CIS Windows Server 2019 Benchmark

This recommendation verifies that Minimum Password Length Is Set to 14 or More on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Minimum Password Length Is Set to 14 or More:

audit_check_more

Apply the following configuration to ensure Minimum Password Length Is Set to 14 or More:

remediate_more

This recommendation verifies that Password History Is Set to 24 or More on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password History Is Set to 24 or More:

audit_check_more

Apply the following configuration to ensure Password History Is Set to 24 or More:

remediate_more

This recommendation verifies that Maximum Password Age Is Set to 365 or Fewer Days on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Maximum Password Age Is Set to 365 or Fewer Days:

audit_check_days

Apply the following configuration to ensure Maximum Password Age Is Set to 365 or Fewer Days:

remediate_days

This recommendation verifies that Minimum Password Age Is Set to 1 or More Days on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Minimum Password Age Is Set to 1 or More Days:

audit_check_days

Apply the following configuration to ensure Minimum Password Age Is Set to 1 or More Days:

remediate_days

This recommendation verifies that Password Must Meet Complexity Requirements Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Must Meet Complexity Requirements Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Password Must Meet Complexity Requirements Is Enabled:

remediate_enabled

This recommendation verifies that Store Passwords Using Reversible Encryption Is Disabled on the Windows Server 2019 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2019 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Store Passwords Using Reversible Encryption Is Disabled:

audit_check_disabled

Apply the following configuration to ensure Store Passwords Using Reversible Encryption Is Disabled:

remediate_disabled

This recommendation verifies that Account Lockout Duration Is Set to 15 or More Minutes on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Account Lockout Duration Is Set to 15 or More Minutes:

audit_check_minutes

Apply the following configuration to ensure Account Lockout Duration Is Set to 15 or More Minutes:

remediate_minutes

This recommendation verifies that Account Lockout Threshold Is Set to 5 or Fewer Attempts on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Account Lockout Threshold Is Set to 5 or Fewer Attempts:

audit_check_attempts

Apply the following configuration to ensure Account Lockout Threshold Is Set to 5 or Fewer Attempts:

remediate_attempts

This recommendation verifies that Reset Account Lockout Counter Is Set to 15 or More Minutes on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Reset Account Lockout Counter Is Set to 15 or More Minutes:

audit_check_minutes

Apply the following configuration to ensure Reset Account Lockout Counter Is Set to 15 or More Minutes:

remediate_minutes

This recommendation verifies that Access This Computer from the Network Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Access This Computer from the Network Is Configured:

audit_check_configured

Apply the following configuration to ensure Access This Computer from the Network Is Configured:

remediate_configured

This recommendation verifies that Act as Part of the Operating System Is Set to No One on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Act as Part of the Operating System Is Set to No One:

audit_check_one

Apply the following configuration to ensure Act as Part of the Operating System Is Set to No One:

remediate_one

This recommendation verifies that Allow Log On Locally Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Allow Log On Locally Is Configured:

audit_check_configured

Apply the following configuration to ensure Allow Log On Locally Is Configured:

remediate_configured

This recommendation verifies that Debug Programs Is Set to Administrators on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Debug Programs Is Set to Administrators:

audit_check_administrators

Apply the following configuration to ensure Debug Programs Is Set to Administrators:

remediate_administrators

This recommendation verifies that Deny Access to This Computer from the Network Includes Guests on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Deny Access to This Computer from the Network Includes Guests:

audit_check_guests

Apply the following configuration to ensure Deny Access to This Computer from the Network Includes Guests:

remediate_guests

This recommendation verifies that Deny Log On Through Remote Desktop Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Deny Log On Through Remote Desktop Is Configured:

audit_check_configured

Apply the following configuration to ensure Deny Log On Through Remote Desktop Is Configured:

remediate_configured

This recommendation verifies that Accounts: Rename Administrator Account Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Accounts: Rename Administrator Account Is Configured:

audit_check_configured

Apply the following configuration to ensure Accounts: Rename Administrator Account Is Configured:

remediate_configured

This recommendation verifies that Accounts: Rename Guest Account Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Accounts: Rename Guest Account Is Configured:

audit_check_configured

Apply the following configuration to ensure Accounts: Rename Guest Account Is Configured:

remediate_configured

This recommendation verifies that Interactive Logon: Do Not Display Last Username Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Interactive Logon: Do Not Display Last Username Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Interactive Logon: Do Not Display Last Username Is Enabled:

remediate_enabled

This recommendation verifies that Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds:

audit_check_seconds

Apply the following configuration to ensure Interactive Logon: Machine Inactivity Limit Is Set to 900 or Fewer Seconds:

remediate_seconds

This recommendation verifies that Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts Is Enabled:

remediate_enabled

This recommendation verifies that Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only:

audit_check_only

Apply the following configuration to ensure Network Security: LAN Manager Authentication Level Is Set to NTLMv2 Only:

remediate_only

This recommendation verifies that User Account Control: Admin Approval Mode Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that User Account Control: Admin Approval Mode Is Enabled:

audit_check_enabled

Apply the following configuration to ensure User Account Control: Admin Approval Mode Is Enabled:

remediate_enabled

This recommendation verifies that Windows Firewall Domain Profile Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Firewall Domain Profile Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Windows Firewall Domain Profile Is Enabled:

remediate_enabled

This recommendation verifies that Domain Inbound Connections Are Set to Block on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Domain Inbound Connections Are Set to Block:

audit_check_block

Apply the following configuration to ensure Domain Inbound Connections Are Set to Block:

remediate_block

This recommendation verifies that Domain Outbound Connections Are Set to Allow on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Domain Outbound Connections Are Set to Allow:

audit_check_allow

Apply the following configuration to ensure Domain Outbound Connections Are Set to Allow:

remediate_allow

This recommendation verifies that Domain Firewall Logging Size Is Set to 16384 KB or Greater on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Domain Firewall Logging Size Is Set to 16384 KB or Greater:

audit_check_greater

Apply the following configuration to ensure Domain Firewall Logging Size Is Set to 16384 KB or Greater:

remediate_greater

This recommendation verifies that Domain Firewall Logging of Dropped Packets Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Domain Firewall Logging of Dropped Packets Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Domain Firewall Logging of Dropped Packets Is Enabled:

remediate_enabled

This recommendation verifies that Windows Firewall Private Profile Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Firewall Private Profile Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Windows Firewall Private Profile Is Enabled:

remediate_enabled

This recommendation verifies that Windows Firewall Public Profile Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Firewall Public Profile Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Windows Firewall Public Profile Is Enabled:

remediate_enabled

This recommendation verifies that Public Inbound Connections Are Set to Block on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Public Inbound Connections Are Set to Block:

audit_check_block

Apply the following configuration to ensure Public Inbound Connections Are Set to Block:

remediate_block

This recommendation verifies that Private and Public Firewall Logging Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Private and Public Firewall Logging Is Configured:

audit_check_configured

Apply the following configuration to ensure Private and Public Firewall Logging Is Configured:

remediate_configured

This recommendation verifies that Public Firewall Logging of Successful Connections Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Public Firewall Logging of Successful Connections Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Public Firewall Logging of Successful Connections Is Enabled:

remediate_enabled

This recommendation verifies that Audit Credential Validation Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Credential Validation Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit Credential Validation Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit Security Group Management Is Set to Success on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Security Group Management Is Set to Success:

audit_check_success

Apply the following configuration to ensure Audit Security Group Management Is Set to Success:

remediate_success

This recommendation verifies that Audit User Account Management Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit User Account Management Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit User Account Management Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit Computer Account Management Is Set to Success on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Computer Account Management Is Set to Success:

audit_check_success

Apply the following configuration to ensure Audit Computer Account Management Is Set to Success:

remediate_success

This recommendation verifies that Audit Logon Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Logon Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit Logon Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit Account Lockout Is Set to Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Account Lockout Is Set to Failure:

audit_check_failure

Apply the following configuration to ensure Audit Account Lockout Is Set to Failure:

remediate_failure

This recommendation verifies that Audit Other Logon/Logoff Events Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Other Logon/Logoff Events Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit Other Logon/Logoff Events Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit Policy Change Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Policy Change Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit Policy Change Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit Sensitive Privilege Use Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Sensitive Privilege Use Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit Sensitive Privilege Use Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Audit System Integrity Is Set to Success and Failure on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit System Integrity Is Set to Success and Failure:

audit_check_failure

Apply the following configuration to ensure Audit System Integrity Is Set to Success and Failure:

remediate_failure

This recommendation verifies that Windows Defender Antivirus Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Defender Antivirus Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Windows Defender Antivirus Is Enabled:

remediate_enabled

This recommendation verifies that Real-Time Protection Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Real-Time Protection Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Real-Time Protection Is Enabled:

remediate_enabled

This recommendation verifies that Behavior Monitoring Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Behavior Monitoring Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Behavior Monitoring Is Enabled:

remediate_enabled

This recommendation verifies that Attack Surface Reduction Rules Are Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Attack Surface Reduction Rules Are Configured:

audit_check_configured

Apply the following configuration to ensure Attack Surface Reduction Rules Are Configured:

remediate_configured

This recommendation verifies that Controlled Folder Access Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Controlled Folder Access Is Configured:

audit_check_configured

Apply the following configuration to ensure Controlled Folder Access Is Configured:

remediate_configured

This recommendation verifies that Credential Guard Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Credential Guard Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Credential Guard Is Enabled:

remediate_enabled

This recommendation verifies that Secure Boot Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Secure Boot Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Secure Boot Is Enabled:

remediate_enabled

This recommendation verifies that Windows Defender Application Control Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Defender Application Control Is Configured:

audit_check_configured

Apply the following configuration to ensure Windows Defender Application Control Is Configured:

remediate_configured

This recommendation verifies that Remote Desktop Services Encryption Level Is Set to High on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Remote Desktop Services Encryption Level Is Set to High:

audit_check_high

Apply the following configuration to ensure Remote Desktop Services Encryption Level Is Set to High:

remediate_high

This recommendation verifies that Windows Remote Management WinRM Service Is Configured on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Windows Remote Management WinRM Service Is Configured:

audit_check_configured

Apply the following configuration to ensure Windows Remote Management WinRM Service Is Configured:

remediate_configured

This recommendation verifies that Remote Desktop Session Host Is Hardened on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Remote Desktop Session Host Is Hardened:

audit_check_hardened

Apply the following configuration to ensure Remote Desktop Session Host Is Hardened:

remediate_hardened

This recommendation verifies that PowerShell Script Block Logging Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that PowerShell Script Block Logging Is Enabled:

audit_check_enabled

Apply the following configuration to ensure PowerShell Script Block Logging Is Enabled:

remediate_enabled

This recommendation verifies that PowerShell Transcription Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that PowerShell Transcription Is Enabled:

audit_check_enabled

Apply the following configuration to ensure PowerShell Transcription Is Enabled:

remediate_enabled

This recommendation verifies that SMBv1 Protocol Is Disabled on the Windows Server 2019 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2019 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SMBv1 Protocol Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SMBv1 Protocol Is Disabled:

remediate_disabled

This recommendation verifies that NetBIOS over TCP/IP Is Disabled on the Windows Server 2019 server operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Windows Server 2019 server operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NetBIOS over TCP/IP Is Disabled:

audit_check_disabled

Apply the following configuration to ensure NetBIOS over TCP/IP Is Disabled:

remediate_disabled

This recommendation verifies that LDAP Channel Binding Is Enabled on the Windows Server 2019 server operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Windows Server 2019 server operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that LDAP Channel Binding Is Enabled:

audit_check_enabled

Apply the following configuration to ensure LDAP Channel Binding Is Enabled:

remediate_enabled

This recommendation ensures that LDAP Signing Is Required on the Windows Server 2019 server operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Windows Server 2019 server operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Run the following command and verify that LDAP Signing Is Required:

audit_check_required

Apply the following configuration to ensure LDAP Signing Is Required:

remediate_required