logon: Kerberos Service Ticket Operations' to 'No
Auditing' (Scored)
.....................................................................................................................................
36
1.1.2.4 Set
'Audit Policy: Account Logon: Other Account Logon Events' to 'No Auditing'
(Scored)
.........................................................................................................................................................
37
1.1.2.5 Set
'Audit Policy: Account Management: Application Group Management' to 'No
Auditing' (Scored)
.....................................................................................................................................
39
1.1.2.6 Configure
'Audit Policy: Account Management: Computer Account Management' (Scored)
.........................................................................................................................................................
40
1.1.2.7 Set
'Audit Policy: Account Management: Distribution Group Management' to 'No
Auditing' (Scored)
.....................................................................................................................................
1.1.2.8 Set 'Audit Policy: Account Management:
Other Account Management Events' to 'Success and Failure' (Scored)
..............................................................................................................
44
1.1.2.9 Set 'Audit Policy: Account
Management: Security Group Management' to 'Success and Failure' (Scored)
..............................................................................................................
45
1.1.2.10 Set 'Audit Policy: Account
Management: User Account Management' to 'Success and Failure' (Scored)
..............................................................................................................
47
1.1.2.11 Set 'Audit Policy:
Detailed Tracking: DPAPI Activity' to 'No Auditing' (Scored)
..........................................................................................................................................................................
48
1.1.2.12 Set 'Audit Policy: Detailed
Tracking: Process Creation' to 'Success' (Scored) . 50
1.1.2.13 Set 'Audit Policy: Detailed
Tracking: Process Termination' to 'No Auditing' (Scored)
.........................................................................................................................................................
51
1.1.2.14 Set 'Audit Policy: Detailed
Tracking: RPC Events' to 'No Auditing' (Scored) .... 53
1.1.2.15 Set 'Audit Policy: DS
Access: Detailed Directory Service Replication' to 'No Auditing' (Scored)
.....................................................................................................................................
54
1.1.2.16 Set 'Audit Policy: DS
Access: Directory Service Access' to 'Success and Failure' (Scored)
.........................................................................................................................................................
56
1.1.2.17 Set 'Audit Policy: DS
Access: Directory Service Changes' to 'Success and Failure' (Scored)
........................................................................................................................................
57
1.1.2.18 Set 'Audit Policy: DS
Access: Directory Service Replication' to 'No Auditing' (Scored)
.........................................................................................................................................................
59
1.1.2.19 Set 'Audit Policy:
Logon-Logoff: Account Lockout' to 'No Auditing' (Scored) .. 60
1.1.2.20 Set 'Audit Policy:
Logon-Logoff: IPsec Extended Mode' to 'No Auditing' (Scored)
.........................................................................................................................................................
61
1.1.2.21 Set 'Audit Policy:
Logon-Logoff: IPsec Main Mode' to 'No Auditing' (Scored) . 63
1.1.2.22 Set 'Audit Policy:
Logon-Logoff: IPsec Quick Mode' to 'No Auditing' (Scored) 65
1.1.2.23 Set 'Audit Policy: Logon-Logoff: Logoff' to 'Success'
(Scored) ................................ 66
1.1.2.24 Set 'Audit Policy: Logon-Logoff: Logon' to 'Success and
Failure' (Scored) ........ 68
1.1.2.25 Set 'Audit Policy:
Logon-Logoff: Network Policy Server' to 'No Auditing' (Scored)
.........................................................................................................................................................
69
1.1.2.26 Set 'Audit Policy:
Logon-Logoff: Other Logon/Logoff Events' to 'No Auditing' (Scored)
.........................................................................................................................................................
71
1.1.2.27 Set 'Audit Policy:
Logon-Logoff: Special Logon' to 'Success' (Scored) ................ 73
1.1.2.28 Set 'Audit Policy:
Object Access: Application Generated' to 'No Auditing' (Scored)
.........................................................................................................................................................
74 4
1.1.2.29 Set 'Audit Policy:
Object Access: Central Access Policy Staging' to 'No Auditing' (Scored)
.........................................................................................................................................................
76
1.1.2.30 Set 'Audit Policy:
Object Access: Certification Services' to 'No Auditing' (Scored)
.........................................................................................................................................................
77
1.1.2.31 Set 'Audit Policy:
Object Access: Detailed File Share' to 'No Auditing' (Scored)
..........................................................................................................................................................................
79
1.1.2.32 Set 'Audit Policy:
Object Access: File Share' to 'No Auditing' (Scored) ............... 81
1.1.2.33 Set 'Audit Policy:
Object Access: File System' to 'No Auditing' (Scored) ............ 83
1.1.2.34 Set 'Audit Policy:
Object Access: Filtering Platform Connection' to 'No Auditing' (Scored)
.........................................................................................................................................................
85
1.1.2.35 Set 'Audit Policy:
Object Access: Filtering Platform Packet Drop' to 'No Auditing' (Scored)
.....................................................................................................................................
86
1.1.2.36 Set 'Audit Policy:
Object Access: Handle Manipulation' to 'No Auditing' (Scored)
.........................................................................................................................................................
88
1.1.2.37 Set 'Audit Policy:
Object Access: Kernel Object' to 'No Auditing' (Scored) ........ 89
1.1.2.38 Set 'Audit Policy:
Object Access: Other Object Access Events' to 'No Auditing' (Scored)
.........................................................................................................................................................
91
1.1.2.39 Set 'Audit Policy:
Object Access: Registry' to 'No Auditing' (Scored) .................. 92
1.1.2.40 Set 'Audit Policy:
Object Access: Removable Storage' to 'No Auditing' (Scored)
..........................................................................................................................................................................
94
1.1.2.41 Set 'Audit Policy:
Object Access: SAM' to 'No Auditing' (Scored) .......................... 95
1.1.2.42 Set 'Audit Policy: Policy
Change: Audit Policy Change' to 'Success and Failure' (Scored)
.........................................................................................................................................................
97
1.1.2.43 Set 'Audit Policy:
Policy Change: Authentication Policy Change' to 'Success' (Scored) .........................................................................................................................................................
98
1.1.2.44 Set 'Audit Policy:
Policy Change: Authorization Policy Change' to 'No Auditing' (Scored)
.......................................................................................................................................................
100
1.1.2.45 Set 'Audit Policy:
Policy Change: Filtering Platform Policy Change' to 'No Auditing' (Scored)
...................................................................................................................................
101
1.1.2.46 Set 'Audit Policy:
Policy Change: MPSSVC Rule-Level Policy Change' to 'No Auditing' (Scored)
...................................................................................................................................
104
1.1.2.47 Set 'Audit Policy:
Policy Change: Other Policy Change Events' to 'No Auditing' (Scored)
.......................................................................................................................................................
106
1.1.2.48 Set 'Audit Policy:
Privilege Use: Non Sensitive Privilege Use' to 'No Auditing' (Scored)
.......................................................................................................................................................
108
1.1.2.49 Set 'Audit Policy:
Privilege Use: Other Privilege Use Events' to 'No Auditing' (Scored)
.......................................................................................................................................................
109
1.1.2.50 Set 'Audit Policy: Privilege
Use: Sensitive Privilege Use' to 'Success and Failure' (Scored)
.......................................................................................................................................................
111
1.1.2.51 Set 'Audit Policy:
System: IPsec Driver' to 'Success and Failure' (Scored) ...... 112
1.1.2.52 Set 'Audit Policy: System:
Other System Events' to 'No Auditing' (Scored) .... 114
1.1.2.53 Set 'Audit Policy: System:
Security State Change' to 'Success and Failure' (Scored)
.......................................................................................................................................................
116
1.1.2.54 Set 'Audit Policy: System:
Security System Extension' to 'Success and Failure' (Scored)
.......................................................................................................................................................
118
1.1.2.55 Set 'Audit Policy: System:
System Integrity' to 'Success and Failure' (Scored)
........................................................................................................................................................................
119
1.1.3 Security Options
................................................................................................................................
121
1.1.3.1 Accounts
...........................................................................................................................................
121
1.1.3.1.1 Configure 'Accounts: Rename administrator account'
(Scored) ........................ 121
1.1.3.1.2 Configure 'Accounts: Rename guest account' (Scored)
.......................................... 122
1.1.3.1.3 Set 'Accounts: Limit local
account use of blank passwords to console logon only' to 'Enabled' (Scored)
...................................................................................................................
123
1.1.3.2 Audit
...................................................................................................................................................
124
1.1.3.2.1 Configure 'Audit: Audit
the access of global system objects' (Not Scored) .... 124
1.1.3.2.2 Configure 'Audit: Audit
the use of Backup and Restore privilege' (Not Scored)
........................................................................................................................................................................
125
1.1.3.2.3 Set 'Audit: Force audit
policy subcategory settings (Windows Vista or later) to override audit policy
category settings' to 'Enabled' (Scored)
............................................. 127
1.1.3.2.4 Set 'Audit: Shut down
system immediately if unable to log security audits' to 'Disabled' (Scored)
..................................................................................................................................
128
1.1.3.3 DCOM
.................................................................................................................................................
