Microsoft Windows Server 2019 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group.
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Take ownership of files or other objects" user right can take owners...Rule Medium Severity -
Windows Server 2019 must be configured to audit Account Management - Other Account Management Events successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit System - Other System Events failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit System - System Integrity successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 Active Directory Group Policy objects must be configured with proper audit settings.
When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact...Rule Medium Severity -
Windows Server 2019 Active Directory Domain object must be configured with proper audit settings.
When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact...Rule Medium Severity -
Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact...Rule Medium Severity -
Windows Server 2019 Active Directory AdminSDHolder object must be configured with proper audit settings.
When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact...Rule Medium Severity -
Windows Server 2019 Active Directory RID Manager$ object must be configured with proper audit settings.
When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact...Rule Medium Severity -
Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows Server 2019 account lockout duration must be configured to 15 minutes or greater.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified nu...Rule Medium Severity -
The Windows Server 2019 time service must synchronize with an appropriate DOD time source.
The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize...Rule Low Severity -
Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Using an allowlist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential v...Rule Medium Severity -
Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. Satisfies: SRG-OS-00037...Rule Medium Severity -
Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. Satisfies: SRG-OS-000393-GPOS-0017...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.