1. Introduction
2. Licensing
3. Installing Sicura Enterprise
4. Server install from RPM
5. Server install from ISO
6. Upgrade Sicura Enterprise
7. Server Installation via Control Repo
8. Enable SIMP Compliance Engine
9. Configure SIMP Compliance Engine
10. Included Compliance Profiles
11. Console install via Puppet
12. Agent Install via Puppet
13. Coverage - CIS, Windows
14. Coverage - CIS, Linux
15. Coverage - CMMC, Windows
16. Coverage - CMMC, Linux
17. Coverage - DISA, Windows
18. Coverage - DISA, Linux
19. Coverage - NIST 800-171 r2, Windows
20. Linux DISA Module Usage
21. Windows CIS module usage
22. Linux CIS Module Usage
23. Linux SSG Module Usage

NIST Coverage Report

Summary

Detail

Unmapped Controls

The following controls are not mapped:

Windows 2019 (12/204 [5%])

• oval:simp.disa.V-205648:def:1
  • Title: Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in the Trusted Root Store.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-205649:def:1
  • Title: Windows Server 2019 must have the DoD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-205650:def:1
  • Title: Windows Server 2019 must have the US DoD CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-205663:def:1
  • Title: Windows Server 2019 local volumes must use a format that supports NTFS attributes.
• oval:simp.disa.V-205702:def:1
  • Title: Windows Server 2019 Kerberos user logon restrictions must be enforced.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-205703:def:1
  • Title: Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-205704:def:1
  • Title: Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-205705:def:1
  • Title: Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-205706:def:1
  • Title: Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-205739:def:1
  • Title: Windows Server 2019 permissions on the Active Directory data files must only allow System and Administrators access.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-205842:def:1
  • Title: Windows Server 2019 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
  • NOTE: Lower priority: this is not a requirement for most customers.
• oval:simp.disa.V-205849:def:1
  • Title: Windows Server 2019 must be maintained at a supported servicing level.

    Windows 2016 (12/202 [5%])

• oval:simp.disa.V-224828:def:1
  • Title: Systems must be maintained at a supported servicing level.
• oval:simp.disa.V-224831:def:1
  • Title: Local volumes must use a format that supports NTFS attributes.
• oval:simp.disa.V-224965:def:1
  • Title: Kerberos user logon restrictions must be enforced.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-224966:def:1
  • Title: The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-224967:def:1
  • Title: The Kerberos user ticket lifetime must be limited to 10 hours or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-224968:def:1
  • Title: The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-224969:def:1
  • Title: The computer clock synchronization tolerance must be limited to 5 minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-224970:def:1
  • Title: Permissions on the Active Directory data files must only allow System and Administrators access.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-225021:def:1
  • Title: The DoD Root CA certificates must be installed in the Trusted Root Store.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225022:def:1
  • Title: The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225023:def:1
  • Title: The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225059:def:1
  • Title: Windows Server 2016 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
  • NOTE: Lower priority: this is not a requirement for most customers.

    Windows 2012 R2 (20/520 [3%])

• oval:simp.disa.V-225417:def:1
  • Title: Systems must be maintained at a supported service pack level.
• oval:simp.disa.V-225430:def:1
  • Title: The HBSS McAfee Agent must be installed.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-225441:def:1
  • Title: The DoD Root CA certificates must be installed in the Trusted Root Store.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225442:def:1
  • Title: The DoD Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225443:def:1
  • Title: The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-225444:def:1
  • Title: Standard user accounts must only have Read permissions to the Winlogon registry key.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-225512:def:1
  • Title: The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
  • NOTE: Lower priority: this is not a requirement for most customers.
• oval:simp.disa.V-226065:def:1
  • Title: Kerberos user logon restrictions must be enforced.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-226066:def:1
  • Title: The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-226067:def:1
  • Title: The Kerberos user ticket lifetime must be limited to 10 hours or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-226068:def:1
  • Title: The Kerberos policy user ticket renewal maximum lifetime must be limited to 7 days or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-226069:def:1
  • Title: The computer clock synchronization tolerance must be limited to 5 minutes or less.
  • NOTE: Requires a module to manage Group Policy.
• oval:simp.disa.V-226070:def:1
  • Title: Active Directory data files must have proper access control permissions.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-226237:def:1
  • Title: Systems must be maintained at a supported service pack level.
• oval:simp.disa.V-226250:def:1
  • Title: The HBSS McAfee Agent must be installed.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-226261:def:1
  • Title: The DoD Root CA certificates must be installed in the Trusted Root Store.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-226262:def:1
  • Title: The DoD Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-226263:def:1
  • Title: The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
  • NOTE: Requires a module to manage the Windows certificate store.
• oval:simp.disa.V-226268:def:1
  • Title: Standard user accounts must only have Read permissions to the Winlogon registry key.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-226335:def:1
  • Title: The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
  • NOTE: Lower priority: this is not a requirement for most customers.