130
1.1.3.3.1
Configure 'DCOM: Machine Access Restrictions in Security Descriptor Definition
Language (SDDL) syntax' (Not Scored)
..................................................................... 130
1.1.3.3.2
Configure 'DCOM: Machine Launch Restrictions in Security Descriptor Definition
Language (SDDL) syntax' (Not Scored) .....................................................................
132
1.1.3.4
Devices
..............................................................................................................................................
134
1.1.3.4.1 Configure 'Devices:
Allow undock without having to log on' (Not Scored).... 134
1.1.3.4.2 Configure 'Devices:
Restrict CD-ROM access to locally logged-on user only' (Not Scored)
..............................................................................................................................................
135
1.1.3.4.3 Configure 'Devices:
Restrict floppy access to locally logged-on user only' (Not Scored)
........................................................................................................................................................
136
1.1.3.4.4 Set 'Devices: Allowed to
format and eject removable media' to 'Administrators' (Scored)
....................................................................................................................
137
1.1.3.4.5 Set 'Devices: Prevent users
from installing printer drivers' to 'Enabled' (Scored)
.......................................................................................................................................................
139
1.1.3.5 Domain controller
.........................................................................................................................
140
1.1.3.5.1 Set 'Domain controller: Allow server operators to schedule
tasks' to 'Disabled' (Scored) .......................................................................................................................................................
140
1.1.3.5.2 Set 'Domain controller:
LDAP server signing requirements' to 'Require signing' (Scored)
......................................................................................................................................
141
1.1.3.5.3 Set 'Domain controller:
Refuse machine account password changes' to 'Disabled' (Scored)
..................................................................................................................................
143
1.1.3.6 Domain member
............................................................................................................................
144
1.1.3.6.1 Set 'Domain member:
Digitally encrypt or sign secure channel data (always)' to 'Enabled' (Scored)
..............................................................................................................................
144
1.1.3.6.2 Set 'Domain member:
Digitally encrypt secure channel data (when possible)' to 'Enabled' (Scored)
..............................................................................................................................
146
1.1.3.6.3 Set 'Domain member: Digitally
sign secure channel data (when possible)' to 'Enabled' (Scored)
...................................................................................................................................
148
1.1.3.6.4 Set 'Domain member: Disable
machine account password changes' to 'Disabled' (Scored)
..................................................................................................................................
149
1.1.3.6.5 Set 'Domain member: Maximum
machine account password age' to '30 or fewer day(s)' (Scored)
...........................................................................................................................
151
1.1.3.6.6
Set 'Domain member: Require strong (Windows 2000 or later) session key' to
'Enabled' (Scored)
...................................................................................................................................
152
1.1.3.7 Interactive logon
...........................................................................................................................
153
1.1.3.7.1 Configure 'Interactive
logon: Display user information when the session is locked' (Not Scored)
...............................................................................................................................
153 7 | P a g e1.1.3.7.2
Configure 'Interactive logon: Message text for users attempting to log on'
(Scored)
.......................................................................................................................................................
154
1.1.3.7.3
Configure 'Interactive logon: Message title for users attempting to log on'
(Scored) .......................................................................................................................................................
156
1.1.3.7.4 Configure 'Interactive
logon: Require smart card' (Not Scored) ........................ 157
1.1.3.7.5 Set 'Interactive logon: Do
not display last user name' to 'Enabled' (Scored) 158
1.1.3.7.6 Set 'Interactive logon: Do
not require CTRL+ALT+DEL' to 'Disabled' (Scored)
........................................................................................................................................................................
159
1.1.3.7.7 Set 'Interactive logon:
Machine inactivity limit' to '900 or fewer seconds' (Scored)
.......................................................................................................................................................
160
1.1.3.7.8 Set 'Interactive logon:
Number of previous logons to cache (in case domain controller is not
available)' to '4 or fewer logon(s)' (Scored)
............................................... 161
1.1.3.7.9 Set 'Interactive logon:
Prompt user to change password before expiration' to '14 or more day(s)'
(Scored)
...............................................................................................................
163
1.1.3.7.10 Set 'Interactive logon:
Require Domain Controller authentication to unlock workstation' to 'Disabled'
(Scored)..................................................................................................
164
1.1.3.7.11 Set 'Interactive
logon: Smart card removal behavior' to 'Lock Workstation' (Scored)
.......................................................................................................................................................
166
1.1.3.7.12 Set 'Interactive logon: Machine account lockout
threshold' to 10 or fewer invalid logon attempts (Scored)
........................................................................................................
167
1.1.3.8 Microsoft network
client ............................................................................................................
169
1.1.3.8.1 Set 'Microsoft network
client: Digitally sign communications (always)' to 'Enabled' (Scored)
...................................................................................................................................
169
1.1.3.8.2 Set 'Microsoft network
client: Digitally sign communications (if server agrees)' to 'Enabled' (Scored)
............................................................................................................
171
1.1.3.8.3 Set 'Microsoft network
client: Send unencrypted password to third-party SMB servers' to 'Disabled'
(Scored)
...........................................................................................................
173
1.1.3.9 Microsoft network server
..........................................................................................................
174
1.1.3.9.1 Configure 'Microsoft
network server: Server SPN target name validation level' (Not Scored)
..............................................................................................................................................
174
1.1.3.9.2
Set 'Microsoft network server: Amount of idle time required before suspending
session' to '15 or fewer minute(s)' (Scored)
........................................................ 175
1.1.3.9.3 Set 'Microsoft network
server: Digitally sign communications (always)' to 'Enabled' (Scored)
...................................................................................................................................
176 8 | P a g e1.1.3.9.4 Set 'Microsoft network server: Digitally sign
communications (if client agrees)' to 'Enabled' (Scored)
............................................................................................................
178
1.1.3.9.5 Set 'Microsoft network
server: Disconnect clients when logon hours expire' to 'Enabled' (Scored)
...................................................................................................................................
180
1.1.3.10 MSS
...................................................................................................................................................
181
1.1.3.10.1 Configure 'MSS:
(AutoReboot) Allow Windows to automatically restart after a system crash
(recommended except for highly secure environments)' (Not Scored)
........................................................................................................................................................................
181
1.1.3.10.2 Configure 'MSS:
(AutoShareServer) Enable Administrative Shares (recommended except for highly
secure environments)' (Not Scored) ............................ 182
1.1.3.10.3 Configure 'MSS:
(EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes'
(Not Scored)
..............................................................................................
183
1.1.3.10.4 Configure 'MSS:
(Hidden) Hide Computer From the Browse List (not recommended except for highly
secure environments)' (Not Scored) .............................. 184
1.1.3.10.5 Configure 'MSS:
(KeepAliveTime) How often keep-alive packets are sent in milliseconds' (Not
Scored)
...................................................................................................................
186
1.1.3.10.6 Configure 'MSS:
(NoDefaultExempt) Configure IPSec exemptions for various types of network
traffic.' (Not Scored)
...........................................................................................
187
1.1.3.10.7 Configure 'MSS: (NoNameReleaseOnDemand) Allow the
computer to ignore NetBIOS name release requests except from WINS servers' (Not
Scored) ...................... 189
1.1.3.10.8 Configure 'MSS:
(PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway
addresses (could lead to DoS)' (Not Scored) ......................... 190
1.1.3.10.9 Configure 'MSS:
(TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is
retransmitted (3 recommended, 5 is default)' (Not Scored) 191
1.1.3.10.10 Configure 'MSS:
(TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted
(3 recommended, 5 is default)' (Not Scored) 192
1.1.3.10.11 Set 'MSS:
(AutoAdminLogon) Enable Automatic Logon (not recommended)' to 'Disabled'
(Scored)
............................................................................................................................
194
1.1.3.10.12 Set 'MSS: (DisableIPSourceRouting IPv6) IP source
routing protection level (protects against packet spoofing)' to 'Highest
protection, source routing is completely disabled' (Scored)
...................................................................................................................................
195
1.1.3.10.13 Set 'MSS: (DisableIPSourceRouting) IP source routing
protection level (protects against packet spoofing)' to 'Highest protection,
source routing is completely disabled' (Scored)
...................................................................................................................................
196
1.1.3.10.14 Set 'MSS: (SafeDllSearchMode) Enable Safe
DLL search mode (recommended)' to 'Enabled' (Scored)
..........................................................................................
197
1.1.3.10.15 Set 'MSS:
(ScreenSaverGracePeriod) The time in seconds before the screen saver grace
period expires (0 recommended)' to '0' (Scored)
.............................................. 199
1.1.3.10.16 Set 'MSS: (WarningLevel)
Percentage threshold for the security event log at which the system will
generate a warning' to '0.9 or less' (Scored)
................................... 200
1.1.3.11 Network access
............................................................................................................................
201
1.1.3.11.1 Configure 'Network
access: Do not allow storage of passwords and credentials for network
authentication' (Not Scored)
............................................................. 201
1.1.3.11.2 Configure 'Network access: Named Pipes that can be
accessed anonymously' (Not Scored)
..............................................................................................................................................
