CIS Microsoft SharePoint Server 2019 Benchmark

This recommendation verifies that farm service account is not a domain administrator on the SharePoint Server 2019 collaboration platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SharePoint Server 2019 collaboration platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Verify the SharePoint farm service account is NOT a domain admin:
Get-SPManagedAccount | Select-Object Username

# Check farm account:
(Get-SPFarm).DefaultServiceAccount.Name

# Verify NOT in Domain Admins:
Get-ADGroupMember 'Domain Admins' | Where-Object { $_.Name -like '*spfarm*' }

# Create a dedicated managed account with least privilege:
$cred = Get-Credential
New-SPManagedAccount -Credential $cred

# Change farm account if needed:
Set-SPFarm -DefaultServiceAccount (Get-SPManagedAccount 'DOMAIN\sp_farm')

This recommendation verifies that web app pools use dedicated managed accounts on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify web application pool identities use dedicated accounts:
Get-SPWebApplication | ForEach-Object {
    $pool = (Get-SPServiceApplicationPool -Identity $_.ApplicationPool)
    Write-Host "$($_.Url) -> $($pool.ProcessAccountName)"
}

# Set a dedicated application pool identity:
$sa = Get-SPManagedAccount 'DOMAIN\sp_apppool'
Set-SPWebApplication -Identity 'http://sharepoint' -ApplicationPool -ApplicationPoolAccount $sa

This recommendation verifies that service app pools use unique managed accounts on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify service application pool identities:
Get-SPServiceApplicationPool | Select-Object Name, ProcessAccountName

# Ensure each uses a unique managed account

# Configure service application pool identity:
$ma = Get-SPManagedAccount 'DOMAIN\sp_services'
Set-SPServiceApplicationPool -Identity 'SharePoint Service App Pool' -Account $ma

This recommendation ensures that farm passphrase meets complexity requirements on the SharePoint Server 2019 collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SharePoint Server 2019 collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify farm passphrase meets complexity:
# No direct audit command — verify with documentation
# Check that passphrase was recently set:
Get-SPFarm | Select-Object BuildVersion, NeedsUpgrade

# Set a strong farm passphrase (min 8 chars, mixed case, special, number):
Set-SPPassPhrase -PassPhrase (ConvertTo-SecureString 'N3wStr0ng!P@ss#2024' -AsPlainText -Force) -Confirm

This recommendation verifies that claims-based authentication is configured on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check claims-based authentication per web app:
Get-SPWebApplication | ForEach-Object {
    $_.UseClaimsAuthentication
    $_.GetIisSettingsWithFallback('Default').ClaimsAuthenticationProviders
} | Format-List

# Enable claims-based authentication:
Set-SPWebApplication -Identity 'http://sharepoint' -Zone Default -AuthenticationProvider (New-SPAuthenticationProvider -UseWindowsIntegratedAuthentication)

This recommendation ensures that Kerberos authentication is enforced on the SharePoint Server 2019 collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SharePoint Server 2019 collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify Kerberos is used instead of NTLM:
Get-SPWebApplication | ForEach-Object {
    $iis = $_.GetIisSettingsWithFallback('Default')
    Write-Host "$($_.Url): DisableKerberos=$($iis.DisableKerberos)"
} | Format-List

# Check IIS authentication:
%windir%\system32\inetsrv\appcmd.exe list config /section:windowsAuthentication

# Configure Kerberos authentication:
$ap = New-SPAuthenticationProvider -UseWindowsIntegratedAuthentication -DisableKerberos:$false
Set-SPWebApplication -Identity 'http://sharepoint' -Zone Default -AuthenticationProvider $ap

# Register SPNs:
setspn -S HTTP/sharepoint.contoso.com DOMAIN\sp_apppool
setspn -S HTTP/sharepoint DOMAIN\sp_apppool

This recommendation verifies that anonymous access is disabled on the SharePoint Server 2019 collaboration platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SharePoint Server 2019 collaboration platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check if anonymous access is disabled:
Get-SPWebApplication | ForEach-Object {
    $iis = $_.GetIisSettingsWithFallback('Default')
    Write-Host "$($_.Url): AllowAnonymous=$($iis.AllowAnonymous)"
}

# Disable anonymous access:
Set-SPWebApplication -Identity 'http://sharepoint' -Zone Default -AllowAnonymousAccess:$false

# Verify in IIS:
%windir%\system32\inetsrv\appcmd.exe set config /section:anonymousAuthentication /enabled:false

This setting ensures that site collection administrators are restricted on the SharePoint Server 2019 collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SharePoint Server 2019 collaboration platform is essential for defense in depth.

# Audit site collection administrators:
Get-SPSite -Limit All | ForEach-Object {
    $admins = $_.RootWeb.SiteAdministrators | Select-Object LoginName
    Write-Host "$($_.Url): $($admins.LoginName -join ', ')"
}

# Remove unnecessary site collection admins:
$site = Get-SPSite 'http://sharepoint'
$web = $site.RootWeb
$user = $web.EnsureUser('DOMAIN\unauthorized_user')
$web.SiteAdministrators.Remove($user)
$web.Update()

This recommendation ensures that least privilege permissions are enforced on the SharePoint Server 2019 collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SharePoint Server 2019 collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check permission levels for excessive privileges:
Get-SPWeb 'http://sharepoint' | ForEach-Object {
    $_.RoleDefinitions | Select-Object Name, BasePermissions
} | Format-Table

# Remove Full Control from non-admin groups:
$web = Get-SPWeb 'http://sharepoint'
$role = $web.RoleDefinitions['Full Control']
# Review and adjust assignments:
$web.RoleAssignments | ForEach-Object {
    $_.RoleDefinitionBindings | Where-Object { $_.Name -eq 'Full Control' }
}

This recommendation ensures that SSL/TLS is enforced for all web applications on the SharePoint Server 2019 collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SharePoint Server 2019 collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify SSL/TLS is enforced:
Get-SPWebApplication | ForEach-Object {
    $zone = $_.AlternateUrls | Where-Object { $_.Zone -eq 'Default' }
    Write-Host "$($_.DisplayName): $($zone.IncomingUrl)"
}

# Check IIS bindings:
Get-WebBinding -Protocol https | Format-Table

# Configure HTTPS binding in IIS:
New-WebBinding -Name 'SharePoint - 443' -Protocol https -Port 443 -SslFlags 0

# Set SharePoint AAM to HTTPS:
Set-SPAlternateURL -Identity 'http://sharepoint' -Url 'https://sharepoint' -Zone Default

# Require SSL:
Set-SPWebApplication -Identity 'https://sharepoint' -Zone Default -SecureSocketsLayer

This recommendation ensures that TLS 1.2 or higher is required on the SharePoint Server 2019 collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SharePoint Server 2019 collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Verify TLS 1.2+ only:
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name Enabled
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled 2>$null
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Name Enabled 2>$null

# Disable TLS 1.0:
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name Enabled -Value 0

# Disable TLS 1.1:
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Name Enabled -Value 0

# Enable TLS 1.2:
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name Enabled -Value 1

This recommendation verifies that Information Rights Management is configured on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Information Rights Management is configured:
Get-SPSite -Limit All | ForEach-Object {
    Write-Host "$($_.Url): IRM=$($_.IrmEnabled)"
}

# Check farm-level IRM:
(Get-SPFarm).Properties['irm_enabled']

# Enable IRM at farm level:
$farm = Get-SPFarm
$farm.Properties['irm_enabled'] = $true
$farm.Update()

# Enable IRM on a site collection:
$site = Get-SPSite 'http://sharepoint'
$site.IrmEnabled = $true
$site.Update()

This recommendation verifies that diagnostic logging is enabled and configured on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify diagnostic logging is enabled:
Get-SPDiagnosticConfig | Select-Object LogLocation, DaysToKeepLogs, LogMaxDiskSpaceUsageEnabled, ErrorReportingEnabled

# Check ULS log level:
Get-SPLogLevel | Where-Object { $_.TraceSeverity -ne 'Medium' } | Format-Table Area, Name, TraceSeverity

# Configure diagnostic logging:
Set-SPDiagnosticConfig -LogLocation 'D:\SharePointLogs\ULS' -DaysToKeepLogs 14 -LogMaxDiskSpaceUsageEnabled:$true -LogDiskSpaceUsageGB 5

# Set appropriate log levels:
Set-SPLogLevel -TraceSeverity Medium -EventSeverity Information

This recommendation verifies that usage and health data collection is enabled on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify usage and health data collection:
Get-SPUsageService | Select-Object LoggingEnabled, UsageLogDir, UsageLogMaxSpaceGB

# Check health analyzer:
Get-SPHealthAnalysisRule | Select-Object Name, Enabled | Format-Table

# Enable usage and health data collection:
Set-SPUsageService -LoggingEnabled:$true -UsageLogMaxSpaceGB 5

# Enable all health analyzer rules:
Get-SPHealthAnalysisRule | ForEach-Object { Enable-SPHealthAnalysisRule -Identity $_.Name }

This recommendation verifies that audit log settings are configured on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify audit log settings on site collections:
Get-SPSite -Limit All | ForEach-Object {
    $audit = $_.Audit
    Write-Host "$($_.Url): AuditFlags=$($audit.AuditFlags)"
}

# Enable comprehensive auditing:
$site = Get-SPSite 'http://sharepoint'
$site.Audit.AuditFlags = [Microsoft.SharePoint.SPAuditMaskType]::All
$site.Audit.Update()

# Or specific events:
$site.Audit.AuditFlags = 'CheckIn, CheckOut, MoveCopy, DeleteRestore, SearchQuery, SecurityChange, ProfileChange, SchemaChange'

This recommendation verifies that app sideloading is disabled on the SharePoint Server 2019 collaboration platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the SharePoint Server 2019 collaboration platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Verify app catalog and sideloading settings:
Get-SPAppAcquisitionConfiguration -WebApplication 'http://sharepoint'

# Check if app sideloading is disabled:
Get-SPFeature -Identity 'AE3A1339-61F5-4e8f-81A7-ABD2DA956A7D' -ErrorAction SilentlyContinue

# Disable app sideloading:
Disable-SPFeature -Identity 'AE3A1339-61F5-4e8f-81A7-ABD2DA956A7D' -Url 'http://sharepoint' -Force

# Configure app acquisition:
Set-SPAppAcquisitionConfiguration -WebApplication 'http://sharepoint' -Enable:$false

This recommendation verifies that app permissions are reviewed on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check app permissions:
Get-SPAppInstance -Web 'http://sharepoint' | Select-Object Title, Status, AppPrincipalId

# Review app-only permissions:
Get-SPServiceApplicationSecurity (Get-SPServiceApplication | Where-Object { $_.TypeName -eq 'User Profile Service Application' })

# Remove unauthorized apps:
$app = Get-SPAppInstance -Web 'http://sharepoint' | Where-Object { $_.Title -eq 'UntrustedApp' }
Uninstall-SPAppInstance -Identity $app -Confirm:$false

This recommendation verifies that search crawl account uses least privilege on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify search crawl account uses least privilege:
Get-SPEnterpriseSearchCrawlContentSource -SearchApplication (Get-SPEnterpriseSearchServiceApplication) | Select-Object Name, Type, CrawlState

# Check default content access account:
$ssa = Get-SPEnterpriseSearchServiceApplication
$ssa.GetProperty('DefaultContentAccessAccountName')

# Set dedicated crawl account:
$ssa = Get-SPEnterpriseSearchServiceApplication
$content = New-Object Microsoft.Office.Server.Search.Administration.Content($ssa)
$content.SetDefaultGatheringAccount('DOMAIN\sp_crawl', (ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force))

This recommendation verifies that regular farm backups are scheduled on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify backup schedule:
Get-SPTimerJob | Where-Object { $_.Name -like '*backup*' } | Select-Object Name, Schedule, LastRunTime

