Coverage - DISA, Windows

For the profile names to use and how coverage is organized, see the Compliance Coverage overview.

Current revisions

Operating System	Source Benchmark version
Windows 11	V2 R3
Windows 2016	V2 R6
Windows 2019	V3 R1
Windows 2022	V2 R1

Windows Coverage Report for DISA STIG

The following report details the status of each STIG Rule in the Sicura compliance data.

• Mapped controls have enforcement and reporting support.
• Unmapped controls are not supported at this time. A reason for the lack of support is provided for each unmapped control.
• Paper policy controls refer to organizational policy requirements and cannot be reasonably enforced by Sicura at this time.

Summary

OS	Unmapped Controls	Paper Policy	Mapped	Total
Windows 11	9 (4%)		201 (95%)	210
Windows 2016	12 (5%)		189 (94%)	201
Windows 2019	12 (5%)		191 (94%)	203
Windows 2022	12 (5%)		192 (94%)	204

---

Detail

Unmapped Controls

The following controls are not mapped:

Windows 11 (9/210 [4%])

Control	Title	Notes
V-253254	Domain-joined systems must use Windows 11 Enterprise Edition 64-bit version.	The product cannot control which architecture is being used.
V-253259	Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.	The product cannot enable BitLocker without a compatible TPM or user-specified password.
V-253263	Windows 11 systems must be maintained at a supported servicing level.	The product will not automatically update windows versions, this could have far-reaching consequences for customers.
V-253265	Local volumes must be formatted using NTFS.	The product will not automatically format customer's drives, this could cause massive data loss.
V-253427	The DoD Root CA certificates must be installed in the Trusted Root Store.	Requires a module to manage the Windows certificate store.
V-253428	The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-253429	The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-253430	The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-253470	Windows 11 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.	The way in which multifactor authentication will be set up will vary between different organizations, the product cannot infer how this will be done.

Windows 2016 (12/201 [5%])

Control	Title	Notes
V-224828	Systems must be maintained at a supported servicing level.	The product will not automatically apply updates to existing systems to avoid potential issues from updating without testing.
V-224831	Local volumes must use a format that supports NTFS attributes.	The product will not automatically reformat disks.
V-224965	Kerberos user logon restrictions must be enforced.	Requires a module to manage Group Policy.
V-224966	The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.	Requires a module to manage Group Policy.
V-224967	The Kerberos user ticket lifetime must be limited to 10 hours or less.	Requires a module to manage Group Policy.
V-224968	The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.	Requires a module to manage Group Policy.
V-224969	The computer clock synchronization tolerance must be limited to 5 minutes or less.	Requires a module to manage Group Policy.
V-224970	Permissions on the Active Directory data files must only allow System and Administrators access.	Discussing the best approach to enforcement.
V-225021	The DoD Root CA certificates must be installed in the Trusted Root Store.	Requires a module to manage the Windows certificate store.
V-225022	The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-225023	The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-225059	Windows Server 2016 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.	Lower priority: this is not a requirement for most customers.

Windows 2019 (12/203 [5%])

Control	Title	Notes
V-205648	Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in the Trusted Root Store.	Requires a module to manage the Windows certificate store.
V-205649	Windows Server 2019 must have the DoD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-205650	Windows Server 2019 must have the US DoD CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-205663	Windows Server 2019 local volumes must use a format that supports NTFS attributes.	The product will not automatically reformat disks.
V-205702	Windows Server 2019 Kerberos user logon restrictions must be enforced.	Requires a module to manage Group Policy.
V-205703	Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.	Requires a module to manage Group Policy.
V-205704	Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.	Requires a module to manage Group Policy.
V-205705	Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.	Requires a module to manage Group Policy.
V-205706	Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.	Requires a module to manage Group Policy.
V-205739	Windows Server 2019 permissions on the Active Directory data files must only allow System and Administrators access.	Discussing the best approach to enforcement.
V-205842	Windows Server 2019 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.	Lower priority: this is not a requirement for most customers.
V-205849	Windows Server 2019 must be maintained at a supported servicing level.	The product will not automatically apply updates to existing systems to avoid potential issues from updating without testing.

Windows 2022 (12/204 [5%])

Control	Title	Notes
V-254247	Windows Server 2022 must be maintained at a supported servicing level.	The product will not automatically apply updates to existing systems to avoid potential issues from updating without testing.
V-254250	Windows Server 2022 local volumes must use a format that supports NTFS attributes.	The product will not automatically reformat disks.
V-254386	Windows Server 2022 Kerberos user logon restrictions must be enforced.	Requires a module to manage Group Policy.
V-254387	Windows Server 2022 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.	Requires a module to manage Group Policy.
V-254388	Windows Server 2022 Kerberos user ticket lifetime must be limited to 10 hours or less.	Requires a module to manage Group Policy.
V-254389	Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.	Requires a module to manage Group Policy.
V-254390	Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.	Requires a module to manage Group Policy.
V-254391	Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.	Discussing the best approach to enforcement.
V-254442	Windows Server 2022 must have the DoD Root Certificate Authority (CA) certificates installed in the Trusted Root Store.	Requires a module to manage the Windows certificate store.
V-254443	Windows Server 2022 must have the DoD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-254444	Windows Server 2022 must have the US DoD CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.	Requires a module to manage the Windows certificate store.
V-254480	Windows Server 2022 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.	Lower priority: this is not a requirement for most customers.

---

Mapped

The following controls are mapped:

Windows 11 (201/210 [95%])

Control	Title	Notes
V-253260	Windows 11 systems must use a BitLocker PIN for pre-boot authentication.
V-253261	Windows 11 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.
V-253275	Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
V-253277	Simple TCP/IP Services must not be installed on the system.
V-253278	The Telnet Client must not be installed on the system.
V-253279	The TFTP Client must not be installed on the system.
V-253283	Data Execution Prevention (DEP) must be configured to at least OptOut.	For the changes made from this rule to take effect, a reboot is required.
V-253284	Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
V-253285	The Windows PowerShell 2.0 feature must be disabled on the system.
V-253286	The Server Message Block (SMB) v1 protocol must be disabled on the system.
V-253287	The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
V-253288	The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
V-253289	The Secondary Logon service must be disabled on Windows 11.
V-253297	Windows 11 account lockout duration must be configured to 15 minutes or greater.
V-253298	The number of allowed bad logon attempts must be configured to three or less.
V-253299	The period of time before the bad logon counter is reset must be configured to 15 minutes.
V-253300	The password history must be configured to 24 passwords remembered.
V-253301	The maximum password age must be configured to 60 days or less.
V-253302	The minimum password age must be configured to at least 1 day.
V-253303	Passwords must, at a minimum, be 14 characters.
V-253304	The built-in Microsoft password complexity filter must be enabled.
V-253305	Reversible password encryption must be disabled.
V-253306	The system must be configured to audit Account Logon - Credential Validation failures.
V-253307	The system must be configured to audit Account Logon - Credential Validation successes.
V-253308	The system must be configured to audit Account Management - Security Group Management successes.
V-253309	The system must be configured to audit Account Management - User Account Management failures.
V-253310	The system must be configured to audit Account Management - User Account Management successes.
V-253312	The system must be configured to audit Detailed Tracking - Process Creation successes.
V-253313	The system must be configured to audit Logon/Logoff - Account Lockout failures.
V-253315	The system must be configured to audit Logon/Logoff - Logoff successes.
V-253316	The system must be configured to audit Logon/Logoff - Logon failures.
V-253317	The system must be configured to audit Logon/Logoff - Logon successes.
V-253318	The system must be configured to audit Logon/Logoff - Special Logon successes.
V-253319	Windows 11 must be configured to audit Object Access - File Share failures.
V-253320	Windows 11 must be configured to audit Object Access - File Share successes.
V-253321	Windows 11 must be configured to audit Object Access - Other Object Access Events successes.
V-253322	Windows 11 must be configured to audit Object Access - Other Object Access Events failures.
V-253325	The system must be configured to audit Policy Change - Audit Policy Change successes.
V-253326	The system must be configured to audit Policy Change - Authentication Policy Change successes.
V-253327	The system must be configured to audit Policy Change - Authorization Policy Change successes.
V-253328	The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
V-253329	The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
V-253330	The system must be configured to audit System - IPsec Driver failures.
V-253331	The system must be configured to audit System - Other System Events successes.
V-253332	The system must be configured to audit System - Other System Events failures.
V-253333	The system must be configured to audit System - Security State Change successes.
V-253334	The system must be configured to audit System - Security System Extension successes.
V-253335	The system must be configured to audit System - System Integrity failures.
V-253336	The system must be configured to audit System - System Integrity successes.
V-253337	The Application event log size must be configured to 32768 KB or greater.
V-253338	The Security event log size must be configured to 1024000 KB or greater.
V-253339	The System event log size must be configured to 32768 KB or greater.
V-253340	Windows 11 permissions for the Application event log must prevent access by non-privileged accounts.
V-253341	Windows 11 permissions for the Security event log must prevent access by non-privileged accounts.
V-253342	Windows 11 permissions for the System event log must prevent access by non-privileged accounts.
V-253343	Windows 11 must be configured to audit Other Policy Change Events Successes.
V-253344	Windows 11 must be configured to audit Other Policy Change Events Failures.
V-253345	Windows 11 must be configured to audit other Logon/Logoff Events Successes.
V-253346	Windows 11 must be configured to audit other Logon/Logoff Events Failures.
V-253347	Windows 11 must be configured to audit Detailed File Share Failures.
V-253348	Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Successes.
V-253349	Windows 11 must be configured to audit MPSSVC Rule-Level Policy Change Failures.
V-253352	The display of slide shows on the lock screen must be disabled.
V-253353	IPv6 source routing must be configured to highest protection.
V-253354	The system must be configured to prevent IP source routing.
V-253355	The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
V-253356	The system must be configured to ignore NetBIOS name release requests except from WINS servers.
V-253357	Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
V-253358	WDigest Authentication must be disabled.
V-253359	Run as different user must be removed from context menus.
V-253360	Insecure logons to an SMB server must be disabled.
V-253361	Internet connection sharing must be disabled.
V-253362	Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.
V-253364	Simultaneous connections to the internet or a Windows domain must be limited.
V-253365	Connections to non-domain networks when connected to a domain authenticated network must be blocked.
V-253366	Wi-Fi Sense must be disabled.
V-253367	Command line data must be included in process creation events.
V-253368	Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials.
V-253372	Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.
V-253373	Group Policy objects must be reprocessed even if they have not changed.
V-253374	Downloading print driver packages over HTTP must be prevented.
V-253375	Web publishing and online ordering wizards must be prevented from downloading a list of providers.
V-253376	Printing over HTTP must be prevented.
V-253377	Systems must at least attempt device authentication using certificates.
V-253378	The network selection user interface (UI) must not be displayed on the logon screen.
V-253379	Local users on domain-joined computers must not be enumerated.
V-253380	Users must be prompted for a password on resume from sleep (on battery).
V-253381	The user must be prompted for a password on resume from sleep (plugged in).
V-253382	Solicited Remote Assistance must not be allowed.
V-253383	Unauthenticated RPC clients must be restricted from connecting to the RPC server.
V-253384	The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.
V-253385	The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
V-253386	Autoplay must be turned off for non-volume devices.
V-253387	The default autorun behavior must be configured to prevent autorun commands.
V-253388	Autoplay must be disabled for all drives.
V-253389	Enhanced anti-spoofing for facial recognition must be enabled on Windows 11.
V-253390	Microsoft consumer experiences must be turned off.
V-253391	Administrator accounts must not be enumerated during elevation.
V-253393	Windows Telemetry must not be configured to Full.
V-253394	Windows Update must not obtain updates from other PCs on the internet.
V-253395	The Microsoft Defender SmartScreen for Explorer must be enabled.
V-253396	Explorer Data Execution Prevention must be enabled.
V-253397	File Explorer heap termination on corruption must be disabled.
V-253398	File Explorer shell protocol must run in protected mode.
V-253399	Windows 11 must be configured to disable Windows Game Recording and Broadcasting.
V-253400	The use of a hardware security device with Windows Hello for Business must be enabled.
V-253401	Windows 11 must be configured to require a minimum pin length of six characters or greater.
V-253402	Passwords must not be saved in the Remote Desktop Client.
V-253403	Local drives must be prevented from sharing with Remote Desktop Session Hosts.
V-253404	Remote Desktop Services must always prompt a client for passwords upon connection.
V-253405	The Remote Desktop Session Host must require secure RPC communications.
V-253406	Remote Desktop Services must be configured with the client connection encryption set to the required level.
V-253407	Attachments must be prevented from being downloaded from RSS feeds.
V-253408	Basic authentication for RSS feeds over HTTP must not be used.
V-253409	Indexing of encrypted files must be turned off.
V-253410	Users must be prevented from changing installation options.
V-253411	The Windows Installer feature "Always install with elevated privileges" must be disabled.
V-253412	Users must be notified if a web-based program attempts to install software.
V-253413	Automatically signing in the last interactive user after a system-initiated restart must be disabled.
V-253414	PowerShell script block logging must be enabled on Windows 11.
V-253415	PowerShell Transcription must be enabled on Windows 11.
V-253416	The Windows Remote Management (WinRM) client must not use Basic authentication.
V-253417	The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
V-253418	The Windows Remote Management (WinRM) service must not use Basic authentication.
V-253419	The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
V-253420	The Windows Remote Management (WinRM) service must not store RunAs credentials.
V-253421	The Windows Remote Management (WinRM) client must not use Digest authentication.
V-253422	Windows 11 must be configured to prevent Windows apps from being activated by voice while the system is locked.
V-253423	The convenience PIN for Windows 11 must be disabled.
V-253424	Windows Ink Workspace must be configured to disallow access above the lock.
V-253426	Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled.
V-253432	The built-in administrator account must be disabled.
V-253433	The built-in guest account must be disabled.
V-253434	Local accounts with blank passwords must be restricted to prevent access from the network.
V-253435	The built-in administrator account must be renamed.
V-253436	The built-in guest account must be renamed.
V-253437	Audit policy using subcategories must be enabled.
V-253438	Outgoing secure channel traffic must be encrypted or signed.
V-253439	Outgoing secure channel traffic must be encrypted.
V-253440	Outgoing secure channel traffic must be signed.
V-253441	The computer account password must not be prevented from being reset.
V-253442	The maximum age for machine account passwords must be configured to 30 days or less.
V-253443	The system must be configured to require a strong session key.
V-253444	The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
V-253447	Caching of logon credentials must be limited.
V-253448	The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
V-253449	The Windows SMB client must be configured to always perform SMB packet signing.
V-253450	Unencrypted passwords must not be sent to third-party SMB Servers.
V-253451	The Windows SMB server must be configured to always perform SMB packet signing.
V-253453	Anonymous enumeration of SAM accounts must not be allowed.
V-253454	Anonymous enumeration of shares must be restricted.
V-253455	The system must be configured to prevent anonymous users from having the same rights as the Everyone group.
V-253456	Anonymous access to Named Pipes and Shares must be restricted.
V-253457	Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
V-253458	NTLM must be prevented from falling back to a Null session.
V-253459	PKU2U authentication using online identities must be prevented.
V-253460	Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
V-253461	The system must be configured to prevent the storage of the LAN Manager hash of passwords.
V-253462	The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
V-253463	The system must be configured to the required LDAP client signing level.
V-253464	The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.
V-253465	The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.
V-253466	The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
V-253467	The default permissions of global system objects must be increased.
V-253468	User Account Control approval mode for the built-in Administrator must be enabled.
V-253469	User Account Control must prompt administrators for consent on the secure desktop.
V-253471	User Account Control must automatically deny elevation requests for standard users.
V-253472	User Account Control must be configured to detect application installations and prompt for elevation.
V-253473	User Account Control must only elevate UIAccess applications that are installed in secure locations.
V-253474	User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
V-253475	User Account Control must virtualize file and registry write failures to per-user locations.
V-253479	The "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts.
V-253480	The "Access this computer from the network" user right must only be assigned to the Administrators and Remote Desktop Users groups.
V-253481	The "Act as part of the operating system" user right must not be assigned to any groups or accounts.
V-253482	The "Allow log on locally" user right must only be assigned to the Administrators and Users groups.
V-253483	The "Back up files and directories" user right must only be assigned to the Administrators group.
V-253484	The "Change the system time" user right must only be assigned to Administrators and Local Service.
V-253485	The "Create a pagefile" user right must only be assigned to the Administrators group.
V-253486	The "Create a token object" user right must not be assigned to any groups or accounts.
V-253487	The "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-253488	The "Create permanent shared objects" user right must not be assigned to any groups or accounts.
V-253489	The "Create symbolic links" user right must only be assigned to the Administrators group.
V-253490	The "Debug programs" user right must only be assigned to the Administrators group.
V-253491	The "Deny access to this computer from the network" user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
V-253492	The "Deny log on as a batch job" user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
V-253493	The "Deny log on as a service" user right on Windows 11 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
V-253494	The "Deny log on locally" user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.
V-253495	The "Deny log on through Remote Desktop Services" user right on Windows 11 workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.
V-253496	The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts.
V-253497	The "Force shutdown from a remote system" user right must only be assigned to the Administrators group.
V-253498	The "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-253499	The "Load and unload device drivers" user right must only be assigned to the Administrators group.
V-253500	The "Lock pages in memory" user right must not be assigned to any groups or accounts.
V-253501	The "Manage auditing and security log" user right must only be assigned to the Administrators group.
V-253502	The "Modify firmware environment values" user right must only be assigned to the Administrators group.
V-253503	The "Perform volume maintenance tasks" user right must only be assigned to the Administrators group.
V-253504	The "Profile single process" user right must only be assigned to the Administrators group.
V-253505	The "Restore files and directories" user right must only be assigned to the Administrators group.
V-253506	The "Take ownership of files or other objects" user right must only be assigned to the Administrators group.
V-256893	Internet Explorer must be disabled for Windows 11.
V-257770	Windows 11 must have command line process auditing events enabled for failures.

Windows 2016 (189/201 [94%])

Control	Title
V-224850	The Fax Server role must not be installed.
V-224851	The Microsoft FTP service must not be installed unless required.
V-224852	The Peer Name Resolution Protocol must not be installed.
V-224853	Simple TCP/IP Services must not be installed.
V-224854	The Telnet Client must not be installed.
V-224855	The TFTP Client must not be installed.
V-224856	The Server Message Block (SMB) v1 protocol must be uninstalled.
V-224857	The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
V-224858	The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
V-224859	Windows PowerShell 2.0 must not be installed.
V-224866	Windows 2016 account lockout duration must be configured to 15 minutes or greater.
V-224867	Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less.
V-224868	Windows Server 2016 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.
V-224869	Windows Server 2016 password history must be configured to 24 passwords remembered.
V-224870	Windows Server 2016 maximum password age must be configured to 60 days or less.
V-224871	Windows Server 2016 minimum password age must be configured to at least one day.
V-224872	Windows Server 2016 minimum password length must be configured to 14 characters.
V-224873	Windows Server 2016 must have the built-in Windows password complexity policy enabled.
V-224874	Windows Server 2016 reversible password encryption must be disabled.
V-224877	Permissions for the Application event log must prevent access by non-privileged accounts.
V-224878	Permissions for the Security event log must prevent access by non-privileged accounts.
V-224879	Permissions for the System event log must prevent access by non-privileged accounts.
V-224880	Event Viewer must be protected from unauthorized modification and deletion.
V-224881	Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes.
V-224882	Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures.
V-224883	Windows Server 2016 must be configured to audit Account Management - Other Account Management Events successes.
V-224884	Windows Server 2016 must be configured to audit Account Management - Security Group Management successes.
V-224885	Windows Server 2016 must be configured to audit Account Management - User Account Management successes.
V-224886	Windows Server 2016 must be configured to audit Account Management - User Account Management failures.
V-224888	Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes.
V-224890	Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures.
V-224892	Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes.
V-224893	Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes.
V-224894	Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures.
V-224895	Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes.
V-224896	Windows 2016 must be configured to audit Object Access - Other Object Access Events successes.
V-224897	Windows 2016 must be configured to audit Object Access - Other Object Access Events failures.
V-224900	Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes.
V-224901	Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures.
V-224902	Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change successes.
V-224903	Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change successes.
V-224904	Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
V-224905	Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
V-224906	Windows Server 2016 must be configured to audit System - IPsec Driver successes.
V-224907	Windows Server 2016 must be configured to audit System - IPsec Driver failures.
V-224908	Windows Server 2016 must be configured to audit System - Other System Events successes.
V-224909	Windows Server 2016 must be configured to audit System - Other System Events failures.
V-224910	Windows Server 2016 must be configured to audit System - Security State Change successes.
V-224911	Windows Server 2016 must be configured to audit System - Security System Extension successes.
V-224912	Windows Server 2016 must be configured to audit System - System Integrity successes.
V-224913	Windows Server 2016 must be configured to audit System - System Integrity failures.
V-224914	The display of slide shows on the lock screen must be disabled.
V-224915	WDigest Authentication must be disabled on Windows Server 2016.
V-224916	Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.
V-224917	Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.
V-224918	Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.
V-224919	Windows Server 2016 must be configured to ignore NetBIOS name release requests except from WINS servers.
V-224920	Insecure logons to an SMB server must be disabled.
V-224921	Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.
V-224922	Command line data must be included in process creation events.
V-224924	Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.
V-224925	Group Policy objects must be reprocessed even if they have not changed.
V-224926	Downloading print driver packages over HTTP must be prevented.
V-224927	Printing over HTTP must be prevented.
V-224928	The network selection user interface (UI) must not be displayed on the logon screen.
V-224929	Users must be prompted to authenticate when the system wakes from sleep (on battery).
V-224930	Users must be prompted to authenticate when the system wakes from sleep (plugged in).
V-224931	The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
V-224932	AutoPlay must be turned off for non-volume devices.
V-224933	The default AutoRun behavior must be configured to prevent AutoRun commands.
V-224934	AutoPlay must be disabled for all drives.
V-224935	Administrator accounts must not be enumerated during elevation.
V-224936	Windows Telemetry must be configured to Security or Basic.
V-224937	The Application event log size must be configured to 32768 KB or greater.
V-224938	The Security event log size must be configured to 196608 KB or greater.
V-224939	The System event log size must be configured to 32768 KB or greater.
V-224940	Windows Server 2016 Windows SmartScreen must be enabled.
V-224941	Explorer Data Execution Prevention must be enabled.
V-224942	Turning off File Explorer heap termination on corruption must be disabled.
V-224943	File Explorer shell protocol must run in protected mode.
V-224944	Passwords must not be saved in the Remote Desktop Client.
V-224945	Local drives must be prevented from sharing with Remote Desktop Session Hosts.
V-224946	Remote Desktop Services must always prompt a client for passwords upon connection.
V-224947	The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications.
V-224948	Remote Desktop Services must be configured with the client connection encryption set to High Level.
V-224949	Attachments must be prevented from being downloaded from RSS feeds.
V-224951	Basic authentication for RSS feeds over HTTP must not be used.
V-224952	Indexing of encrypted files must be turned off.
V-224953	Users must be prevented from changing installation options.
V-224954	The Windows Installer Always install with elevated privileges option must be disabled.
V-224955	Users must be notified if a web-based program attempts to install software.
V-224956	Automatically signing in the last interactive user after a system-initiated restart must be disabled.
V-224957	PowerShell script block logging must be enabled.
V-224958	The Windows Remote Management (WinRM) client must not use Basic authentication.
V-224959	The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
V-224960	The Windows Remote Management (WinRM) client must not use Digest authentication.
V-224961	The Windows Remote Management (WinRM) service must not use Basic authentication.
V-224962	The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
V-224963	The Windows Remote Management (WinRM) service must not store RunAs credentials.
V-224987	Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes.
V-224988	Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures.
V-224989	Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes.
V-224995	Domain controllers must require LDAP access signing.
V-224996	Domain controllers must be configured to allow reset of machine account passwords.
V-224997	The Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and
Enterprise Domain Controllers groups on domain controllers.
Control	Title
:--	:--
V-224998	The Add workstations to domain user right must only be assigned to the Administrators group.
V-224999	The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.
V-225000	The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
V-225001	The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
V-225002	The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
V-225003	The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
V-225004	The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
V-225005	The Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
V-225008	Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
V-225009	Local users on domain-joined computers must not be enumerated.
V-225010	Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server.
V-225011	Caching of logon credentials must be limited.
V-225013	Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
V-225014	The "Access this computer from the network" user right must only be assigned to the Administrators and Authenticated Users groups on member servers.
V-225015	The "Deny access to this computer from the network" user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and from unauthenticated access on all systems.
V-225016	The "Deny log on as a batch job" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.
V-225017	The "Deny log on as a service" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.
V-225018	The "Deny log on locally" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.
V-225019	The "Deny log on through Remote Desktop Services" user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.
V-225020	The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on member servers.
V-225024	Windows Server 2016 built-in guest account must be disabled.
V-225025	Local accounts with blank passwords must be restricted to prevent access from the network.
V-225026	Windows Server 2016 built-in administrator account must be renamed.
V-225027	Windows Server 2016 built-in guest account must be renamed.
V-225028	Audit policy using subcategories must be enabled.
V-225029	The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
V-225030	The setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
V-225031	The setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
V-225032	The computer account password must not be prevented from being reset.
V-225033	The maximum age for machine account passwords must be configured to 30 days or less.
V-225034	Windows Server 2016 must be configured to require a strong session key.
V-225035	The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver.
V-225038	The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
V-225039	The setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
V-225040	The setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
V-225041	Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
V-225042	The setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
V-225043	The setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
V-225045	Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed.
V-225046	Anonymous enumeration of shares must not be allowed.
V-225047	Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
V-225048	Anonymous access to Named Pipes and Shares must be restricted.
V-225049	Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
V-225050	NTLM must be prevented from falling back to a Null session.
V-225051	PKU2U authentication using online identities must be prevented.
V-225052	Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
V-225053	Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords.
V-225054	The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM.
V-225055	Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing.
V-225056	Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
V-225057	Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
V-225058	Users must be required to enter a password to access private keys stored on the computer.
V-225060	The default permissions of global system objects must be strengthened.
V-225061	User Account Control approval mode for the built-in Administrator must be enabled.
V-225062	UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
V-225063	User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
V-225064	User Account Control must automatically deny standard user requests for elevation.
V-225065	User Account Control must be configured to detect application installations and prompt for elevation.
V-225066	User Account Control must only elevate UIAccess applications that are installed in secure locations.
V-225067	User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
V-225068	User Account Control must virtualize file and registry write failures to per-user locations.
V-225070	The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
V-225071	The Act as part of the operating system user right must not be assigned to any groups or accounts.
V-225072	The Allow log on locally user right must only be assigned to the Administrators group.
V-225073	The Back up files and directories user right must only be assigned to the Administrators group.
V-225074	The Create a pagefile user right must only be assigned to the Administrators group.
V-225076	The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-225077	The Create permanent shared objects user right must not be assigned to any groups or accounts.
V-225078	The Create symbolic links user right must only be assigned to the Administrators group.
V-225079	The Debug programs user right must only be assigned to the Administrators group.
V-225080	The Force shutdown from a remote system user right must only be assigned to the Administrators group.
V-225081	The Generate security audits user right must only be assigned to Local Service and Network Service.
V-225082	The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-225083	The Increase scheduling priority user right must only be assigned to the Administrators group.
V-225084	The Load and unload device drivers user right must only be assigned to the Administrators group.
V-225085	The Lock pages in memory user right must not be assigned to any groups or accounts.
V-225086	The Manage auditing and security log user right must only be assigned to the Administrators group.
V-225087	The Modify firmware environment values user right must only be assigned to the Administrators group.
V-225088	The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
V-225089	The Profile single process user right must only be assigned to the Administrators group.
V-225091	The Create a token object user right must not be assigned to any groups or accounts.
V-225092	The Restore files and directories user right must only be assigned to the Administrators group.
V-225093	The Take ownership of files or other objects user right must only be assigned to the Administrators group.
V-257502	Windows Server 2016 must have PowerShell Transcription enabled.

Windows 2019 (191/203 [94%])

Control	Title
V-205625	Windows Server 2019 must be configured to audit Account Management - Security Group Management successes.
V-205626	Windows Server 2019 must be configured to audit Account Management - User Account Management successes.
V-205627	Windows Server 2019 must be configured to audit Account Management - User Account Management failures.
V-205629	Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less.
V-205630	Windows Server 2019 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.
V-205633	Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
V-205634	Windows Server 2019 must be configured to audit logon successes.
V-205635	Windows Server 2019 must be configured to audit logon failures.
V-205636	Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
V-205637	Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level.
V-205638	Windows Server 2019 command line data must be included in process creation events.
V-205639	Windows Server 2019 PowerShell script block logging must be enabled.
V-205640	Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts.
V-205641	Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts.
V-205642	Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts.
V-205643	Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group.
V-205644	Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings.
V-205651	Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.
V-205652	Windows Server 2019 must have the built-in Windows password complexity policy enabled.
V-205653	Windows Server 2019 reversible password encryption must be disabled.
V-205654	Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords.
V-205655	Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
V-205656	Windows Server 2019 minimum password age must be configured to at least one day.
V-205659	Windows Server 2019 maximum password age must be configured to 60 days or less.
V-205660	Windows Server 2019 password history must be configured to 24 passwords remembered.
V-205662	Windows Server 2019 minimum password length must be configured to 14 characters.
V-205665	Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and
Enterprise Domain Controllers groups on domain controllers.
Control	Title
:--	:--
V-205666	Windows Server 2019 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.
V-205667	Windows Server 2019 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
V-205668	Windows Server 2019 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
V-205669	Windows Server 2019 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
V-205670	Windows Server 2019 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
V-205671	Windows Server 2019 "Access this computer from the network" user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and standalone or nondomain-joined systems.
V-205672	Windows Server 2019 "Deny access to this computer from the network" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.
V-205673	Windows Server 2019 "Deny log on as a batch job" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
V-205674	Windows Server 2019 "Deny log on as a service" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
V-205675	Windows Server 2019 "Deny log on locally" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
V-205676	Windows Server 2019 Allow log on locally user right must only be assigned to the Administrators group.
V-205678	Windows Server 2019 must not have the Fax Server role installed.
V-205679	Windows Server 2019 must not have the Peer Name Resolution Protocol installed.
V-205680	Windows Server 2019 must not have Simple TCP/IP Services installed.
V-205681	Windows Server 2019 must not have the TFTP Client installed.
V-205682	Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed.
V-205683	Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
V-205684	Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
V-205685	Windows Server 2019 must not have Windows PowerShell 2.0 installed.
V-205686	Windows Server 2019 must prevent the display of slide shows on the lock screen.
V-205687	Windows Server 2019 must have WDigest Authentication disabled.
V-205688	Windows Server 2019 downloading print driver packages over HTTP must be turned off.
V-205689	Windows Server 2019 printing over HTTP must be turned off.
V-205690	Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen.
V-205691	Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
V-205692	Windows Server 2019 Windows Defender SmartScreen must be enabled.
V-205693	Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP.
V-205694	Windows Server 2019 must prevent Indexing of encrypted files.
V-205696	Windows Server 2019 local users on domain-joined member servers must not be enumerated.
V-205697	Windows Server 2019 must not have the Microsoft FTP service installed unless required by the organization.
V-205698	Windows Server 2019 must not have the Telnet Client installed.
V-205708	Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
V-205709	Windows Server 2019 must have the built-in guest account disabled.
V-205711	Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.
V-205712	Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.
V-205713	Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.
V-205714	Windows Server 2019 administrator accounts must not be enumerated during elevation.
V-205715	Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.
V-205716	Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
V-205717	Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
V-205718	Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation.
V-205719	Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.
V-205720	Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.
V-205722	Windows Server 2019 Remote Desktop Services must prevent drive redirection.
V-205724	Windows Server 2019 must not allow anonymous enumeration of shares.
V-205725	Windows Server 2019 must restrict anonymous access to Named Pipes and Shares.
V-205730	Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures.
V-205731	Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.
V-205732	Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
V-205733	Windows Server 2019 "Deny log on through Remote Desktop Services" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
V-205744	Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
V-205745	Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
V-205747	Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems.
V-205748	Windows Server 2019 "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems.
V-205749	Windows Server 2019 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
V-205750	Windows Server 2019 Act as part of the operating system user right must not be assigned to any groups or accounts.
V-205751	Windows Server 2019 Back up files and directories user right must only be assigned to the Administrators group.
V-205752	Windows Server 2019 Create a pagefile user right must only be assigned to the Administrators group.
V-205753	Windows Server 2019 Create a token object user right must not be assigned to any groups or accounts.
V-205754	Windows Server 2019 Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-205755	Windows Server 2019 Create permanent shared objects user right must not be assigned to any groups or accounts.
V-205756	Windows Server 2019 Create symbolic links user right must only be assigned to the Administrators group.
V-205757	Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group.
V-205758	Windows Server 2019 Force shutdown from a remote system user right must only be assigned to the Administrators group.
V-205759	Windows Server 2019 Generate security audits user right must only be assigned to Local Service and Network Service.
V-205760	Windows Server 2019 Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-205761	Windows Server 2019 Increase scheduling priority: user right must only be assigned to the Administrators group.
V-205762	Windows Server 2019 Load and unload device drivers user right must only be assigned to the Administrators group.
V-205763	Windows Server 2019 Lock pages in memory user right must not be assigned to any groups or accounts.