202
1.1.3.11.3 Configure 'Network access: Shares that can be accessed
anonymously' (Not Scored)
........................................................................................................................................................
204
1.1.3.11.4 Set 'Network access: Allow
anonymous SID/Name translation' to 'Disabled' (Scored)
.......................................................................................................................................................
205
1.1.3.11.5 Set 'Network access: Do not allow anonymous enumeration
of SAM accounts and shares' to 'Enabled' (Scored)
.....................................................................................................
206
1.1.3.11.6 Set 'Network access: Do not allow anonymous enumeration of
SAM accounts' to 'Enabled' (Scored)
..............................................................................................................................
208
1.1.3.11.7 Set 'Network access: Let
Everyone permissions apply to anonymous users' to 'Disabled' (Scored)
..................................................................................................................................
209
1.1.3.11.8 Set 'Network access:
Remotely accessible registry paths and sub-paths' to 'System\CurrentControlSet\Control\Print\Printers
System\CurrentControlSet\Services\Eventlog Software\Microsoft\OLAP Server
Software\Microsoft\Windows NT\CurrentVersion\Print Softwar (Scored)
................. 210
1.1.3.11.9 Set 'Network access:
Remotely accessible registry paths' to
'System\CurrentControlSet\Control\ProductOptions
System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows
NT\CurrentVersion'
(Scored).............................................................................................................
212
1.1.3.11.10 Set 'Network access:
Restrict anonymous access to Named Pipes and Shares' to 'Enabled' (Scored)
..............................................................................................................
213
1.1.3.11.11 Set 'Network access:
Sharing and security model for local accounts' to 'Classic - local users
authenticate as themselves' (Scored)
.................................................... 215
1.1.3.12 Network security ........................................................................................................................
1.1.3.12.1 Configure 'Network
Security: Allow PKU2U authentication requests to this computer to use online
identities' (Not Scored) .........................................................................
216
1.1.3.12.2 Configure 'Network
Security: Configure encryption types allowed for Kerberos' (Not Scored)
.........................................................................................................................
217
1.1.3.12.3 Configure 'Network
security: Force logoff when logon hours expire' (Not Scored)
........................................................................................................................................................
218
1.1.3.12.4 Configure 'Network
Security: Restrict NTLM: Add remote server exceptions for NTLM authentication'
(Not Scored)
..........................................................................................
219
1.1.3.12.5 Configure 'Network
Security: Restrict NTLM: Add server exceptions in this domain' (Not Scored)
.............................................................................................................................
221
1.1.3.12.6
Configure 'Network Security: Restrict NTLM: Audit Incoming NTLM Traffic' (Not
Scored)
..............................................................................................................................................
222
1.1.3.12.7
Configure 'Network Security: Restrict NTLM: Audit NTLM authentication in this
domain' (Not Scored)
....................................................................................................................
223
1.1.3.12.8 Configure 'Network
Security: Restrict NTLM: Incoming NTLM traffic' (Not Scored)
........................................................................................................................................................
225
1.1.3.12.9 Configure 'Network
Security: Restrict NTLM: NTLM authentication in this domain' (Not Scored)
.............................................................................................................................
226
1.1.3.12.10
Configure 'Network Security: Restrict NTLM: Outgoing NTLM traffic to remote
servers' (Not Scored)
.............................................................................................................
228 – EM Notes: Set to AUDIT
ALL if feasible
1.1.3.12.11 Set 'Network security: Allow Local System to use computer
identity for NTLM' to 'Enabled' (Scored)
...............................................................................................................
229
1.1.3.12.12 Set 'Network security: Allow LocalSystem NULL session
fallback' to 'Disabled' (Scored)
..................................................................................................................................
230
1.1.3.12.13 Set 'Network security: Do
not store LAN Manager hash value on next password change' to 'Enabled' (Scored)
........................................................................................
231
1.1.3.12.14 Set 'Network security: LAN Manager authentication level'
to 'Send NTLMv2 response only. Refuse LM & NTLM' (Scored)
...............................................................................
232
1.1.3.12.15 Set 'Network
security: LDAP client signing requirements' to 'Negotiate signing' (Scored)
......................................................................................................................................
235
1.1.3.12.16 Set 'Network
security: Minimum session security for NTLM SSP based (including secure RPC)
clients' to 'Require NTLMv2 session security,Require 128-bit encryption'
(Scored) ..............................................................................................................................
237 11 | P a g e1.1.3.12.17 Set 'Network security: Minimum session security for NTLM SSP based
(including secure RPC) servers' to 'Require NTLMv2 session security,Require
128-bit encryption' (Scored)
..............................................................................................................................