# Check last backup:
Get-SPBackupHistory -Directory '\\backup\sharepoint' -ShowBackup | Select-Object -Last 3 | Format-Table

# Configure farm backup:
Backup-SPFarm -Directory '\\backup\sharepoint' -BackupMethod Full

# Schedule regular backups via task scheduler:
stsadm -o backup -directory '\\backup\sharepoint' -backupmethod full

This recommendation verifies that browser file handling is set to Strict on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify browser file handling is set to Strict:
Get-SPWebApplication | ForEach-Object {
    Write-Host "$($_.Url): BrowserFileHandling=$($_.BrowserFileHandling)"
}

# Set browser file handling to Strict:
$wa = Get-SPWebApplication 'http://sharepoint'
$wa.BrowserFileHandling = 'Strict'
$wa.Update()

This setting ensures that dangerous file types are blocked on the SharePoint Server 2019 collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SharePoint Server 2019 collaboration platform is essential for defense in depth.

# Check blocked file types:
Get-SPWebApplication 'http://sharepoint' | ForEach-Object {
    $_.BlockedFileExtensions | Sort-Object
}

# Add dangerous file extensions to blocked list:
$wa = Get-SPWebApplication 'http://sharepoint'
$wa.BlockedFileExtensions.Add('exe')
$wa.BlockedFileExtensions.Add('bat')
$wa.BlockedFileExtensions.Add('cmd')
$wa.BlockedFileExtensions.Add('ps1')
$wa.BlockedFileExtensions.Add('vbs')
$wa.Update()

This setting ensures that maximum upload size is limited on the SharePoint Server 2019 collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SharePoint Server 2019 collaboration platform is essential for defense in depth.

# Verify upload size limits:
Get-SPWebApplication 'http://sharepoint' | Select-Object MaximumFileSize

# Check web.config:
# <httpRuntime maxRequestLength="..." />

# Set maximum upload size (in MB):
$wa = Get-SPWebApplication 'http://sharepoint'
$wa.MaximumFileSize = 50
$wa.Update()

This recommendation verifies that security headers are configured on the SharePoint Server 2019 collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SharePoint Server 2019 collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web.config for security headers:
Get-Content 'C:\inetpub\wwwroot\wss\VirtualDirectories\443\web.config' | Select-String 'X-Content-Type-Options|X-Frame-Options|Content-Security-Policy|Strict-Transport-Security'

# Add security headers in web.config:
# <system.webServer>
#   <httpProtocol>
#     <customHeaders>
#       <add name="X-Content-Type-Options" value="nosniff" />
#       <add name="X-Frame-Options" value="SAMEORIGIN" />
#       <add name="Strict-Transport-Security" value="max-age=31536000" />
#       <add name="Content-Security-Policy" value="default-src 'self'" />
#     </customHeaders>
#   </httpProtocol>
# </system.webServer>

This setting ensures that Central Administration access is restricted on the SharePoint Server 2019 collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SharePoint Server 2019 collaboration platform is essential for defense in depth.

# Verify Central Admin is restricted by IP/network:
Get-SPWebApplication -IncludeCentralAdministration | Where-Object { $_.IsAdministrationWebApplication } | ForEach-Object {
    Write-Host "Central Admin URL: $($_.Url)"
    Write-Host "Port: $($_.Port)"
}

# Restrict Central Administration access:
# Configure Windows Firewall to limit access:
New-NetFirewallRule -DisplayName 'Block Central Admin External' -Direction Inbound -LocalPort $(Get-SPWebApplication -IncludeCentralAdministration | Where-Object { $_.IsAdministrationWebApplication } | Select-Object -ExpandProperty Port) -Protocol TCP -Action Block -RemoteAddress @('0.0.0.0/0') 
New-NetFirewallRule -DisplayName 'Allow Central Admin Internal' -Direction Inbound -LocalPort $(Get-SPWebApplication -IncludeCentralAdministration | Where-Object { $_.IsAdministrationWebApplication } | Select-Object -ExpandProperty Port) -Protocol TCP -Action Allow -RemoteAddress @('10.0.0.0/8', '192.168.0.0/16')