V-205764	Windows Server 2019 Modify firmware environment values user right must only be assigned to the Administrators group.
V-205765	Windows Server 2019 Perform volume maintenance tasks user right must only be assigned to the Administrators group.
V-205766	Windows Server 2019 Profile single process user right must only be assigned to the Administrators group.
V-205767	Windows Server 2019 Restore files and directories user right must only be assigned to the Administrators group.
V-205768	Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group.
V-205769	Windows Server 2019 must be configured to audit Account Management - Other Account Management Events successes.
V-205770	Windows Server 2019 must be configured to audit Detailed Tracking - Process Creation successes.
V-205771	Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes.
V-205772	Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures.
V-205773	Windows Server 2019 must be configured to audit Policy Change - Authentication Policy Change successes.
V-205774	Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change successes.
V-205775	Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
V-205776	Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
V-205777	Windows Server 2019 must be configured to audit System - IPsec Driver successes.
V-205778	Windows Server 2019 must be configured to audit System - IPsec Driver failures.
V-205779	Windows Server 2019 must be configured to audit System - Other System Events successes.
V-205780	Windows Server 2019 must be configured to audit System - Other System Events failures.
V-205781	Windows Server 2019 must be configured to audit System - Security State Change successes.
V-205782	Windows Server 2019 must be configured to audit System - Security System Extension successes.
V-205783	Windows Server 2019 must be configured to audit System - System Integrity successes.
V-205784	Windows Server 2019 must be configured to audit System - System Integrity failures.
V-205791	Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes.
V-205792	Windows Server 2019 must be configured to audit DS Access - Directory Service Access failures.
V-205793	Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes.
V-205795	Windows Server 2019 account lockout duration must be configured to 15 minutes or greater.
V-205796	Windows Server 2019 Application event log size must be configured to 32768 KB or greater.
V-205797	Windows Server 2019 Security event log size must be configured to 196608 KB or greater.
V-205798	Windows Server 2019 System event log size must be configured to 32768 KB or greater.
V-205801	Windows Server 2019 must prevent users from changing installation options.
V-205802	Windows Server 2019 must disable the Windows Installer Always install with elevated privileges option.
V-205804	Windows Server 2019 Autoplay must be turned off for non-volume devices.
V-205805	Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands.
V-205806	Windows Server 2019 AutoPlay must be disabled for all drives.
V-205808	Windows Server 2019 must not save passwords in the Remote Desktop Client.
V-205809	Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connection.
V-205810	Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials.
V-205811	Windows Server 2019 User Account Control approval mode for the built-in Administrator must be enabled.
V-205812	Windows Server 2019 User Account Control must automatically deny standard user requests for elevation.
V-205813	Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
V-205814	Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
V-205815	Windows Server 2019 computer account password must not be prevented from being reset.
V-205816	Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic.
V-205817	Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
V-205819	Windows Server 2019 must be configured to ignore NetBIOS name release requests except from WINS servers.
V-205820	Windows Server 2019 domain controllers must require LDAP access signing.
V-205821	Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
V-205822	Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
V-205823	Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
V-205824	Windows Server 2019 must be configured to require a strong session key.
V-205825	Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
V-205826	Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
V-205827	Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
V-205828	Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
V-205830	Windows Server 2019 Explorer Data Execution Prevention must be enabled.
V-205832	Windows Server 2019 must be configured to audit Account Logon - Credential Validation successes.
V-205833	Windows Server 2019 must be configured to audit Account Logon - Credential Validation failures.
V-205835	Windows Server 2019 must be configured to audit Logon/Logoff - Special Logon successes.
V-205836	Windows Server 2019 must be configured to audit Object Access - Other Object Access Events successes.
V-205837	Windows Server 2019 must be configured to audit Object Access - Other Object Access Events failures.
V-205838	Windows Server 2019 must be configured to audit logoff successes.
V-205858	Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.
V-205859	Windows Server 2019 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.
V-205860	Windows Server 2019 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.
V-205861	Windows Server 2019 insecure logons to an SMB server must be disabled.
V-205862	Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.
V-205863	Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable credentials.
V-205865	Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.
V-205866	Windows Server 2019 group policy objects must be reprocessed even if they have not changed.
V-205867	Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on battery).
V-205868	Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plugged in).
V-205869	Windows Server 2019 Telemetry must be configured to Security or Basic.
V-205870	Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet.
V-205871	Windows Server 2019 Turning off File Explorer heap termination on corruption must be disabled.
V-205872	Windows Server 2019 File Explorer shell protocol must run in protected mode.
V-205873	Windows Server 2019 must prevent attachments from being downloaded from RSS feeds.
V-205874	Windows Server 2019 users must be notified if a web-based program attempts to install software.
V-205876	Windows Server 2019 domain controllers must be configured to allow reset of machine account passwords.
V-205906	Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined member servers.
V-205908	Windows Server 2019 must prevent local accounts with blank passwords from being used from the network.
V-205909	Windows Server 2019 built-in administrator account must be renamed.
V-205910	Windows Server 2019 built-in guest account must be renamed.
V-205911	Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less.
V-205912	Windows Server 2019 Smart Card removal option must be configured to Force Logoff or Lock Workstation.
V-205914	Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts.
V-205915	Windows Server 2019 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
V-205916	Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
V-205917	Windows Server 2019 must prevent NTLM from falling back to a Null session.
V-205918	Windows Server 2019 must prevent PKU2U authentication using online identities.
V-205919	Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM.
V-205920	Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing.
V-205921	Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
V-205922	Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
V-205923	Windows Server 2019 default permissions of global system objects must be strengthened.
V-205925	Windows Server 2019 must disable automatically signing in the last interactive user after a system-initiated restart.
V-257503	Windows Server 2019 must have PowerShell Transcription enabled.

Windows 2022 (192/204 [94%])

Control	Title	Notes
V-254269	Windows Server 2022 must not have the Fax Server role installed.
V-254270	Windows Server 2022 must not have the Microsoft FTP service installed unless required by the organization.
V-254271	Windows Server 2022 must not have the Peer Name Resolution Protocol installed.
V-254272	Windows Server 2022 must not have Simple TCP/IP Services installed.
V-254273	Windows Server 2022 must not have the Telnet Client installed.
V-254274	Windows Server 2022 must not have the TFTP Client installed.
V-254275	Windows Server 2022 must not the Server Message Block (SMB) v1 protocol installed.
V-254276	Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
V-254277	Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
V-254278	Windows Server 2022 must not have Windows PowerShell 2.0 installed.
V-254285	Windows Server 2022 account lockout duration must be configured to 15 minutes or greater.
V-254286	Windows Server 2022 must have the number of allowed bad logon attempts configured to three or less.
V-254287	Windows Server 2022 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.
V-254288	Windows Server 2022 password history must be configured to 24 passwords remembered.
V-254289	Windows Server 2022 maximum password age must be configured to 60 days or less.
V-254290	Windows Server 2022 minimum password age must be configured to at least one day.
V-254291	Windows Server 2022 minimum password length must be configured to 14 characters.
V-254292	Windows Server 2022 must have the built-in Windows password complexity policy enabled.
V-254293	Windows Server 2022 reversible password encryption must be disabled.
V-254296	Windows Server 2022 permissions for the Application event log must prevent access by nonprivileged accounts.
V-254297	Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged accounts.
V-254298	Windows Server 2022 permissions for the System event log must prevent access by nonprivileged accounts.
V-254299	Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion.
V-254300	Windows Server 2022 must be configured to audit Account Logon - Credential Validation successes.
V-254301	Windows Server 2022 must be configured to audit Account Logon - Credential Validation failures.
V-254302	Windows Server 2022 must be configured to audit Account Management - Other Account Management Events successes.
V-254303	Windows Server 2022 must be configured to audit Account Management - Security Group Management successes.
V-254304	Windows Server 2022 must be configured to audit Account Management - User Account Management successes.
V-254305	Windows Server 2022 must be configured to audit Account Management - User Account Management failures.
V-254307	Windows Server 2022 must be configured to audit Detailed Tracking - Process Creation successes.
V-254309	Windows Server 2022 must be configured to audit Logon/Logoff - Account Lockout failures.
V-254311	Windows Server 2022 must be configured to audit logoff successes.
V-254312	Windows Server 2022 must be configured to audit logon successes.
V-254313	Windows Server 2022 must be configured to audit logon failures.
V-254314	Windows Server 2022 must be configured to audit Logon/Logoff - Special Logon successes.
V-254315	Windows Server 2022 must be configured to audit Object Access - Other Object Access Events successes.
V-254316	Windows Server 2022 must be configured to audit Object Access - Other Object Access Events failures.
V-254319	Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change successes.
V-254320	Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change failures.
V-254321	Windows Server 2022 must be configured to audit Policy Change - Authentication Policy Change successes.
V-254322	Windows Server 2022 must be configured to audit Policy Change - Authorization Policy Change successes.
V-254323	Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
V-254324	Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
V-254325	Windows Server 2022 must be configured to audit System - IPsec Driver successes.
V-254326	Windows Server 2022 must be configured to audit System - IPsec Driver failures.
V-254327	Windows Server 2022 must be configured to audit System - Other System Events successes.
V-254328	Windows Server 2022 must be configured to audit System - Other System Events failures.
V-254329	Windows Server 2022 must be configured to audit System - Security State Change successes.
V-254330	Windows Server 2022 must be configured to audit System - Security System Extension successes.
V-254331	Windows Server 2022 must be configured to audit System - System Integrity successes.
V-254332	Windows Server 2022 must be configured to audit System - System Integrity failures.
V-254333	Windows Server 2022 must prevent the display of slide shows on the lock screen.
V-254334	Windows Server 2022 must have WDigest Authentication disabled.
V-254335	Windows Server 2022 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.
V-254336	Windows Server 2022 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.
V-254337	Windows Server 2022 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.
V-254338	Windows Server 2022 must be configured to ignore NetBIOS name release requests except from WINS servers.
V-254339	Windows Server 2022 insecure logons to an SMB server must be disabled.
V-254340	Windows Server 2022 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.	Scan results may show failure after remediation, this is a false-negative due to pattern matching errors in the scanner.
V-254341	Windows Server 2022 command line data must be included in process creation events.
V-254342	Windows Server 2022 must be configured to enable Remote host allows delegation of nonexportable credentials.
V-254344	Windows Server 2022 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.
V-254345	Windows Server 2022 group policy objects must be reprocessed even if they have not changed.
V-254346	Windows Server 2022 downloading print driver packages over HTTP must be turned off.
V-254347	Windows Server 2022 printing over HTTP must be turned off.
V-254348	Windows Server 2022 network selection user interface (UI) must not be displayed on the logon screen.
V-254349	Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (on battery).
V-254350	Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (plugged in).
V-254351	Windows Server 2022 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
V-254352	Windows Server 2022 Autoplay must be turned off for nonvolume devices.
V-254353	Windows Server 2022 default AutoRun behavior must be configured to prevent AutoRun commands.
V-254354	Windows Server 2022 AutoPlay must be disabled for all drives.
V-254355	Windows Server 2022 administrator accounts must not be enumerated during elevation.
V-254356	Windows Server 2022 Diagnostic Data must be configured to send "required diagnostic data" or "optional diagnostic data".
V-254357	Windows Server 2022 Windows Update must not obtain updates from other PCs on the internet.
V-254358	Windows Server 2022 Application event log size must be configured to 32768 KB or greater.
V-254359	Windows Server 2022 Security event log size must be configured to 196608 KB or greater.
V-254360	Windows Server 2022 System event log size must be configured to 32768 KB or greater.
V-254361	Windows Server 2022 Microsoft Defender antivirus SmartScreen must be enabled.
V-254362	Windows Server 2022 Explorer Data Execution Prevention must be enabled.
V-254363	Windows Server 2022 Turning off File Explorer heap termination on corruption must be disabled.
V-254364	Windows Server 2022 File Explorer shell protocol must run in protected mode.
V-254365	Windows Server 2022 must not save passwords in the Remote Desktop Client.
V-254366	Windows Server 2022 Remote Desktop Services must prevent drive redirection.
V-254367	Windows Server 2022 Remote Desktop Services must always prompt a client for passwords upon connection.
V-254368	Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
V-254369	Windows Server 2022 Remote Desktop Services must be configured with the client connection encryption set to High Level.
V-254370	Windows Server 2022 must prevent attachments from being downloaded from RSS feeds.
V-254371	Windows Server 2022 must disable Basic authentication for RSS feeds over HTTP.
V-254372	Windows Server 2022 must prevent Indexing of encrypted files.
V-254373	Windows Server 2022 must prevent users from changing installation options.
V-254374	Windows Server 2022 must disable the Windows Installer Always install with elevated privileges option.
V-254375	Windows Server 2022 users must be notified if a web-based program attempts to install software.
V-254376	Windows Server 2022 must disable automatically signing in the last interactive user after a system-initiated restart.
V-254377	Windows Server 2022 PowerShell script block logging must be enabled.
V-254378	Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication.
V-254379	Windows Server 2022 Windows Remote Management (WinRM) client must not allow unencrypted traffic.
V-254380	Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication.
V-254381	Windows Server 2022 Windows Remote Management (WinRM) service must not use Basic authentication.
V-254382	Windows Server 2022 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
V-254383	Windows Server 2022 Windows Remote Management (WinRM) service must not store RunAs credentials.
V-254384	Windows Server 2022 must have PowerShell Transcription enabled.
V-254407	Windows Server 2022 must be configured to audit Account Management - Computer Account Management successes.
V-254408	Windows Server 2022 must be configured to audit DS Access - Directory Service Access successes.
V-254409	Windows Server 2022 must be configured to audit DS Access - Directory Service Access failures.
V-254410	Windows Server 2022 must be configured to audit DS Access - Directory Service Changes successes.
V-254416	Windows Server 2022 domain controllers must require LDAP access signing.
V-254417	Windows Server 2022 domain controllers must be configured to allow reset of machine account passwords.
V-254418	Windows Server 2022 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and
Enterprise Domain Controllers groups on domain controllers.
Control	Title
:--	:--
V-254419	Windows Server 2022 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
V-254420	Windows Server 2022 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.
V-254421	Windows Server 2022 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
V-254422	Windows Server 2022 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
V-254423	Windows Server 2022 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
V-254424	Windows Server 2022 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
V-254425	Windows Server 2022 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
V-254426	Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
V-254429	Windows Server 2022 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.
V-254430	Windows Server 2022 local users on domain-joined member servers must not be enumerated.
V-254431	Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
V-254432	Windows Server 2022 must limit the caching of logon credentials to four or less on domain-joined member servers.
V-254433	Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems.
V-254434	Windows Server 2022 Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and standalone or nondomain-joined systems.
V-254435	Windows Server 2022 Deny access to this computer from the network user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.
V-254436	Windows Server 2022 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
V-254437	Windows Server 2022 Deny log on as a service user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
V-254438	Windows Server 2022 Deny log on locally user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
V-254439	Windows Server 2022 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
V-254440	Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems.
V-254445	Windows Server 2022 must have the built-in guest account disabled.
V-254446	Windows Server 2022 must prevent local accounts with blank passwords from being used from the network.
V-254447	Windows Server 2022 built-in administrator account must be renamed.
V-254448	Windows Server 2022 built-in guest account must be renamed.
V-254449	Windows Server 2022 must force audit policy subcategory settings to override audit policy category settings.
V-254450	Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
V-254451	Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
V-254452	Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
V-254453	Windows Server 2022 computer account password must not be prevented from being reset.
V-254454	Windows Server 2022 maximum age for machine account passwords must be configured to 30 days or less.
V-254455	Windows Server 2022 must be configured to require a strong session key.
V-254456	Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
V-254459	Windows Server 2022 Smart Card removal option must be configured to Force Logoff or Lock Workstation.
V-254460	Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
V-254461	Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
V-254462	Windows Server 2022 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
V-254463	Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
V-254464	Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
V-254466	Windows Server 2022 must not allow anonymous enumeration of Security Account Manager (SAM) accounts.
V-254467	Windows Server 2022 must not allow anonymous enumeration of shares.
V-254468	Windows Server 2022 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
V-254469	Windows Server 2022 must restrict anonymous access to Named Pipes and Shares.
V-254470	Windows Server 2022 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
V-254471	Windows Server 2022 must prevent NTLM from falling back to a Null session.
V-254472	Windows Server 2022 must prevent PKU2U authentication using online identities.
V-254473	Windows Server 2022 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
V-254474	Windows Server 2022 must be configured to prevent the storage of the LAN Manager hash of passwords.
V-254475	Windows Server 2022 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM.
V-254476	Windows Server 2022 must be configured to at least negotiate signing for LDAP client signing.
V-254477	Windows Server 2022 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
V-254478	Windows Server 2022 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
V-254479	Windows Server 2022 users must be required to enter a password to access private keys stored on the computer.
V-254481	Windows Server 2022 default permissions of global system objects must be strengthened.
V-254482	Windows Server 2022 User Account Control (UAC) approval mode for the built-in Administrator must be enabled.
V-254483	Windows Server 2022 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
V-254484	Windows Server 2022 User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop.
V-254485	Windows Server 2022 User Account Control (UAC) must automatically deny standard user requests for elevation.
V-254486	Windows Server 2022 User Account Control (UAC) must be configured to detect application installations and prompt for elevation.
V-254487	Windows Server 2022 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.
V-254488	Windows Server 2022 User Account Control (UAC) must run all administrators in Admin Approval Mode, enabling UAC.
V-254489	Windows Server 2022 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.
V-254491	Windows Server 2022 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
V-254492	Windows Server 2022 Act as part of the operating system user right must not be assigned to any groups or accounts.
V-254493	Windows Server 2022 Allow log on locally user right must only be assigned to the Administrators group.
V-254494	Windows Server 2022 back up files and directories user right must only be assigned to the Administrators group.
V-254495	Windows Server 2022 create a pagefile user right must only be assigned to the Administrators group.
V-254496	Windows Server 2022 create a token object user right must not be assigned to any groups or accounts.
V-254497	Windows Server 2022 create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-254498	Windows Server 2022 create permanent shared objects user right must not be assigned to any groups or accounts.
V-254499	Windows Server 2022 create symbolic links user right must only be assigned to the Administrators group.
V-254500	Windows Server 2022 debug programs user right must only be assigned to the Administrators group.
V-254501	Windows Server 2022 force shutdown from a remote system user right must only be assigned to the Administrators group.
V-254502	Windows Server 2022 generate security audits user right must only be assigned to Local Service and Network Service.
V-254503	Windows Server 2022 impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
V-254504	Windows Server 2022 increase scheduling priority: user right must only be assigned to the Administrators group.
V-254505	Windows Server 2022 load and unload device drivers user right must only be assigned to the Administrators group.
V-254506	Windows Server 2022 lock pages in memory user right must not be assigned to any groups or accounts.
V-254507	Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.
V-254508	Windows Server 2022 modify firmware environment values user right must only be assigned to the Administrators group.
V-254509	Windows Server 2022 perform volume maintenance tasks user right must only be assigned to the Administrators group.
V-254510	Windows Server 2022 profile single process user right must only be assigned to the Administrators group.
V-254511	Windows Server 2022 restore files and directories user right must only be assigned to the Administrators group.
V-254512	Windows Server 2022 take ownership of files or other objects user right must only be assigned to the Administrators group.