Microsoft Windows 11 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000433-GPOS-00192
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000433-GPOS-00193
Group -
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000134-GPOS-00068
Group -
SRG-OS-000379-GPOS-00164
Group -
PKU2U authentication using online identities must be prevented.
PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user ac...Rule Medium Severity -
SRG-OS-000120-GPOS-00061
Group -
SRG-OS-000420-GPOS-00186
Group -
SRG-OS-000073-GPOS-00041
Group -
SRG-OS-000125-GPOS-00065
Group -
The Windows Remote Management (WinRM) client must not use Digest authentication.
Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.Rule Medium Severity -
SRG-OS-000028-GPOS-00009
Group -
Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.
UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 11, including virtualiza...Rule Medium Severity -
Windows 11 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: Continuously, where ESS is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).
An approved tool for continuous network scanning must be installed and configured to run. Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, ...Rule Medium Severity -
Windows 11 systems must be maintained at a supported servicing level.
Windows 11 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security...Rule High Severity -
Only accounts responsible for the administration of a system must have Administrator rights on the system.
An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and mak...Rule High Severity -
Inbound exceptions to the firewall on Windows 11 domain workstations must only allow authorized remote management hosts.
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote ...Rule Medium Severity -
Data Execution Prevention (DEP) must be configured to at least OptOut.
Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windo...Rule High Severity -
Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handli...Rule High Severity -
The Windows PowerShell 2.0 feature must be disabled on the system.
Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade ...Rule Medium Severity -
The Server Message Block (SMB) v1 protocol must be disabled on the system.
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS complian...Rule Medium Severity -
Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
Using applications that access the internet or have potential internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running...Rule High Severity -
The Windows 11 time service must synchronize with an appropriate DOD time source.
The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize...Rule Low Severity -
The period of time before the bad logon counter is reset must be configured to 15 minutes.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the cou...Rule Medium Severity -
The system must be configured to audit Account Logon - Credential Validation failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Detailed Tracking - PNP Activity successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Logon/Logoff - Group Membership successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Logon/Logoff - Logon failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows 11 must be configured to audit Object Access - Other Object Access Events successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Object Access - Removable Storage failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Policy Change - Authentication Policy Change successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit System - Other System Events successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit System - System Integrity successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows 11 permissions for the System event log must prevent access by non-privileged accounts.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows 11 must be configured to audit Other Policy Change Events Successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows 11 must be configured to audit Detailed File Share Failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
Windows 11 must cover or disable the built-in or attached camera when not in use.
It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooke...Rule Medium Severity -
The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.Rule Low Severity -
The system must be configured to ignore NetBIOS name release requests except from WINS servers.
Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server...Rule Low Severity -
Windows 11 must be configured to prioritize ECC Curves with longer key lengths first.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first. Requiring ECC curve...Rule Medium Severity -
Virtualization-based Security must be enabled on Windows 11 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.
Virtualization-based Security (VBS) provides the platform for the additional security features, Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum se...Rule Medium Severity -
Web publishing and online ordering wizards must be prevented from downloading a list of providers.
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive informati...Rule Medium Severity -
Solicited Remote Assistance must not be allowed.
Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthori...Rule High Severity -
Unauthenticated RPC clients must be restricted from connecting to the RPC server.
Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.Rule Medium Severity -
The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive informati...Rule Low Severity -
Enhanced diagnostic data must be limited to the minimum required to support Windows Analytics.
Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information ...Rule Medium Severity -
Windows 11 must be configured to disable Windows Game Recording and Broadcasting.
Windows Game Recording and Broadcasting is intended for use with games; however, it could potentially record screen shots of other applications and expose sensitive data. Disabling the feature will...Rule Medium Severity -
Windows 11 must be configured to require a minimum pin length of six characters or greater.
Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised. Longer minimum PIN lengths increase the ava...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.