Microsoft Windows 10 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The computer account password must not be prevented from being reset.
Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes ca...Rule Low Severity -
The maximum age for machine account passwords must be configured to 30 days or less.
Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 3...Rule Low Severity -
Caching of logon credentials must be limited.
The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's mac...Rule Low Severity -
The Windows SMB client must be configured to always perform SMB packet signing.
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SM...Rule Medium Severity -
Anonymous access to Named Pipes and Shares must be restricted.
Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be...Rule High Severity -
The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for com...Rule High Severity -
The system must be configured to the required LDAP client signing level.
This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.Rule Medium Severity -
The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.
Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.Rule Medium Severity -
The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Governm...Rule Medium Severity -
Windows 10 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.
Without the use of multifactor authentication, the ease of access to privileged and nonprivileged functions is greatly increased. All domain accounts must be enabled for multifactor authenticatio...Rule Medium Severity -
User Account Control must be configured to detect application installations and prompt for elevation.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to appli...Rule Medium Severity -
User Account Control must virtualize file and registry write failures to per-user locations.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC compliant applica...Rule Medium Severity -
Passwords for enabled local Administrator accounts must be changed at least every 60 days.
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password may not...Rule Medium Severity -
The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. Accounts with the "Access Credential Manager as a trusted caller" user right may be abl...Rule Medium Severity -
The Create a token object user right must not be assigned to any groups or accounts.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Create a token object" user right allows a process to create an access token. This...Rule High Severity -
The Debug programs user right must only be assigned to the Administrators group.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. Accounts with the "Debug Programs" user right can attach a debugger to any process or t...Rule High Severity -
The "Deny log on as a batch job" user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on as a batch job" right defines accounts that are prevented from logging...Rule Medium Severity -
The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on through Remote Desktop Services" right defines the accounts that are p...Rule Medium Severity -
The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Impersonate a client after authentication" user right allows a program to imperson...Rule Medium Severity -
The Manage auditing and security log user right must only be assigned to the Administrators group.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. Accounts with the "Manage auditing and security log" user right can manage the security...Rule Medium Severity -
The Restore files and directories user right must only be assigned to the Administrators group.
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. Accounts with the "Restore files and directories" user right can circumvent file and di...Rule Medium Severity -
PowerShell Transcription must be enabled on Windows 10.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.