Skip to content
ATO Pathways
  Log In

Microsoft Windows Server 2016 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Act as part of the operating system user right must not be assigned to any groups or accounts.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule High Severity
    Show

  • SRG-OS-000080-GPOS-00048

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Allow log on locally user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • The Back up files and directories user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Create a pagefile user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Create permanent shared objects user right must not be assigned to any groups or accounts.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Create symbolic links user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Debug programs user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule High Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Force shutdown from a remote system user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • The Generate security audits user right must only be assigned to Local Service and Network Service.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Generate s...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Impersonat...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Increase scheduling priority user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Load and unload device drivers user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Load and u...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Lock pages in memory user right must not be assigned to any groups or accounts.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Lock pages...
    Rule Medium Severity
    Show

  • SRG-OS-000057-GPOS-00027

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Manage auditing and security log user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Modify firmware environment values user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Perform volume maintenance tasks user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Profile single process user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Create a token object user right must not be assigned to any groups or accounts.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Create a t...
    Rule High Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Restore files and directories user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Take ownership of files or other objects user right must only be assigned to the Administrators group.

    &lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with t...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Windows Explorer Preview pane must be disabled for Windows Server 2016.

    &lt;VulnDiscussion&gt;A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or view...
    Rule Medium Severity
    Show

  • SRG-OS-000041-GPOS-00019

    <GroupDescription></GroupDescription>
    Group
    Show

  • Windows Server 2016 must have PowerShell Transcription enabled.

    &lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules