Skip to content
Log In

Microsoft Windows 11 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • SRG-OS-000120-GPOS-00061

    Group
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • The built-in administrator account must be renamed.

    The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • SRG-OS-000423-GPOS-00187

    Group
    Show

  • The system must be configured to require a strong session key.

    A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.
    Rule Medium Severity
    Show

  • SRG-OS-000279-GPOS-00109

    Group
    Show

  • File Explorer shell protocol must run in protected mode.

    The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open, to a limited set of folders, increases the security of ...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    Group
    Show

  • SRG-OS-000033-GPOS-00014

    Group
    Show

  • The Windows Remote Management (WinRM) service must not allow unencrypted traffic.

    Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.
    Rule Medium Severity
    Show

  • SRG-OS-000373-GPOS-00156

    Group
    Show

  • Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

    IIS is not installed by default. Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been desi...
    Rule High Severity
    Show

  • SRG-OS-000096-GPOS-00050

    Group
    Show

  • Simple Network Management Protocol (SNMP) must not be installed on the system.

    "SNMP" is not installed by default. Some protocols and services do not support required security features, such as encrypting passwords or traffic.
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    Group
    Show

  • Simple TCP/IP Services must not be installed on the system.

    "Simple TCP/IP Services" is not installed by default. Some protocols and services do not support required security features, such as encrypting passwords or traffic.
    Rule Medium Severity
    Show

  • SRG-OS-000096-GPOS-00050

    Group
    Show

  • The Telnet Client must not be installed on the system.

    The "Telnet Client" is not installed by default. Some protocols and services do not support required security features, such as encrypting passwords or traffic.
    Rule Medium Severity
    Show

  • SRG-OS-000096-GPOS-00050

    Group
    Show

  • The TFTP Client must not be installed on the system.

    The "TFTP Client" is not installed by default. Some protocols and services do not support required security features, such as encrypting passwords or traffic.
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • Secure Boot must be enabled on Windows 11 systems.

    Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 11, including virtualization-based...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • Domain-joined systems must use Windows 11 Enterprise Edition 64-bit version.

    Features such as Credential Guard use virtualization-based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements t...
    Rule Medium Severity
    Show

  • SRG-OS-000424-GPOS-00188

    Group
    Show

  • Windows 11 domain-joined systems must have a Trusted Platform Module (TPM) enabled.

    Credential Guard uses virtualization-based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met ...
    Rule Medium Severity
    Show

  • SRG-OS-000424-GPOS-00188

    Group
    Show

  • SRG-OS-000424-GPOS-00188

    Group
    Show

  • SRG-OS-000191-GPOS-00080

    Group
    Show

  • SRG-OS-000404-GPOS-00183

    Group
    Show

  • Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

    If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, t...
    Rule High Severity
    Show

  • SRG-OS-000405-GPOS-00184

    Group
    Show

  • Windows 11 systems must use a BitLocker PIN for pre-boot authentication.

    If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, t...
    Rule High Severity
    Show

  • SRG-OS-000121-GPOS-00062

    Group
    Show

  • Windows 11 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.

    If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, t...
    Rule Medium Severity
    Show

  • SRG-OS-000370-GPOS-00155

    Group
    Show

  • The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

    Utilizing an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of pot...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • The Windows 11 system must use an antivirus program.

    Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operati...
    Rule High Severity
    Show

  • SRG-OS-000080-GPOS-00048

    Group
    Show

  • Local volumes must be formatted using NTFS.

    The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using the NTFS file sys...
    Rule High Severity
    Show

  • SRG-OS-000480-GPOS-00227

    Group
    Show

  • Alternate operating systems must not be permitted on the same system.

    Allowing other operating systems to run on a secure system may allow security to be circumvented.
    Rule Medium Severity
    Show

  • SRG-OS-000138-GPOS-00069

    Group
    Show

  • Non-system-created file shares on a system must limit access to groups that require it.

    Shares which provide network access, must not exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information. If a share is necessary, sh...
    Rule Medium Severity
    Show

  • SRG-OS-000468-GPOS-00212

    Group
    Show

  • Unused accounts must be disabled or removed from the system after 35 days of inactivity.

    Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed. Satisfies: SRG-...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules