Microsoft Windows 10 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The computer account password must not be prevented from being reset.
Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes ca...Rule Low Severity -
The maximum age for machine account passwords must be configured to 30 days or less.
Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 3...Rule Low Severity -
Caching of logon credentials must be limited.
The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's mac...Rule Low Severity -
The Windows SMB client must be configured to always perform SMB packet signing.
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SM...Rule Medium Severity -
Anonymous access to Named Pipes and Shares must be restricted.
Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be...Rule High Severity -
The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for com...Rule High Severity -
The system must be configured to the required LDAP client signing level.
This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.Rule Medium Severity -
The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.
Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.Rule Medium Severity -
The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Governm...Rule Medium Severity -
Windows 10 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.
Without the use of multifactor authentication, the ease of access to privileged and nonprivileged functions is greatly increased. All domain accounts must be enabled for multifactor authenticatio...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.