CIS Windows Server 2016 Benchmark

This recommendation verifies that Minimum Password Length Is Set to 14 or More on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Minimum Password Length Is Set to 14 or More. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Minimum Password Length Is Set to 14 or More. Run gpupdate /force to apply.

This recommendation verifies that Password History Is Set to 24 or More on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Password History Is Set to 24 or More. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Password History Is Set to 24 or More. Run gpupdate /force to apply.

This recommendation verifies that Maximum Password Age Is Set to 365 or Fewer Days on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Maximum Password Age Is Set to 365 or Fewer Days. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Maximum Password Age Is Set to 365 or Fewer Days. Run gpupdate /force to apply.

This recommendation verifies that Minimum Password Age Is Set to 1 or More Days on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Minimum Password Age Is Set to 1 or More Days. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Minimum Password Age Is Set to 1 or More Days. Run gpupdate /force to apply.

This recommendation verifies that Password Must Meet Complexity Requirements Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Password Must Meet Complexity Requirements Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Password Must Meet Complexity Requirements Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Store Passwords Using Reversible Encryption Is Disabled on the Windows Server 2016 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2016 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Store Passwords Using Reversible Encryption Is Disabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Store Passwords Using Reversible Encryption Is Disabled. Run gpupdate /force to apply.

This recommendation verifies that Account Lockout Duration Is Set to 15 or More Minutes on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Account Lockout Duration Is Set to 15 or More Minutes. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Account Lockout Duration Is Set to 15 or More Minutes. Run gpupdate /force to apply.

This recommendation verifies that Account Lockout Threshold Is Set to 10 or Fewer Attempts on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Account Lockout Threshold Is Set to 10 or Fewer Attempts. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Account Lockout Threshold Is Set to 10 or Fewer Attempts. Run gpupdate /force to apply.

This recommendation verifies that Reset Account Lockout Counter Is Set to 15 or More Minutes on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Reset Account Lockout Counter Is Set to 15 or More Minutes. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Reset Account Lockout Counter Is Set to 15 or More Minutes. Run gpupdate /force to apply.

This recommendation verifies that Access This Computer from the Network Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Access This Computer from the Network Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Access This Computer from the Network Is Configured. Run gpupdate /force to apply.

This recommendation verifies that Act as Part of the Operating System Is Set to No One on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Act as Part of the Operating System Is Set to No One. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Act as Part of the Operating System Is Set to No One. Run gpupdate /force to apply.

This recommendation verifies that Allow Log On Locally Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Allow Log On Locally Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Allow Log On Locally Is Configured. Run gpupdate /force to apply.

This recommendation verifies that Debug Programs Is Set to Administrators on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Debug Programs Is Set to Administrators. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Debug Programs Is Set to Administrators. Run gpupdate /force to apply.

This recommendation verifies that Deny Access to This Computer from the Network Includes Guests on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Deny Access to This Computer from the Network Includes Guests. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Deny Access to This Computer from the Network Includes Guests. Run gpupdate /force to apply.

This recommendation verifies that Deny Log On as a Batch Job Includes Guests on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Deny Log On as a Batch Job Includes Guests. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Deny Log On as a Batch Job Includes Guests. Run gpupdate /force to apply.

This recommendation verifies that Accounts: Rename Administrator Account Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Accounts: Rename Administrator Account Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Accounts: Rename Administrator Account Is Configured. Run gpupdate /force to apply.

This recommendation verifies that Accounts: Rename Guest Account Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Accounts: Rename Guest Account Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Accounts: Rename Guest Account Is Configured. Run gpupdate /force to apply.

This recommendation verifies that Interactive Logon: Do Not Display Last Username Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Interactive Logon: Do Not Display Last Username Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Interactive Logon: Do Not Display Last Username Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds. Run gpupdate /force to apply.

This recommendation verifies that Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only. Run gpupdate /force to apply.

This recommendation verifies that Windows Firewall Domain Profile Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Windows Firewall Domain Profile Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Windows Firewall Domain Profile Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Domain Inbound Connections Are Set to Block on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Domain Inbound Connections Are Set to Block. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Domain Inbound Connections Are Set to Block. Run gpupdate /force to apply.

This recommendation verifies that Domain Outbound Connections Are Set to Allow on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Domain Outbound Connections Are Set to Allow. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Domain Outbound Connections Are Set to Allow. Run gpupdate /force to apply.

This recommendation verifies that Domain Firewall Logging Size Is Set to 16384 KB or Greater on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Domain Firewall Logging Size Is Set to 16384 KB or Greater. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Domain Firewall Logging Size Is Set to 16384 KB or Greater. Run gpupdate /force to apply.

