CIS Windows 11 Enterprise Benchmark

This recommendation configures 'Enforce password history' to ≥ 24 on the Windows 11 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for 'Enforce password history' could weaken security controls or allow unintended behavior. Setting this to ≥ 24 ensures the Windows 11 operating system operates within a well-defined security boundary.

net accounts | findstr /i "password history"
# Or: secedit /export /cfg C:\secpol.cfg
# Check PasswordHistorySize

# GPO: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy
# Set "Enforce password history" = 24 passwords remembered

This recommendation configures 'Minimum password length' to ≥ 14 on the Windows 11 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for 'Minimum password length' could weaken security controls or allow unintended behavior. Setting this to ≥ 14 ensures the Windows 11 operating system operates within a well-defined security boundary.

net accounts | findstr /i "minimum password length"

# GPO Path: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy
# Set "Minimum password length" = 14

This setting controls whether 'Password must meet complexity requirements' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Password must meet complexity requirements' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# secedit /export /cfg C:\secpol.cfg
# Check PasswordComplexity = 1

# GPO: Password Policy > "Password must meet complexity requirements" = Enabled

This recommendation verifies that 'Maximum password age' Is ≤ 365 Days on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Maximum password age' Is ≤ 365 Days may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

net accounts | findstr /i "maximum password age"

# GPO: Password Policy > "Maximum password age" = 365 days

This setting controls whether 'Store passwords using reversible encryption' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'Store passwords using reversible encryption' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

# secedit /export /cfg C:\secpol.cfg
# Check ClearTextPassword = 0

# GPO: Password Policy > "Store passwords using reversible encryption" = Disabled

This recommendation verifies that 'Account lockout threshold' Is ≤ 5 Invalid Logon Attempts on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Account lockout threshold' Is ≤ 5 Invalid Logon Attempts may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

net accounts | findstr /i "lockout threshold"

# GPO: Account Policies > Account Lockout Policy > "Account lockout threshold" = 5 invalid logon attempts

This recommendation configures the duration for 'Account lockout on the Windows 11 operating system. Appropriate duration values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to 'Account lockout duration' Is ≥ 15 Minutes may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

net accounts | findstr /i "lockout duration"

# GPO: Account Lockout Policy > "Account lockout duration" = 15 minutes

This recommendation verifies that 'Reset account lockout counter after' Is ≥ 15 Minutes on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Reset account lockout counter after' Is ≥ 15 Minutes may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

net accounts | findstr /i "lockout observation"

# GPO: Account Lockout Policy > "Reset account lockout counter after" = 15 minutes

This setting ensures that 'Access this computer from the network' is restricted on the Windows 11 operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted 'Access this computer from the network' could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Windows 11 operating system is essential for defense in depth.

# secedit /export /cfg C:\secpol.cfg
# Check SeNetworkLogonRight

# GPO: Local Policies > User Rights Assignment > "Access this computer from the network"
# Set to: Administrators, Remote Desktop Users

This recommendation verifies that 'Deny log on locally' Includes Guests on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Deny log on locally' Includes Guests may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SeDenyInteractiveLogonRight includes Guests

# GPO: User Rights Assignment > "Deny log on locally" > Add "Guests"

This recommendation verifies that 'Act as part of the operating system' Is Blank on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Act as part of the operating system' Is Blank may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# secedit export: SeTcbPrivilege should be empty

# GPO: User Rights Assignment > "Act as part of the operating system" = No one

This recommendation verifies that 'Debug programs' Is Administrators Only on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Debug programs' Is Administrators Only may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SeDebugPrivilege = *S-1-5-32-544 (Administrators)

# GPO: User Rights Assignment > "Debug programs" = Administrators

This setting controls whether 'Accounts: Administrator account status' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'Accounts: Administrator account status' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

Get-LocalUser -Name "Administrator" | Select-Object Enabled

Disable-LocalUser -Name "Administrator"

This setting controls whether 'Accounts: Guest account status' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'Accounts: Guest account status' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

Get-LocalUser -Name "Guest" | Select-Object Enabled

Disable-LocalUser -Name "Guest"

This setting controls whether 'Interactive logon: Do not display last user name' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Interactive logon: Do not display last user name' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DontDisplayLastUserName"

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DontDisplayLastUserName" -Value 1 -Type DWord

This setting controls whether 'Network access: Do not allow anonymous enumeration of SAM accounts' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Network access: Do not allow anonymous enumeration of SAM accounts' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymousSAM"

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictAnonymousSAM" -Value 1 -Type DWord

This recommendation verifies that 'Network security: LAN Manager authentication level' Is 'NTLMv2 Only' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Network security: LAN Manager authentication level' Is 'NTLMv2 Only' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel"
# Value should be 5 (Send NTLMv2 response only. Refuse LM & NTLM)

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" -Value 5 -Type DWord

This recommendation verifies that 'Audit Credential Validation' Is 'Success and Failure' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Credential Validation' Is 'Success and Failure' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Credential Validation"

auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

This recommendation verifies that 'Audit Logon' Is 'Success and Failure' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Logon' Is 'Success and Failure' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Logon"

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

This recommendation verifies that 'Audit Account Lockout' Is 'Failure' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Account Lockout' Is 'Failure' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Account Lockout"

auditpol /set /subcategory:"Account Lockout" /failure:enable

This recommendation verifies that 'Audit Kerberos Authentication Service' Is 'Success and Failure' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Kerberos Authentication Service' Is 'Success and Failure' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Kerberos Authentication Service"

auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable

This recommendation verifies that 'Audit Security State Change' Is 'Success' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Security State Change' Is 'Success' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Security State Change"

auditpol /set /subcategory:"Security State Change" /success:enable

This recommendation verifies that 'Audit Removable Storage' Is 'Success and Failure' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Removable Storage' Is 'Success and Failure' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Removable Storage"

auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable

This recommendation verifies that 'Audit Process Creation' Is 'Success' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Audit Process Creation' Is 'Success' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditpol /get /subcategory:"Process Creation"

auditpol /set /subcategory:"Process Creation" /success:enable

This setting controls whether 'Real-time protection' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Real-time protection' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-MpPreference | Select-Object DisableRealtimeMonitoring
# Value should be False

Set-MpPreference -DisableRealtimeMonitoring $false

This setting controls whether 'Cloud-delivered protection' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Cloud-delivered protection' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-MpPreference | Select-Object MAPSReporting
# Value should be 2 (Advanced)

Set-MpPreference -MAPSReporting Advanced

This setting controls whether 'Behavior monitoring' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Behavior monitoring' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-MpPreference | Select-Object DisableBehaviorMonitoring

Set-MpPreference -DisableBehaviorMonitoring $false

This setting controls whether 'Attack Surface Reduction rules' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Attack Surface Reduction rules' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

# Enable key ASR rules:
Add-MpPreference -AttackSurfaceReductionRules_Ids "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" -AttackSurfaceReductionRules_Actions Enabled  # Block executable content from email
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled  # Block Office child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids "3B576869-A4EC-4529-8536-B80A7769E899" -AttackSurfaceReductionRules_Actions Enabled  # Block Office macro Win32 API

This setting controls whether 'Controlled folder access' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Controlled folder access' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-MpPreference | Select-Object EnableControlledFolderAccess

Set-MpPreference -EnableControlledFolderAccess Enabled

This recommendation verifies that 'Domain Profile: Firewall state' Is 'On' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Domain Profile: Firewall state' Is 'On' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Domain | Select-Object Enabled

Set-NetFirewallProfile -Name Domain -Enabled True

This recommendation verifies that 'Private Profile: Firewall state' Is 'On' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Private Profile: Firewall state' Is 'On' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Private | Select-Object Enabled

Set-NetFirewallProfile -Name Private -Enabled True

This recommendation verifies that 'Public Profile: Firewall state' Is 'On' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Public Profile: Firewall state' Is 'On' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Public | Select-Object Enabled

