II - Mission Support Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000480-GPOS-00227
Group -
Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these pe...Rule Medium Severity -
SRG-OS-000138-GPOS-00069
Group -
Anonymous access to Named Pipes and Shares must be restricted.
Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be ...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
NTLM must be prevented from falling back to a Null session.
NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
PKU2U authentication using online identities must be prevented.
PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user acc...Rule Medium Severity -
SRG-OS-000120-GPOS-00061
Group -
Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. Note: Organizations with domain controllers running earlier ve...Rule Medium Severity -
SRG-OS-000073-GPOS-00041
Group -
Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords.
The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM.
The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compa...Rule High Severity -
SRG-OS-000480-GPOS-00227
Group -
Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing.
This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.Rule Medium Severity -
SRG-OS-000067-GPOS-00035
Group -
Users must be required to enter a password to access private keys stored on the computer.
If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key use...Rule Medium Severity -
SRG-OS-000033-GPOS-00014
Group -
Windows Server 2016 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government an...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The default permissions of global system objects must be strengthened.
Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List ...Rule Low Severity -
SRG-OS-000373-GPOS-00157
Group -
User Account Control approval mode for the built-in Administrator must be enabled.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator...Rule Medium Severity -
SRG-OS-000134-GPOS-00068
Group -
UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility...Rule Medium Severity -
SRG-OS-000134-GPOS-00068
Group -
User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements...Rule Medium Severity -
SRG-OS-000373-GPOS-00157
Group -
User Account Control must automatically deny standard user requests for elevation.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation wh...Rule Medium Severity -
SRG-OS-000134-GPOS-00068
Group -
User Account Control must be configured to detect application installations and prompt for elevation.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to applic...Rule Medium Severity -
SRG-OS-000134-GPOS-00068
Group -
User Account Control must only elevate UIAccess applications that are installed in secure locations.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow appl...Rule Medium Severity -
SRG-OS-000373-GPOS-00157
Group -
User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. Satisfies: SRG-OS-00037...Rule Medium Severity -
SRG-OS-000134-GPOS-00068
Group -
User Account Control must virtualize file and registry write failures to per-user locations.
User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applicat...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Zone information must be preserved when saving attachments.
Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group -
The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Access Credential Manager as a trusted caller" user right may be abl...Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group -
The Act as part of the operating system user right must not be assigned to any groups or accounts.
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Act as part of the operating system" user right can assume the ident...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.