CIS Microsoft Windows Server 2022 Benchmark

This policy determines the number of unique new passwords that must be associated with a user account before an old password can be reused. Set to 24 to force users to create unique passwords.

An improperly configured value for 'Enforce password history' could weaken security controls or allow unintended behavior. Setting this to 24 or More ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

# PowerShell:
(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -ErrorAction SilentlyContinue)

# Or via Group Policy:
# Computer Configuration > Policies > Windows Settings > Security Settings >
# Account Policies > Password Policy > Enforce password history
# Verify: 24 or more passwords remembered

# Command line:
net accounts | findstr "Length"

Set via Group Policy: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy — Set Enforce password history to 24 or more passwords remembered.

Set the minimum password length to 14 characters or more to ensure passwords have sufficient entropy to resist brute-force and dictionary attacks.

An improperly configured value for 'Minimum password length' could weaken security controls or allow unintended behavior. Setting this to 14 or More ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

# PowerShell:
net accounts | findstr "Minimum password length"
# Should show 14 or higher

# Or via secedit:
secedit /export /cfg C:\secpol.cfg
findstr "MinimumPasswordLength" C:\secpol.cfg
# Should be 14 or greater

Group Policy: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy — Set Minimum password length to 14.

Enable password complexity requirements. Passwords must contain characters from three of five categories: uppercase, lowercase, digits, special characters, and Unicode characters.

An improperly configured value for 'Password must meet complexity requirements' could weaken security controls or allow unintended behavior. Setting this to Enabled ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

secedit /export /cfg C:\secpol.cfg
findstr "PasswordComplexity" C:\secpol.cfg
# Should be 1 (enabled)

Group Policy: Account Policies\Password Policy — Set Password must meet complexity requirements to Enabled.

Set the account lockout threshold to 5 or fewer invalid logon attempts. This mitigates brute-force password attacks while minimizing impact on legitimate users.

An improperly configured value for 'Account lockout threshold' could weaken security controls or allow unintended behavior. Setting this to 5 or Fewer ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

net accounts | findstr "Lockout threshold"
# Should be 5 or fewer (but NOT 0, which disables lockout)

Group Policy: Account Policies\Account Lockout Policy — Set Account lockout threshold to 5 invalid logon attempts.

Set the lockout duration to 15 minutes or more. This slows brute-force attacks by forcing attackers to wait between lockout cycles.

An improperly configured value for 'Account lockout duration' could weaken security controls or allow unintended behavior. Setting this to 15 or More Minutes ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

net accounts | findstr "Lockout duration"
# Should be 15 or greater

Group Policy: Account Policies\Account Lockout Policy — Set Account lockout duration to 15 minutes.

Audit both successful and failed credential validation events. This captures authentication attempts, enabling detection of brute-force attacks and credential misuse.

An improperly configured value for 'Audit Credential Validation' could weaken security controls or allow unintended behavior. Setting this to Success and Failure ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

auditpol /get /subcategory:"Credential Validation"
# Should show: Success and Failure

auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

Audit logon events to track all logon attempts to the system. This is essential for detecting unauthorized access and investigating security incidents.

An improperly configured value for 'Audit Logon' could weaken security controls or allow unintended behavior. Setting this to Success and Failure ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

auditpol /get /subcategory:"Logon"
# Should show: Success and Failure

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Audit security group management events to track group membership changes including additions, removals, and group creation/deletion.

An improperly configured value for 'Audit Security Group Management' could weaken security controls or allow unintended behavior. Setting this to Include Success ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

auditpol /get /subcategory:"Security Group Management"
# Should show: Success (at minimum)

auditpol /set /subcategory:"Security Group Management" /success:enable

Restrict the "Access this computer from the network" user right to only Administrators and Authenticated Users (for Member Servers) or Administrators, Authenticated Users, and Enterprise Domain Controllers (for DCs).

Unrestricted 'Access this computer from the network' could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Windows Server 2022 operating system is essential for defense in depth.

# PowerShell:
secedit /export /cfg C:\secpol.cfg
findstr "SeNetworkLogonRight" C:\secpol.cfg
# Should only include Administrators and Authenticated Users

Group Policy: Local Policies\User Rights Assignment — Set Access this computer from the network to Administrators, Authenticated Users.

Deny the Guest account and local Guests group the ability to log on via Remote Desktop Services. This prevents unauthorized remote access through the Guest account.

Failure to 'Deny log on through Remote Desktop Services' Includes Guests may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

secedit /export /cfg C:\secpol.cfg
findstr "SeDenyRemoteInteractiveLogonRight" C:\secpol.cfg
# Should include Guests

Group Policy: Local Policies\User Rights Assignment — Add Guests to Deny log on through Remote Desktop Services.

Disable the built-in Administrator account (RID 500). This account is a well-known target. Use a separate named admin account instead. Note: Does not apply to Domain Controllers.

An improperly configured value for 'Accounts: Administrator account status' could weaken security controls or allow unintended behavior. Setting this to Disabled ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

# PowerShell:
Get-LocalUser -Name "Administrator" | Select-Object Name, Enabled
# Enabled should be False

# Or:
net user Administrator | findstr "Account active"
# Should be "No"

# PowerShell:
Disable-LocalUser -Name "Administrator"

Ensure the Guest account is disabled. The Guest account allows unauthenticated network access and should remain disabled.

An improperly configured value for 'Accounts: Guest account status' could weaken security controls or allow unintended behavior. Setting this to Disabled ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

Get-LocalUser -Name "Guest" | Select-Object Name, Enabled
# Enabled should be False

Disable-LocalUser -Name "Guest"

Prevent anonymous enumeration of SAM (Security Account Manager) accounts. This prevents attackers from enumerating local user accounts without authentication.

Without 'Network access: Do not allow anonymous enumeration of SAM accounts' enabled, the Windows Server 2022 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# Registry:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RestrictAnonymousSAM
# Should be 1

# Group Policy path:
# Security Options > Network access: Do not allow anonymous enumeration of SAM accounts = Enabled

Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RestrictAnonymousSAM -Value 1

Set the maximum Application event log size to at least 32,768 KB (32 MB) to ensure sufficient log retention for forensic investigation.

Failure to 'Application' Log Maximum Size is 32,768 KB or Greater may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerShell:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application" -Name MaxSize
# Should be 33554432 (32768 KB in bytes) or greater

# Or:
wevtutil gl Application | findstr "maxSize"

wevtutil sl Application /ms:33554432

Set the maximum Security event log size to at least 196,608 KB (192 MB). The Security log is the most critical log for investigations and should retain events for an extended period.

Failure to 'Security' Log Maximum Size is 196,608 KB or Greater may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

wevtutil gl Security | findstr "maxSize"
# Should be 201326592 (196608 KB in bytes) or greater

wevtutil sl Security /ms:201326592

Set the maximum System event log size to at least 32,768 KB (32 MB) to retain system events for troubleshooting and investigation.

Failure to 'System' Log Maximum Size is 32,768 KB or Greater may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

wevtutil gl System | findstr "maxSize"
# Should be 33554432 or greater

wevtutil sl System /ms:33554432

Ensure Windows Defender Firewall is enabled for the Domain network profile. The firewall provides host-based filtering even when a network firewall is present (defense in depth).

Failure to windows Firewall: Domain Profile: Firewall State is On may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerShell:
Get-NetFirewallProfile -Name Domain | Select-Object Name, Enabled
# Enabled should be True

# Or:
netsh advfirewall show domainprofile state
# Should show: ON

Set-NetFirewallProfile -Name Domain -Enabled True

Set the default inbound action for the Domain profile to Block. Only explicitly allowed traffic should pass through the firewall.

Failure to windows Firewall: Domain Profile: Inbound Default is Block may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Domain | Select-Object DefaultInboundAction
# Should be "Block"

Set-NetFirewallProfile -Name Domain -DefaultInboundAction Block

Ensure Windows Defender Firewall is enabled for the Public network profile. The Public profile is the most restrictive and applies to untrusted networks.

Failure to windows Firewall: Public Profile: Firewall State is On may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Public | Select-Object Name, Enabled
# Enabled should be True

Set-NetFirewallProfile -Name Public -Enabled True

Enable logging of dropped packets for the Public firewall profile. This helps identify blocked connection attempts and potential attacks.

Failure to windows Firewall: Public Profile: Logging: Log Dropped Packets may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-NetFirewallProfile -Name Public | Select-Object LogBlocked
# Should be True

netsh advfirewall show publicprofile logging
# LogDroppedConnections should be: enable

Set-NetFirewallProfile -Name Public -LogBlocked True -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log"

Disable SMBv1 protocol on all systems. SMBv1 has critical vulnerabilities (EternalBlue/WannaCry) and lacks modern security features like encryption, signing, and dialect negotiation.

Leaving 'SMBv1 Protocol' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows Server 2022 operating system.

# PowerShell:
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
# Should be False

# Or check Windows Feature:
Get-WindowsFeature FS-SMB1
# InstallState should be "Available" (not Installed)

# Disable SMB1 server:
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Remove SMB1 feature:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

Require SMB packet signing to prevent man-in-the-middle attacks on SMB communications. Both server and client SMB signing should be required.

Failure to 'SMB Signing' is Required may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Server signing:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -Name RequireSecuritySignature
# Should be 1

# Client signing:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name RequireSecuritySignature
# Should be 1

Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -Name RequireSecuritySignature -Value 1
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name RequireSecuritySignature -Value 1

Require TLS/SSL as the security layer for Remote Desktop connections instead of the weaker RDP Security Layer (which uses the native RDP encryption).

An improperly configured value for 'Require use of specific security layer for RDP' could weaken security controls or allow unintended behavior. Setting this to SSL ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name SecurityLayer
# Should be 2 (SSL/TLS)

Group Policy: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security — Set Require use of specific security layer to SSL.

Set the RDP encryption level to High to ensure all data sent between client and server is encrypted with strong 128-bit encryption.

An improperly configured value for 'Set client connection encryption level' could weaken security controls or allow unintended behavior. Setting this to High ensures the Windows Server 2022 operating system operates within a well-defined security boundary.

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name MinEncryptionLevel
# Should be 3 (High Level)

Group Policy: Remote Desktop Session Host\Security — Set Set client connection encryption level to High Level.

Enable Network Level Authentication (NLA) for RDP to require authentication before a full session is established. NLA protects against pre-authentication DoS attacks and credential theft.

Without 'Require Network Level Authentication' for RDP enabled, the Windows Server 2022 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name UserAuthentication
# Should be 1 (Enabled)

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name UserAuthentication -Value 1

Disable the Print Spooler service on servers that do not perform print services. The Print Spooler has been the target of multiple critical vulnerabilities (PrintNightmare - CVE-2021-34527).

Failure to 'Print Spooler' Service is Disabled on Non-Print Servers may leave the Windows Server 2022 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-Service -Name Spooler | Select-Object Status, StartType
# Status should be Stopped, StartType should be Disabled

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

If WinRM is required, ensure it uses HTTPS (port 5986) instead of HTTP (port 5985) and restrict access to authorized IP ranges. If not needed, disable the WinRM service.

Misconfiguration of 'Windows Remote Management (WinRM)' can lead to security gaps that may be exploited by attackers. A properly configured Windows Server 2022 operating system reduces exposure to both known vulnerabilities and configuration drift.

# Check WinRM configuration:
winrm get winrm/config/service
# Verify: AllowUnencrypted = false

# Check listeners:
winrm enumerate winrm/config/listener
# Should show HTTPS listener (port 5986) if WinRM is enabled

Configure WinRM to use HTTPS only with a valid certificate, or disable the service if not required.

Disable the Remote Registry service to prevent remote modification of the Windows registry. Remote registry access could allow attackers to change critical system settings.

Leaving 'Remote Registry' Service enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Windows Server 2022 operating system.

Get-Service -Name RemoteRegistry | Select-Object Status, StartType
# Status should be Stopped, StartType should be Disabled

Stop-Service -Name RemoteRegistry -Force
Set-Service -Name RemoteRegistry -StartupType Disabled