Set-NetFirewallProfile -Name Public -Enabled True

This recommendation verifies that Default Inbound Action Is 'Block' for All Profiles on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Inbound Action Is 'Block' for All Profiles may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile | Select-Object Name, DefaultInboundAction

Set-NetFirewallProfile -All -DefaultInboundAction Block

This recommendation verifies that Firewall Logging Is Enabled for All Profiles on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to firewall Logging Is Enabled for All Profiles may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile | Select-Object Name, LogFileName, LogMaxSizeKilobytes, LogAllowed, LogBlocked

Set-NetFirewallProfile -All -LogAllowed True -LogBlocked True -LogMaxSizeKilobytes 16384 -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log"

This setting controls whether 'Turn off multicast name resolution (LLMNR)' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Turn off multicast name resolution (LLMNR)' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast"

New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -PropertyType DWord -Force

This setting controls whether 'Remote Desktop Services: Require NLA' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Remote Desktop Services: Require NLA' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication"

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1 -Type DWord

This recommendation verifies that 'Remote Desktop Services: Encryption Level' Is 'High' on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'Remote Desktop Services: Encryption Level' Is 'High' may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "MinEncryptionLevel"

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "MinEncryptionLevel" -Value 3 -Type DWord

This setting controls whether 'WinRM Client: Disallow Digest authentication' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'WinRM Client: Disallow Digest authentication' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" -Name "AllowDigest"

New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" -Name "AllowDigest" -Value 0 -PropertyType DWord -Force

This recommendation verifies that BitLocker Drive Encryption Is Enabled for OS Drive on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to bitLocker Drive Encryption Is Enabled for OS Drive may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-BitLockerVolume -MountPoint "C:" | Select-Object VolumeStatus, ProtectionStatus, EncryptionMethod

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

This recommendation verifies that BitLocker Encryption Method Is XTS-AES 256-bit on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to bitLocker Encryption Method Is XTS-AES 256-bit may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\FVE" -Name "EncryptionMethodWithXtsOs"

# GPO: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > OS Drives
# "Choose drive encryption method and cipher strength" = XTS-AES 256-bit
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\FVE" -Name "EncryptionMethodWithXtsOs" -Value 7 -Type DWord

This recommendation addresses the proper configuration of 'Require additional authentication at startup' on the Windows 11 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of 'Require additional authentication at startup' can lead to security gaps that may be exploited by attackers. A properly configured Windows 11 operating system reduces exposure to both known vulnerabilities and configuration drift.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\FVE" -Name "UseAdvancedStartup"

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\FVE" -Name "UseAdvancedStartup" -Value 1 -Type DWord

This setting controls whether Windows Defender Credential Guard is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without Windows Defender Credential Guard enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning
# 1 = Credential Guard running

# GPO: Computer Configuration > Admin Templates > System > Device Guard
# "Turn On Virtualization Based Security" = Enabled
# "Credential Guard Configuration" = Enabled with UEFI lock
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LsaCfgFlags" -Value 1

This recommendation verifies that LSASS Runs as a Protected Process on the Windows 11 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to lSASS Runs as a Protected Process may leave the Windows 11 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL"

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1 -Type DWord

This setting controls whether 'WDigest Authentication' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'WDigest Authentication' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential"

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 0 -Type DWord

This setting controls whether PowerShell Script Block Logging is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without PowerShell Script Block Logging enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging"

New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -Type DWord

This setting controls whether 'Windows Sandbox' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'Windows Sandbox' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

Get-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" | Select-Object State

Disable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -NoRestart

This setting controls whether 'SMBv1 Client/Server' is disabled on the Windows 11 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'SMBv1 Client/Server' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows 11 operating system.

Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object State

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

This setting controls whether 'Include command line in process creation events' is enabled on the Windows 11 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, registry settings, or security configuration.

Without 'Include command line in process creation events' enabled, the Windows 11 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled"

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord