Skip to content
ATO Pathways
  Log In

Microsoft Windows 11 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Inbound exceptions to the firewall on Windows 11 domain workstations must only allow authorized remote management hosts.

    <VulnDiscussion>Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials ar...
    Rule Medium Severity
    Show

  • SRG-OS-000433-GPOS-00193

    <GroupDescription></GroupDescription>
    Group
    Show

  • Data Execution Prevention (DEP) must be configured to at least OptOut.

    &lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents ha...
    Rule High Severity
    Show

  • SRG-OS-000433-GPOS-00192

    <GroupDescription></GroupDescription>
    Group
    Show

  • Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.

    &lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Pro...
    Rule High Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Windows PowerShell 2.0 feature must be disabled on the system.

    &lt;VulnDiscussion&gt;Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a sys...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • User Account Control must run all administrators in Admin Approval Mode, enabling UAC.

    &lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative account...
    Rule Medium Severity
    Show

  • SRG-OS-000134-GPOS-00068

    <GroupDescription></GroupDescription>
    Group
    Show

  • Solicited Remote Assistance must not be allowed.

    &lt;VulnDiscussion&gt;Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help th...
    Rule High Severity
    Show

  • SRG-OS-000379-GPOS-00164

    <GroupDescription></GroupDescription>
    Group
    Show

  • Unauthenticated RPC clients must be restricted from connecting to the RPC server.

    &lt;VulnDiscussion&gt;Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections....
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • PKU2U authentication using online identities must be prevented.

    &lt;VulnDiscussion&gt;PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joine...
    Rule Medium Severity
    Show

  • SRG-OS-000120-GPOS-00061

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.

    &lt;VulnDiscussion&gt;Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed...
    Rule Low Severity
    Show

  • SRG-OS-000420-GPOS-00186

    <GroupDescription></GroupDescription>
    Group
    Show

  • Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.

    &lt;VulnDiscussion&gt;Certain encryption types are no longer considered secure. This setting configures a minimum encryption type for Kerberos, pre...
    Rule Medium Severity
    Show

  • SRG-OS-000073-GPOS-00041

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Windows Remote Management (WinRM) service must not store RunAs credentials.

    &lt;VulnDiscussion&gt;Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windo...
    Rule Medium Severity
    Show

  • SRG-OS-000125-GPOS-00065

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Windows Remote Management (WinRM) client must not use Digest authentication.

    &lt;VulnDiscussion&gt;Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.&lt;/VulnDiscussion&g...
    Rule Medium Severity
    Show

  • SRG-OS-000028-GPOS-00009

    <GroupDescription></GroupDescription>
    Group
    Show

  • The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.

    &lt;VulnDiscussion&gt;Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise crede...
    Rule Low Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • NTLM must be prevented from falling back to a Null session.

    &lt;VulnDiscussion&gt;NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.&lt;/VulnDiscussi...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000373-GPOS-00157

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000373-GPOS-00157

    <GroupDescription></GroupDescription>
    Group
    Show

  • A host-based firewall must be installed and enabled on the system.

    &lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00232

    <GroupDescription></GroupDescription>
    Group
    Show

  • Bluetooth must be turned off when not in use.

    &lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must notify the user when a Bluetooth device attempts to connect.

    &lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000077-GPOS-00045

    <GroupDescription></GroupDescription>
    Group
    Show

  • The display of slide shows on the lock screen must be disabled.

    &lt;VulnDiscussion&gt;Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • IPv6 source routing must be configured to highest protection.

    &lt;VulnDiscussion&gt;Configuring the system to disable IPv6 source routing protects against spoofing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must be configured to prevent IP source routing.

    &lt;VulnDiscussion&gt;Configuring the system to disable IP source routing protects against spoofing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&l...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000120-GPOS-00061

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The built-in administrator account must be renamed.

    &lt;VulnDiscussion&gt;The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name i...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000423-GPOS-00187

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must be configured to require a strong session key.

    &lt;VulnDiscussion&gt;A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules