III - Administrative Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000480-GPOS-00227
Group -
The Windows 11 system must use an antivirus program.
Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operati...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
Local volumes must be formatted using NTFS.
The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using the NTFS file sys...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
Alternate operating systems must not be permitted on the same system.
Allowing other operating systems to run on a secure system may allow security to be circumvented.Rule Medium Severity -
SRG-OS-000138-GPOS-00069
Group -
Non-system-created file shares on a system must limit access to groups that require it.
Shares which provide network access, must not exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information. If a share is necessary, sh...Rule Medium Severity -
SRG-OS-000468-GPOS-00212
Group -
Unused accounts must be disabled or removed from the system after 35 days of inactivity.
Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed. Satisfies: SRG-...Rule Low Severity -
SRG-OS-000312-GPOS-00123
Group -
Only accounts responsible for the administration of a system must have Administrator rights on the system.
An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and mak...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
Only accounts responsible for the backup operations must be members of the Backup Operators group.
Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions pre...Rule Medium Severity -
SRG-OS-000312-GPOS-00124
Group -
Only authorized user accounts must be allowed to create or run virtual machines on Windows 11 systems.
Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Standard local user accounts must not exist on a system in a domain.
To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log on to worksta...Rule Low Severity -
SRG-OS-000076-GPOS-00044
Group -
Accounts must be configured to require password expiration.
Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.