238
1.1.3.13 Recovery console
........................................................................................................................
240
1.1.3.13.1 Set 'Recovery console:
Allow automatic administrative logon' to 'Disabled' (Scored)
.......................................................................................................................................................
240
1.1.3.13.2 Set 'Recovery console:
Allow floppy copy and access to all drives and all folders' to 'Disabled'
(Scored) ............................................................................................................
241
1.1.3.14 Shutdown
.......................................................................................................................................
242
1.1.3.14.1 Set 'Shutdown: Allow
system to be shut down without having to log on' to 'Disabled' (Scored)
..................................................................................................................................
242
1.1.3.14.2 Set 'Shutdown: Clear
virtual memory pagefile' to 'Disabled' (Scored).......... 243
1.1.3.15 System cryptography
................................................................................................................
245
1.1.3.15.1 Configure 'System
cryptography: Force strong key protection for user keys stored on the computer'
(Not Scored)
............................................................................................
245
1.1.3.15.2 Set 'System
cryptography: Use FIPS compliant algorithms for encryption, hashing, and
signing' to 'Enabled' (Scored)
..................................................................................
246
1.1.3.16 System objects
.............................................................................................................................
248
1.1.3.16.1 Set 'System objects:
Require case insensitivity for non-Windows subsystems' to 'Enabled' (Scored)
..............................................................................................................................
248
1.1.3.16.2 Set 'System objects:
Strengthen default permissions of internal system objects (e.g. Symbolic
Links)' to 'Enabled' (Scored)
.................................................................. 250
1.1.3.17 System settings
............................................................................................................................
251
1.1.3.17.1 Configure 'System
settings: Optional subsystems' (Not Scored) ..................... 251
1.1.3.17.2 Set 'System settings:
Use Certificate Rules on Windows Executables for Software Restriction Policies'
to 'Enabled' (Scored)
................................................................. 252
1.1.3.18 User Account Control
................................................................................................................
253
1.1.3.18.1 Set 'User Account
Control: Admin Approval Mode for the Built-in Administrator account' to
'Enabled'
(Scored)..............................................................................
253
1.1.3.18.2 Set 'User Account Control:
Allow UIAccess applications to prompt for elevation without using the secure
desktop' to 'Disabled' (Scored) ................................... 255
1.1.3.18.3 Set 'User Account Control:
Behavior of the elevation prompt for administrators in Admin Approval Mode' to
'Prompt for consent for non-Windows binaries' (Scored)
....................................................................................................................................
1.1.3.18.4 Set 'User Account Control: Behavior of the elevation
prompt for standard users' to 'Prompt for credentials' (Scored)
...................................................................................
258
1.1.3.18.5 Set 'User Account Control:
Detect application installations and prompt for elevation' to 'Enabled'
(Scored)
.........................................................................................................
259
1.1.3.18.6 Set 'User Account Control:
Only elevate executables that are signed and validated' to 'Disabled' (Scored)
.......................................................................................................
261
1.1.3.18.7 Set 'User Account Control:
Only elevate UIAccess applications that are installed in secure locations' to
'Enabled' (Scored)
................................................................... 262
1.1.3.18.8 Set 'User Account Control:
Run all administrators in Admin Approval Mode' to 'Enabled' (Scored)
..............................................................................................................................
264
1.1.3.18.9 Set 'User Account Control:
Switch to the secure desktop when prompting for elevation' to 'Enabled'
(Scored) .........................................................................................................
265
1.1.3.18.10 Set 'User Account
Control: Virtualize file and registry write failures to per-user locations' to
'Enabled' (Scored)
...............................................................................................
266
1.1.4 User Rights Assignments
...............................................................................................................
267
1.1.4.1 Configure 'Deny log on
through Remote Desktop Services' (Not Scored).......... 267
1.1.4.2 Configure 'Log on as a
service' (Not Scored)
................................................................. 268
1.1.4.3 Set 'Access Credential
Manager as a trusted caller' to 'No One' (Scored) .......... 269
1.1.4.4 Configure 'Access this
computer from the network' (Scored) ................................ 270
1.1.4.5 Set 'Act as part of the
operating system' to 'No One' (Scored)................................ 272
1.1.4.6 Set 'Add workstations to
domain' to 'Administrators' (Scored) ............................ 273
1.1.4.7 Set 'Adjust memory quotas for
a process' to 'Administrators, Local Service, Network Service' (Scored)
...................................................................................................................
274
1.1.4.8 Set 'Allow log on locally' to
'Administrators' (Scored)............................................... 275
1.1.4.9 Set 'Allow log on through
Remote Desktop Services' to 'Administrators' (Scored)
.......................................................................................................................................................
277
1.1.4.10 Set 'Back up files and
directories' to 'Administrators' (Scored) .......................... 278
1.1.4.11 Configure 'Bypass
traverse checking' (Scored)
.......................................................... 279
1.1.4.12 Set 'Change the system time'
to 'LOCAL SERVICE, Administrators' (Scored) 280
1.1.4.13 Set 'Change the time zone'
to 'LOCAL SERVICE, Administrators' (Scored) ..... 282
1.1.4.14 Set 'Create a pagefile' to
'Administrators' (Scored) ..................................................
283
1.1.4.15 Set 'Create a token object'
to 'No One' (Scored) .........................................................
284 13 | P a g e1.1.4.16 Set 'Create global objects' to 'Administrators,
SERVICE, LOCAL SERVICE, NETWORK SERVICE' (Scored)
...........................................................................................................
285
1.1.4.17 Set 'Create permanent shared
objects' to 'No One' (Scored) ................................ 286
1.1.4.18 Set 'Create symbolic links'
to 'Administrators' (Scored) ........................................ 287
1.1.4.19 Set 'Debug programs' to
'Administrators' (Scored) ................................................. 288
1.1.4.20 Set 'Deny access to this
computer from the network' to 'Guests' (Scored) ..... 290
1.1.4.21 Set 'Deny log on as a batch
job' to 'Guests' (Scored) ................................................ 291
1.1.4.22 Set 'Deny log on as a
service' to 'No One' (Scored)
................................................... 292
1.1.4.23 Set 'Deny log on locally' to
'Guests' (Scored)...............................................................
293
1.1.4.24 Configure 'Enable computer
and user accounts to be trusted for delegation' (Scored)
.......................................................................................................................................................
294
1.1.4.25 Set 'Force shutdown from a
remote system' to 'Administrators' (Scored) ..... 295
1.1.4.26 Set 'Generate security
audits' to 'Local Service, Network Service' (Scored) .. 297
1.1.4.27 Set
'Impersonate a client after authentication' to 'Administrators, SERVICE, Local
Service, Network Service' (Scored)
......................................................................................
298
1.1.4.28 Set 'Increase a process
working set' to 'Administrators, Local Service' (Scored)
........................................................................................................................................................................
299
1.1.4.29 Set 'Increase scheduling
priority' to 'Administrators' (Scored) .......................... 300
1.1.4.30 Set 'Load and unload device
drivers' to 'Administrators' (Scored) .................... 301
1.1.4.31 Set 'Lock pages in memory'
to 'No One' (Scored) ...................................................... 302
1.1.4.32 Set 'Log on as a batch job'
to 'Administrators' (Scored) ......................................... 303
1.1.4.33 Set 'Manage auditing and
security log' to 'Administrators' (Scored) ................ 304
1.1.4.34 Set 'Modify an object label'
to 'No One' (Scored) .......................................................
305
1.1.4.35 Set 'Modify firmware
environment values' to 'Administrators' (Scored) ........ 306
1.1.4.36 Set 'Perform volume
maintenance tasks' to 'Administrators' (Scored) ........... 307
1.1.4.37 Set 'Profile single
process' to 'Administrators' (Scored) ........................................
308
1.1.4.38 Set 'Profile system
performance' to 'Administrators,NT SERVICE\WdiServiceHost' (Scored)
................................................................................................
310
1.1.4.39 Set 'Remove computer from
docking station' to 'Administrators' (Scored) ... 311
1.1.4.40 Set 'Replace a process level
token' to 'Local Service, Network Service' (Scored)
........................................................................................................................................................................
312
1.1.4.41 Set 'Restore files and
directories' to 'Administrators' (Scored) .......................... 313
1.1.4.42 Set 'Shut down the system' to 'Administrators'
(Scored)....................................... 314
1.1.4.43 Set 'Synchronize directory
service data' to 'No One' (Scored) ............................. 315
1.1.4.44 Set 'Take ownership of files
or other objects' to 'Administrators' (Scored) ... 316
1.1.5
Windows Firewall With Advanced Security ...........................................................................
318
1.1.5.1
Public Profile
...................................................................................................................................
318
1.1.5.1.1
Set 'Inbound connections' to 'Enabled:Block (default)' (Scored)
...................... 318
1.1.5.1.2
Set 'Windows Firewall: Public: Allow unicast response' to 'No' (Scored) ......
319
1.1.5.1.3
Set 'Windows Firewall: Public: Apply local connection security rules' to 'Yes'
(Scored) .......................................................................................................................................................
320
1.1.5.1.4
Set 'Windows Firewall: Public: Apply local firewall rules' to 'Yes (default)'
(Scored) .......................................................................................................................................................
321
1.1.5.1.5
Set 'Windows Firewall: Public: Display a notification' to 'Yes' (Scored)
......... 322
1.1.5.1.6 Set
'Windows Firewall: Public: Firewall state' to 'On (recommended)' (Scored)
........................................................................................................................................................................
323
1.1.5.1.7
Set 'Windows Firewall: Public: Outbound connections' to 'Allow (default)'
(Scored)
.......................................................................................................................................................
324
1.1.5.2 Private
Profile
.................................................................................................................................
326
1.1.5.2.1
Set 'Inbound connections' to 'Enabled:Block (default)' (Scored)
...................... 326
1.1.5.2.2
Set 'Windows Firewall: Private: Allow unicast response' to 'No' (Scored) ....
327
1.1.5.2.3
Set 'Windows Firewall: Private: Apply local connection security rules' to 'Yes
(default)' (Scored) ...................................................................................................................................
328
1.1.5.2.4
Set 'Windows Firewall: Private: Apply local firewall rules' to 'Yes (default)'
(Scored)
.......................................................................................................................................................
329
1.1.5.2.5
Set 'Windows Firewall: Private: Display a notification' to 'Yes (default)'
(Scored)
.......................................................................................................................................................
330
1.1.5.2.6
Set 'Windows Firewall: Private: Firewall state' to 'On (recommended)' (Scored)
.......................................................................................................................................................
331
1.1.5.2.7
Set 'Windows Firewall: Private: Outbound connections' to 'Allow (default)'
(Scored)
.......................................................................................................................................................
332
1.1.5.3
Domain Profile ...............................................................................................................................
334
1.1.5.3.1
Set 'Inbound connections' to 'Enabled:Block (default)' (Scored)
...................... 334
1.1.5.3.2
Set 'Windows Firewall: Domain: Allow unicast response' to 'No' (Scored) ... 335
1.1.5.3.3
Set 'Windows Firewall: Domain: Apply local connection security rules' to 'Yes
(default)' (Scored)
...................................................................................................................................
336
1.1.5.3.4
Set 'Windows Firewall: Domain: Apply local firewall rules' to 'Yes (default)'
(Scored)
.......................................................................................................................................................
337
1.1.5.3.5
Set 'Windows Firewall: Domain: Display a notification' to 'Yes (default)'
(Scored)
.......................................................................................................................................................
338
1.1.5.3.6
Set 'Windows Firewall: Domain: Firewall state' to 'On (recommended)' (Scored)
.......................................................................................................................................................
339
1.1.5.3.7
Set 'Windows Firewall: Domain: Outbound connections' to 'Allow (default)'
(Scored)
.......................................................................................................................................................
340
1.2 Administrative Templates
................................................................................................................
341
1.2.1 Windows Components
....................................................................................................................
341
1.2.1.1 AutoPlay Policies
...........................................................................................................................
341
1.2.1.1.1 Set 'Turn off Autoplay on:'
to 'Enabled:All drives' (Scored) ................................. 341
1.2.1.2 Event Log
..........................................................................................................................................
343
1.2.1.2.1 Set 'Security: Maximum Log
Size (KB)' to 'Enabled:196608 or greater' (Scored)
.......................................................................................................................................................
343
1.2.1.2.2 Set 'System: Maximum Log
Size (KB)' to 'Enabled:32768 or greater' (Scored)
........................................................................................................................................................................
344
1.2.1.2.3 Set 'Application: Maximum
Log Size (KB)' to 'Enabled:32768 or greater' (Scored)
.......................................................................................................................................................
346
1.2.1.2.4 Set 'Security: Control
Event Log behavior when the log file reaches its maximum size' to 'Disabled'
(Scored)
.............................................................................................
347
1.2.1.2.5 Set 'System: Control Event
Log behavior when the log file reaches its maximum size' to 'Disabled' (Scored)
.............................................................................................
348
1.2.1.2.6 Set 'Application: Control
Event Log behavior when the log file reaches its maximum size' to 'Disabled'
(Scored) .............................................................................................
350
1.2.1.3 Terminal Services
.........................................................................................................................
351
1.2.1.3.1 Configure 'Encryption
Level' (Not Scored)
................................................................. 351
1.2.1.4 Windows Installer
.........................................................................................................................
352
1.2.1.4.1
Set 'Always install with elevated privileges' to 'Disabled' (Scored)
.................. 352