This recommendation verifies that Windows Firewall Private Profile Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Windows Firewall Private Profile Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Windows Firewall Private Profile Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Windows Firewall Public Profile Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Windows Firewall Public Profile Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Windows Firewall Public Profile Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Public Inbound Connections Are Set to Block on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Public Inbound Connections Are Set to Block. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Public Inbound Connections Are Set to Block. Run gpupdate /force to apply.

This recommendation verifies that Private and Public Firewall Logging Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Private and Public Firewall Logging Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Private and Public Firewall Logging Is Configured. Run gpupdate /force to apply.

This recommendation verifies that Audit Credential Validation Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Credential Validation Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Credential Validation Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Security Group Management Is Set to Success on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Security Group Management Is Set to Success. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Security Group Management Is Set to Success. Run gpupdate /force to apply.

This recommendation verifies that Audit User Account Management Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit User Account Management Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit User Account Management Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Computer Account Management Is Set to Success on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Computer Account Management Is Set to Success. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Computer Account Management Is Set to Success. Run gpupdate /force to apply.

This recommendation verifies that Audit Other Account Management Events Is Set to Success on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Other Account Management Events Is Set to Success. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Other Account Management Events Is Set to Success. Run gpupdate /force to apply.

This recommendation verifies that Audit Logon Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Logon Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Logon Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Account Lockout Is Set to Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Account Lockout Is Set to Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Account Lockout Is Set to Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Other Logon/Logoff Events Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Other Logon/Logoff Events Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Other Logon/Logoff Events Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Policy Change Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Policy Change Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Policy Change Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Audit Sensitive Privilege Use Is Set to Success and Failure on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Audit Sensitive Privilege Use Is Set to Success and Failure. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Audit Sensitive Privilege Use Is Set to Success and Failure. Run gpupdate /force to apply.

This recommendation verifies that Windows Defender Antivirus Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Windows Defender Antivirus Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Windows Defender Antivirus Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Real-Time Protection Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Real-Time Protection Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Real-Time Protection Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Behavior Monitoring Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Behavior Monitoring Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Behavior Monitoring Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Attack Surface Reduction Rules Are Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Attack Surface Reduction Rules Are Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Attack Surface Reduction Rules Are Configured. Run gpupdate /force to apply.

This recommendation verifies that Credential Guard Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Credential Guard Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Credential Guard Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Remote Desktop Services Encryption Level Is Set to High on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Remote Desktop Services Encryption Level Is Set to High. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Remote Desktop Services Encryption Level Is Set to High. Run gpupdate /force to apply.

This recommendation verifies that Remote Desktop Idle Timeout Is Configured on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Remote Desktop Idle Timeout Is Configured. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Remote Desktop Idle Timeout Is Configured. Run gpupdate /force to apply.

This recommendation verifies that WinRM Service Is Configured Securely on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that WinRM Service Is Configured Securely. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set WinRM Service Is Configured Securely. Run gpupdate /force to apply.

This recommendation verifies that PowerShell Script Block Logging Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that PowerShell Script Block Logging Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set PowerShell Script Block Logging Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that PowerShell Transcription Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that PowerShell Transcription Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set PowerShell Transcription Is Enabled. Run gpupdate /force to apply.

This recommendation verifies that Remote Desktop Session Host Is Hardened on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that Remote Desktop Session Host Is Hardened. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set Remote Desktop Session Host Is Hardened. Run gpupdate /force to apply.

This recommendation verifies that SMBv1 Protocol Is Disabled on the Windows Server 2016 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2016 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that SMBv1 Protocol Is Disabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set SMBv1 Protocol Is Disabled. Run gpupdate /force to apply.

This recommendation verifies that NetBIOS over TCP/IP Is Disabled on the Windows Server 2016 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2016 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that NetBIOS over TCP/IP Is Disabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set NetBIOS over TCP/IP Is Disabled. Run gpupdate /force to apply.

This recommendation verifies that LDAP Channel Binding Is Enabled on the Windows Server 2016 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2016 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that LDAP Channel Binding Is Enabled. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set LDAP Channel Binding Is Enabled. Run gpupdate /force to apply.

This recommendation ensures that LDAP Signing Is Required on the Windows Server 2016 server operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Windows Server 2016 server operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Open Group Policy Editor (gpedit.msc) or run gpresult /r and verify that LDAP Signing Is Required. Alternatively, check the registry setting or use secedit /export.

Configure via Group Policy: navigate to the appropriate policy path and set LDAP Signing Is Required. Run gpupdate /force to apply.