The "Deny access to this computer from the network" user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and from unauthenticated access on all systems.

No profile (default benchmark)

I - Mission Critical Classified

I - Mission Critical Public

I - Mission Critical Sensitive

II - Mission Support Classified

II - Mission Support Public

II - Mission Support Sensitive

III - Administrative Classified

III - Administrative Public

III - Administrative Sensitive