Mapped

The following controls are mapped:

Windows 2019 (192/204 [94%])

• oval:simp.disa.V-205625:def:1
  • Title: Windows Server 2019 must be configured to audit Account Management - Security Group Management successes.
• oval:simp.disa.V-205626:def:1
  • Title: Windows Server 2019 must be configured to audit Account Management - User Account Management successes.
• oval:simp.disa.V-205627:def:1
  • Title: Windows Server 2019 must be configured to audit Account Management - User Account Management failures.
• oval:simp.disa.V-205629:def:1
  • Title: Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less.
• oval:simp.disa.V-205630:def:1
  • Title: Windows Server 2019 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.
• oval:simp.disa.V-205633:def:1
  • Title: Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.
• oval:simp.disa.V-205634:def:1
  • Title: Windows Server 2019 must be configured to audit logon successes.
• oval:simp.disa.V-205635:def:1
  • Title: Windows Server 2019 must be configured to audit logon failures.
• oval:simp.disa.V-205636:def:1
  • Title: Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
• oval:simp.disa.V-205637:def:1
  • Title: Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level.
• oval:simp.disa.V-205638:def:1
  • Title: Windows Server 2019 command line data must be included in process creation events.
• oval:simp.disa.V-205639:def:1
  • Title: Windows Server 2019 PowerShell script block logging must be enabled.
• oval:simp.disa.V-205640:def:1
  • Title: Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-205641:def:1
  • Title: Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-205642:def:1
  • Title: Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-205643:def:1
  • Title: Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205644:def:1
  • Title: Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings.
• oval:simp.disa.V-205651:def:1
  • Title: Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.
• oval:simp.disa.V-205652:def:1
  • Title: Windows Server 2019 must have the built-in Windows password complexity policy enabled.
• oval:simp.disa.V-205653:def:1
  • Title: Windows Server 2019 reversible password encryption must be disabled.
• oval:simp.disa.V-205654:def:1
  • Title: Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords.
• oval:simp.disa.V-205655:def:1
  • Title: Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
• oval:simp.disa.V-205656:def:1
  • Title: Windows Server 2019 minimum password age must be configured to at least one day.
• oval:simp.disa.V-205659:def:1
  • Title: Windows Server 2019 maximum password age must be configured to 60 days or less.
• oval:simp.disa.V-205660:def:1
  • Title: Windows Server 2019 password history must be configured to 24 passwords remembered.
• oval:simp.disa.V-205662:def:1
  • Title: Windows Server 2019 minimum password length must be configured to 14 characters.
• oval:simp.disa.V-205665:def:1
  • Title: Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers.
• oval:simp.disa.V-205666:def:1
  • Title: Windows Server 2019 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.
• oval:simp.disa.V-205667:def:1
  • Title: Windows Server 2019 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-205668:def:1
  • Title: Windows Server 2019 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-205669:def:1
  • Title: Windows Server 2019 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
• oval:simp.disa.V-205670:def:1
  • Title: Windows Server 2019 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-205671:def:1
  • Title: Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and standalone systems.
• oval:simp.disa.V-205672:def:1
  • Title: Windows Server 2019 Deny access to this computer from the network user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.
• oval:simp.disa.V-205673:def:1
  • Title: Windows Server 2019 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
• oval:simp.disa.V-205674:def:1
  • Title: Windows Server 2019 Deny log on as a service user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
• oval:simp.disa.V-205675:def:1
  • Title: Windows Server 2019 Deny log on locally user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.
• oval:simp.disa.V-205676:def:1
  • Title: Windows Server 2019 Allow log on locally user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205678:def:1
  • Title: Windows Server 2019 must not have the Fax Server role installed.
• oval:simp.disa.V-205679:def:1
  • Title: Windows Server 2019 must not have the Peer Name Resolution Protocol installed.
• oval:simp.disa.V-205680:def:1
  • Title: Windows Server 2019 must not have Simple TCP/IP Services installed.
• oval:simp.disa.V-205681:def:1
  • Title: Windows Server 2019 must not have the TFTP Client installed.
• oval:simp.disa.V-205682:def:1
  • Title: Windows Server 2019 must not the Server Message Block (SMB) v1 protocol installed.
• oval:simp.disa.V-205683:def:1
  • Title: Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
• oval:simp.disa.V-205684:def:1
  • Title: Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
• oval:simp.disa.V-205685:def:1
  • Title: Windows Server 2019 must not have Windows PowerShell 2.0 installed.
• oval:simp.disa.V-205686:def:1
  • Title: Windows Server 2019 must prevent the display of slide shows on the lock screen.
• oval:simp.disa.V-205687:def:1
  • Title: Windows Server 2019 must have WDigest Authentication disabled.
• oval:simp.disa.V-205688:def:1
  • Title: Windows Server 2019 downloading print driver packages over HTTP must be turned off.
• oval:simp.disa.V-205689:def:1
  • Title: Windows Server 2019 printing over HTTP must be turned off.
• oval:simp.disa.V-205690:def:1
  • Title: Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen.
• oval:simp.disa.V-205691:def:1
  • Title: Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
• oval:simp.disa.V-205692:def:1
  • Title: Windows Server 2019 Windows Defender SmartScreen must be enabled.
• oval:simp.disa.V-205693:def:1
  • Title: Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP.
• oval:simp.disa.V-205694:def:1
  • Title: Windows Server 2019 must prevent Indexing of encrypted files.
• oval:simp.disa.V-205696:def:1
  • Title: Windows Server 2019 local users on domain-joined member servers must not be enumerated.
• oval:simp.disa.V-205697:def:1
  • Title: Windows Server 2019 must not have the Microsoft FTP service installed unless required by the organization.
• oval:simp.disa.V-205698:def:1
  • Title: Windows Server 2019 must not have the Telnet Client installed.
• oval:simp.disa.V-205708:def:1
  • Title: Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
• oval:simp.disa.V-205709:def:1
  • Title: Windows Server 2019 must have the built-in guest account disabled.
• oval:simp.disa.V-205711:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.
• oval:simp.disa.V-205712:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.
• oval:simp.disa.V-205713:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.
• oval:simp.disa.V-205714:def:1
  • Title: Windows Server 2019 administrator accounts must not be enumerated during elevation.
• oval:simp.disa.V-205715:def:1
  • Title: Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.
• oval:simp.disa.V-205716:def:1
  • Title: Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
• oval:simp.disa.V-205717:def:1
  • Title: Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
• oval:simp.disa.V-205718:def:1
  • Title: Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation.
• oval:simp.disa.V-205719:def:1
  • Title: Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.
• oval:simp.disa.V-205720:def:1
  • Title: Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.
• oval:simp.disa.V-205722:def:1
  • Title: Windows Server 2019 Remote Desktop Services must prevent drive redirection.
• oval:simp.disa.V-205724:def:1
  • Title: Windows Server 2019 must not allow anonymous enumeration of shares.
• oval:simp.disa.V-205725:def:1
  • Title: Windows Server 2019 must restrict anonymous access to Named Pipes and Shares.
• oval:simp.disa.V-205729:def:1
  • Title: Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout successes.
• oval:simp.disa.V-205730:def:1
  • Title: Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures.
• oval:simp.disa.V-205731:def:1
  • Title: Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.
• oval:simp.disa.V-205732:def:1
  • Title: Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-205733:def:1
  • Title: Windows Server 2019 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.
• oval:simp.disa.V-205744:def:1
  • Title: Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
• oval:simp.disa.V-205745:def:1
  • Title: Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
• oval:simp.disa.V-205747:def:1
  • Title: Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone systems.
• oval:simp.disa.V-205748:def:1
  • Title: Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone systems.
• oval:simp.disa.V-205749:def:1
  • Title: Windows Server 2019 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-205750:def:1
  • Title: Windows Server 2019 Act as part of the operating system user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-205751:def:1
  • Title: Windows Server 2019 Back up files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205752:def:1
  • Title: Windows Server 2019 Create a pagefile user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205753:def:1
  • Title: Windows Server 2019 Create a token object user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-205754:def:1
  • Title: Windows Server 2019 Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-205755:def:1
  • Title: Windows Server 2019 Create permanent shared objects user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-205756:def:1
  • Title: Windows Server 2019 Create symbolic links user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205757:def:1
  • Title: Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205758:def:1
  • Title: Windows Server 2019 Force shutdown from a remote system user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205759:def:1
  • Title: Windows Server 2019 Generate security audits user right must only be assigned to Local Service and Network Service.
• oval:simp.disa.V-205760:def:1
  • Title: Windows Server 2019 Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-205761:def:1
  • Title: Windows Server 2019 Increase scheduling priority: user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205762:def:1
  • Title: Windows Server 2019 Load and unload device drivers user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205763:def:1
  • Title: Windows Server 2019 Lock pages in memory user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-205764:def:1
  • Title: Windows Server 2019 Modify firmware environment values user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205765:def:1
  • Title: Windows Server 2019 Perform volume maintenance tasks user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205766:def:1
  • Title: Windows Server 2019 Profile single process user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205767:def:1
  • Title: Windows Server 2019 Restore files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205768:def:1
  • Title: Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group.
• oval:simp.disa.V-205769:def:1
  • Title: Windows Server 2019 must be configured to audit Account Management - Other Account Management Events successes.
• oval:simp.disa.V-205770:def:1
  • Title: Windows Server 2019 must be configured to audit Detailed Tracking - Process Creation successes.
• oval:simp.disa.V-205771:def:1
  • Title: Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes.
• oval:simp.disa.V-205772:def:1
  • Title: Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures.
• oval:simp.disa.V-205773:def:1
  • Title: Windows Server 2019 must be configured to audit Policy Change - Authentication Policy Change successes.
• oval:simp.disa.V-205774:def:1
  • Title: Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change successes.
• oval:simp.disa.V-205775:def:1
  • Title: Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
• oval:simp.disa.V-205776:def:1
  • Title: Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
• oval:simp.disa.V-205777:def:1
  • Title: Windows Server 2019 must be configured to audit System - IPsec Driver successes.
• oval:simp.disa.V-205778:def:1
  • Title: Windows Server 2019 must be configured to audit System - IPsec Driver failures.
• oval:simp.disa.V-205779:def:1
  • Title: Windows Server 2019 must be configured to audit System - Other System Events successes.
• oval:simp.disa.V-205780:def:1
  • Title: Windows Server 2019 must be configured to audit System - Other System Events failures.
• oval:simp.disa.V-205781:def:1
  • Title: Windows Server 2019 must be configured to audit System - Security State Change successes.
• oval:simp.disa.V-205782:def:1
  • Title: Windows Server 2019 must be configured to audit System - Security System Extension successes.
• oval:simp.disa.V-205783:def:1
  • Title: Windows Server 2019 must be configured to audit System - System Integrity successes.
• oval:simp.disa.V-205784:def:1
  • Title: Windows Server 2019 must be configured to audit System - System Integrity failures.
• oval:simp.disa.V-205791:def:1
  • Title: Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes.
• oval:simp.disa.V-205792:def:1
  • Title: Windows Server 2019 must be configured to audit DS Access - Directory Service Access failures.
• oval:simp.disa.V-205793:def:1
  • Title: Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes.
• oval:simp.disa.V-205794:def:1
  • Title: Windows Server 2019 must be configured to audit DS Access - Directory Service Changes failures.
• oval:simp.disa.V-205795:def:1
  • Title: Windows Server 2019 account lockout duration must be configured to 15 minutes or greater.
• oval:simp.disa.V-205796:def:1
  • Title: Windows Server 2019 Application event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-205797:def:1
  • Title: Windows Server 2019 Security event log size must be configured to 196608 KB or greater.
• oval:simp.disa.V-205798:def:1
  • Title: Windows Server 2019 System event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-205801:def:1
  • Title: Windows Server 2019 must prevent users from changing installation options.
• oval:simp.disa.V-205802:def:1
  • Title: Windows Server 2019 must disable the Windows Installer Always install with elevated privileges option.
• oval:simp.disa.V-205804:def:1
  • Title: Windows Server 2019 Autoplay must be turned off for non-volume devices.
• oval:simp.disa.V-205805:def:1
  • Title: Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands.
• oval:simp.disa.V-205806:def:1
  • Title: Windows Server 2019 AutoPlay must be disabled for all drives.
• oval:simp.disa.V-205808:def:1
  • Title: Windows Server 2019 must not save passwords in the Remote Desktop Client.
• oval:simp.disa.V-205809:def:1
  • Title: Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connection.
• oval:simp.disa.V-205810:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials.
• oval:simp.disa.V-205811:def:1
  • Title: Windows Server 2019 User Account Control approval mode for the built-in Administrator must be enabled.
• oval:simp.disa.V-205812:def:1
  • Title: Windows Server 2019 User Account Control must automatically deny standard user requests for elevation.
• oval:simp.disa.V-205813:def:1
  • Title: Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
• oval:simp.disa.V-205814:def:1
  • Title: Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone systems.
• oval:simp.disa.V-205815:def:1
  • Title: Windows Server 2019 computer account password must not be prevented from being reset.
• oval:simp.disa.V-205816:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic.
• oval:simp.disa.V-205817:def:1
  • Title: Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic.
• oval:simp.disa.V-205819:def:1
  • Title: Windows Server 2019 must be configured to ignore NetBIOS name release requests except from WINS servers.
• oval:simp.disa.V-205820:def:1
  • Title: Windows Server 2019 domain controllers must require LDAP access signing.
• oval:simp.disa.V-205821:def:1
  • Title: Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
• oval:simp.disa.V-205822:def:1
  • Title: Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
• oval:simp.disa.V-205823:def:1
  • Title: Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
• oval:simp.disa.V-205824:def:1
  • Title: Windows Server 2019 must be configured to require a strong session key.
• oval:simp.disa.V-205825:def:1
  • Title: Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
• oval:simp.disa.V-205826:def:1
  • Title: Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
• oval:simp.disa.V-205827:def:1
  • Title: Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
• oval:simp.disa.V-205828:def:1
  • Title: Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
• oval:simp.disa.V-205830:def:1
  • Title: Windows Server 2019 Explorer Data Execution Prevention must be enabled.
• oval:simp.disa.V-205832:def:1
  • Title: Windows Server 2019 must be configured to audit Account Logon - Credential Validation successes.
• oval:simp.disa.V-205833:def:1
  • Title: Windows Server 2019 must be configured to audit Account Logon - Credential Validation failures.
• oval:simp.disa.V-205835:def:1
  • Title: Windows Server 2019 must be configured to audit Logon/Logoff - Special Logon successes.
• oval:simp.disa.V-205836:def:1
  • Title: Windows Server 2019 must be configured to audit Object Access - Other Object Access Events successes.
• oval:simp.disa.V-205837:def:1
  • Title: Windows Server 2019 must be configured to audit Object Access - Other Object Access Events failures.
• oval:simp.disa.V-205838:def:1
  • Title: Windows Server 2019 must be configured to audit logoff successes.
• oval:simp.disa.V-205858:def:1
  • Title: Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.
• oval:simp.disa.V-205859:def:1
  • Title: Windows Server 2019 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.
• oval:simp.disa.V-205860:def:1
  • Title: Windows Server 2019 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.
• oval:simp.disa.V-205861:def:1
  • Title: Windows Server 2019 insecure logons to an SMB server must be disabled.
• oval:simp.disa.V-205862:def:1
  • Title: Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.
• oval:simp.disa.V-205863:def:1
  • Title: Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable credentials.
• oval:simp.disa.V-205865:def:1
  • Title: Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.
• oval:simp.disa.V-205866:def:1
  • Title: Windows Server 2019 group policy objects must be reprocessed even if they have not changed.
• oval:simp.disa.V-205867:def:1
  • Title: Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on battery).
• oval:simp.disa.V-205868:def:1
  • Title: Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plugged in).
• oval:simp.disa.V-205869:def:1
  • Title: Windows Server 2019 Telemetry must be configured to Security or Basic.
• oval:simp.disa.V-205870:def:1
  • Title: Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet.
• oval:simp.disa.V-205871:def:1
  • Title: Windows Server 2019 Turning off File Explorer heap termination on corruption must be disabled.
• oval:simp.disa.V-205872:def:1
  • Title: Windows Server 2019 File Explorer shell protocol must run in protected mode.
• oval:simp.disa.V-205873:def:1
  • Title: Windows Server 2019 must prevent attachments from being downloaded from RSS feeds.
• oval:simp.disa.V-205874:def:1
  • Title: Windows Server 2019 users must be notified if a web-based program attempts to install software.
• oval:simp.disa.V-205876:def:1
  • Title: Windows Server 2019 domain controllers must be configured to allow reset of machine account passwords.
• oval:simp.disa.V-205906:def:1
  • Title: Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined member servers.
• oval:simp.disa.V-205908:def:1
  • Title: Windows Server 2019 must prevent local accounts with blank passwords from being used from the network.
• oval:simp.disa.V-205909:def:1
  • Title: Windows Server 2019 built-in administrator account must be renamed.
• oval:simp.disa.V-205910:def:1
  • Title: Windows Server 2019 built-in guest account must be renamed.
• oval:simp.disa.V-205911:def:1
  • Title: Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less.
• oval:simp.disa.V-205912:def:1
  • Title: Windows Server 2019 Smart Card removal option must be configured to Force Logoff or Lock Workstation.
• oval:simp.disa.V-205914:def:1
  • Title: Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts.
• oval:simp.disa.V-205915:def:1
  • Title: Windows Server 2019 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
• oval:simp.disa.V-205916:def:1
  • Title: Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
• oval:simp.disa.V-205917:def:1
  • Title: Windows Server 2019 must prevent NTLM from falling back to a Null session.
• oval:simp.disa.V-205918:def:1
  • Title: Windows Server 2019 must prevent PKU2U authentication using online identities.
• oval:simp.disa.V-205919:def:1
  • Title: Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM.
• oval:simp.disa.V-205920:def:1
  • Title: Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing.
• oval:simp.disa.V-205921:def:1
  • Title: Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
• oval:simp.disa.V-205922:def:1
  • Title: Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
• oval:simp.disa.V-205923:def:1
  • Title: Windows Server 2019 default permissions of global system objects must be strengthened.
• oval:simp.disa.V-205925:def:1
  • Title: Windows Server 2019 must disable automatically signing in the last interactive user after a system-initiated restart.

    Windows 2016 (190/202 [94%])

• oval:simp.disa.V-224850:def:1
  • Title: The Fax Server role must not be installed.
• oval:simp.disa.V-224851:def:1
  • Title: The Microsoft FTP service must not be installed unless required.
• oval:simp.disa.V-224852:def:1
  • Title: The Peer Name Resolution Protocol must not be installed.
• oval:simp.disa.V-224853:def:1
  • Title: Simple TCP/IP Services must not be installed.
• oval:simp.disa.V-224854:def:1
  • Title: The Telnet Client must not be installed.
• oval:simp.disa.V-224855:def:1
  • Title: The TFTP Client must not be installed.
• oval:simp.disa.V-224856:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be uninstalled.
• oval:simp.disa.V-224857:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
• oval:simp.disa.V-224858:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
• oval:simp.disa.V-224859:def:1
  • Title: Windows PowerShell 2.0 must not be installed.
• oval:simp.disa.V-224866:def:1
  • Title: Windows 2016 account lockout duration must be configured to 15 minutes or greater.
• oval:simp.disa.V-224867:def:1
  • Title: Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less.
• oval:simp.disa.V-224868:def:1
  • Title: Windows Server 2016 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.
• oval:simp.disa.V-224869:def:1
  • Title: Windows Server 2016 password history must be configured to 24 passwords remembered.
• oval:simp.disa.V-224870:def:1
  • Title: Windows Server 2016 maximum password age must be configured to 60 days or less.
• oval:simp.disa.V-224871:def:1
  • Title: Windows Server 2016 minimum password age must be configured to at least one day.
• oval:simp.disa.V-224872:def:1
  • Title: Windows Server 2016 minimum password length must be configured to 14 characters.
• oval:simp.disa.V-224873:def:1
  • Title: Windows Server 2016 must have the built-in Windows password complexity policy enabled.
• oval:simp.disa.V-224874:def:1
  • Title: Windows Server 2016 reversible password encryption must be disabled.
• oval:simp.disa.V-224877:def:1
  • Title: Permissions for the Application event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-224878:def:1
  • Title: Permissions for the Security event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-224879:def:1
  • Title: Permissions for the System event log must prevent access by non-privileged accounts.
• oval:simp.disa.V-224880:def:1
  • Title: Event Viewer must be protected from unauthorized modification and deletion.
• oval:simp.disa.V-224881:def:1
  • Title: Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes.
• oval:simp.disa.V-224882:def:1
  • Title: Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures.
• oval:simp.disa.V-224883:def:1
  • Title: Windows Server 2016 must be configured to audit Account Management - Other Account Management Events successes.
• oval:simp.disa.V-224884:def:1
  • Title: Windows Server 2016 must be configured to audit Account Management - Security Group Management successes.
• oval:simp.disa.V-224885:def:1
  • Title: Windows Server 2016 must be configured to audit Account Management - User Account Management successes.
• oval:simp.disa.V-224886:def:1
  • Title: Windows Server 2016 must be configured to audit Account Management - User Account Management failures.
• oval:simp.disa.V-224888:def:1
  • Title: Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes.
• oval:simp.disa.V-224889:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout successes.
• oval:simp.disa.V-224890:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures.
• oval:simp.disa.V-224892:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes.
• oval:simp.disa.V-224893:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes.
• oval:simp.disa.V-224894:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures.
• oval:simp.disa.V-224895:def:1
  • Title: Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes.
• oval:simp.disa.V-224896:def:1
  • Title: Windows 2016 must be configured to audit Object Access - Other Object Access Events successes.
• oval:simp.disa.V-224897:def:1
  • Title: Windows 2016 must be configured to audit Object Access - Other Object Access Events failures.
• oval:simp.disa.V-224900:def:1
  • Title: Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes.
• oval:simp.disa.V-224901:def:1
  • Title: Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures.
• oval:simp.disa.V-224902:def:1
  • Title: Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change successes.
• oval:simp.disa.V-224903:def:1
  • Title: Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change successes.
• oval:simp.disa.V-224904:def:1
  • Title: Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
• oval:simp.disa.V-224905:def:1
  • Title: Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
• oval:simp.disa.V-224906:def:1
  • Title: Windows Server 2016 must be configured to audit System - IPsec Driver successes.
• oval:simp.disa.V-224907:def:1
  • Title: Windows Server 2016 must be configured to audit System - IPsec Driver failures.
• oval:simp.disa.V-224908:def:1
  • Title: Windows Server 2016 must be configured to audit System - Other System Events successes.
• oval:simp.disa.V-224909:def:1
  • Title: Windows Server 2016 must be configured to audit System - Other System Events failures.
• oval:simp.disa.V-224910:def:1
  • Title: Windows Server 2016 must be configured to audit System - Security State Change successes.
• oval:simp.disa.V-224911:def:1
  • Title: Windows Server 2016 must be configured to audit System - Security System Extension successes.
• oval:simp.disa.V-224912:def:1
  • Title: Windows Server 2016 must be configured to audit System - System Integrity successes.
• oval:simp.disa.V-224913:def:1
  • Title: Windows Server 2016 must be configured to audit System - System Integrity failures.
• oval:simp.disa.V-224914:def:1
  • Title: The display of slide shows on the lock screen must be disabled.
• oval:simp.disa.V-224915:def:1
  • Title: WDigest Authentication must be disabled on Windows Server 2016.
• oval:simp.disa.V-224916:def:1
  • Title: Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.
• oval:simp.disa.V-224917:def:1
  • Title: Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.
• oval:simp.disa.V-224918:def:1
  • Title: Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.
• oval:simp.disa.V-224919:def:1
  • Title: Windows Server 2016 must be configured to ignore NetBIOS name release requests except from WINS servers.
• oval:simp.disa.V-224920:def:1
  • Title: Insecure logons to an SMB server must be disabled.
• oval:simp.disa.V-224921:def:1
  • Title: Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\SYSVOL and \\NETLOGON shares.
• oval:simp.disa.V-224922:def:1
  • Title: Command line data must be included in process creation events.
• oval:simp.disa.V-224924:def:1
  • Title: Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.
• oval:simp.disa.V-224925:def:1
  • Title: Group Policy objects must be reprocessed even if they have not changed.
• oval:simp.disa.V-224926:def:1
  • Title: Downloading print driver packages over HTTP must be prevented.
• oval:simp.disa.V-224927:def:1
  • Title: Printing over HTTP must be prevented.
• oval:simp.disa.V-224928:def:1
  • Title: The network selection user interface (UI) must not be displayed on the logon screen.
• oval:simp.disa.V-224929:def:1
  • Title: Users must be prompted to authenticate when the system wakes from sleep (on battery).
• oval:simp.disa.V-224930:def:1
  • Title: Users must be prompted to authenticate when the system wakes from sleep (plugged in).
• oval:simp.disa.V-224931:def:1
  • Title: The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
• oval:simp.disa.V-224932:def:1
  • Title: AutoPlay must be turned off for non-volume devices.
• oval:simp.disa.V-224933:def:1
  • Title: The default AutoRun behavior must be configured to prevent AutoRun commands.
• oval:simp.disa.V-224934:def:1
  • Title: AutoPlay must be disabled for all drives.
• oval:simp.disa.V-224935:def:1
  • Title: Administrator accounts must not be enumerated during elevation.
• oval:simp.disa.V-224936:def:1
  • Title: Windows Telemetry must be configured to Security or Basic.
• oval:simp.disa.V-224937:def:1
  • Title: The Application event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-224938:def:1
  • Title: The Security event log size must be configured to 196608 KB or greater.
• oval:simp.disa.V-224939:def:1
  • Title: The System event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-224940:def:1
  • Title: Windows Server 2016 Windows SmartScreen must be enabled.
• oval:simp.disa.V-224941:def:1
  • Title: Explorer Data Execution Prevention must be enabled.
• oval:simp.disa.V-224942:def:1
  • Title: Turning off File Explorer heap termination on corruption must be disabled.
• oval:simp.disa.V-224943:def:1
  • Title: File Explorer shell protocol must run in protected mode.
• oval:simp.disa.V-224944:def:1
  • Title: Passwords must not be saved in the Remote Desktop Client.
• oval:simp.disa.V-224945:def:1
  • Title: Local drives must be prevented from sharing with Remote Desktop Session Hosts.
• oval:simp.disa.V-224946:def:1
  • Title: Remote Desktop Services must always prompt a client for passwords upon connection.
• oval:simp.disa.V-224947:def:1
  • Title: The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications.
• oval:simp.disa.V-224948:def:1
  • Title: Remote Desktop Services must be configured with the client connection encryption set to High Level.
• oval:simp.disa.V-224949:def:1
  • Title: Attachments must be prevented from being downloaded from RSS feeds.
• oval:simp.disa.V-224951:def:1
  • Title: Basic authentication for RSS feeds over HTTP must not be used.
• oval:simp.disa.V-224952:def:1
  • Title: Indexing of encrypted files must be turned off.
• oval:simp.disa.V-224953:def:1
  • Title: Users must be prevented from changing installation options.
• oval:simp.disa.V-224954:def:1
  • Title: The Windows Installer Always install with elevated privileges option must be disabled.
• oval:simp.disa.V-224955:def:1
  • Title: Users must be notified if a web-based program attempts to install software.
• oval:simp.disa.V-224956:def:1
  • Title: Automatically signing in the last interactive user after a system-initiated restart must be disabled.
• oval:simp.disa.V-224957:def:1
  • Title: PowerShell script block logging must be enabled.
• oval:simp.disa.V-224958:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Basic authentication.
• oval:simp.disa.V-224959:def:1
  • Title: The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
• oval:simp.disa.V-224960:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Digest authentication.
• oval:simp.disa.V-224961:def:1
  • Title: The Windows Remote Management (WinRM) service must not use Basic authentication.
• oval:simp.disa.V-224962:def:1
  • Title: The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
• oval:simp.disa.V-224963:def:1
  • Title: The Windows Remote Management (WinRM) service must not store RunAs credentials.
• oval:simp.disa.V-224987:def:1
  • Title: Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes.
• oval:simp.disa.V-224988:def:1
  • Title: Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures.
• oval:simp.disa.V-224989:def:1
  • Title: Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes.
• oval:simp.disa.V-224990:def:1
  • Title: Windows Server 2016 must be configured to audit DS Access - Directory Service Changes failures.
• oval:simp.disa.V-224995:def:1
  • Title: Domain controllers must require LDAP access signing.
• oval:simp.disa.V-224996:def:1
  • Title: Domain controllers must be configured to allow reset of machine account passwords.
• oval:simp.disa.V-224997:def:1
  • Title: The Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers.
• oval:simp.disa.V-224998:def:1
  • Title: The Add workstations to domain user right must only be assigned to the Administrators group.
• oval:simp.disa.V-224999:def:1
  • Title: The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225000:def:1
  • Title: The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-225001:def:1
  • Title: The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-225002:def:1
  • Title: The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
• oval:simp.disa.V-225003:def:1
  • Title: The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-225004:def:1
  • Title: The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-225005:def:1
  • Title: The Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
• oval:simp.disa.V-225008:def:1
  • Title: Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
• oval:simp.disa.V-225009:def:1
  • Title: Local users on domain-joined computers must not be enumerated.
• oval:simp.disa.V-225010:def:1
  • Title: Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server.
• oval:simp.disa.V-225011:def:1
  • Title: Caching of logon credentials must be limited.
• oval:simp.disa.V-225013:def:1
  • Title: Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
• oval:simp.disa.V-225014:def:1
  • Title: The Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on member servers.
• oval:simp.disa.V-225015:def:1
  • Title: The Deny access to this computer from the network user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems, and from unauthenticated access on all systems.
• oval:simp.disa.V-225016:def:1
  • Title: The Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.
• oval:simp.disa.V-225017:def:1
  • Title: The Deny log on as a service user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.
• oval:simp.disa.V-225018:def:1
  • Title: The Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.
• oval:simp.disa.V-225019:def:1
  • Title: The Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.
• oval:simp.disa.V-225020:def:1
  • Title: The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on member servers.
• oval:simp.disa.V-225024:def:1
  • Title: Windows Server 2016 built-in guest account must be disabled.
• oval:simp.disa.V-225025:def:1
  • Title: Local accounts with blank passwords must be restricted to prevent access from the network.
• oval:simp.disa.V-225026:def:1
  • Title: Windows Server 2016 built-in administrator account must be renamed.
• oval:simp.disa.V-225027:def:1
  • Title: Windows Server 2016 built-in guest account must be renamed.
• oval:simp.disa.V-225028:def:1
  • Title: Audit policy using subcategories must be enabled.
• oval:simp.disa.V-225029:def:1
  • Title: The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
• oval:simp.disa.V-225030:def:1
  • Title: The setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.
• oval:simp.disa.V-225031:def:1
  • Title: The setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
• oval:simp.disa.V-225032:def:1
  • Title: The computer account password must not be prevented from being reset.
• oval:simp.disa.V-225033:def:1
  • Title: The maximum age for machine account passwords must be configured to 30 days or less.
• oval:simp.disa.V-225034:def:1
  • Title: Windows Server 2016 must be configured to require a strong session key.
• oval:simp.disa.V-225035:def:1
  • Title: The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver.
• oval:simp.disa.V-225038:def:1
  • Title: The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
• oval:simp.disa.V-225039:def:1
  • Title: The setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
• oval:simp.disa.V-225040:def:1
  • Title: The setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
• oval:simp.disa.V-225041:def:1
  • Title: Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
• oval:simp.disa.V-225042:def:1
  • Title: The setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
• oval:simp.disa.V-225043:def:1
  • Title: The setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
• oval:simp.disa.V-225045:def:1
  • Title: Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed.
• oval:simp.disa.V-225046:def:1
  • Title: Anonymous enumeration of shares must not be allowed.
• oval:simp.disa.V-225047:def:1
  • Title: Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group.
• oval:simp.disa.V-225048:def:1
  • Title: Anonymous access to Named Pipes and Shares must be restricted.
• oval:simp.disa.V-225049:def:1
  • Title: Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.
• oval:simp.disa.V-225050:def:1
  • Title: NTLM must be prevented from falling back to a Null session.
• oval:simp.disa.V-225051:def:1
  • Title: PKU2U authentication using online identities must be prevented.
• oval:simp.disa.V-225052:def:1
  • Title: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
• oval:simp.disa.V-225053:def:1
  • Title: Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords.
• oval:simp.disa.V-225054:def:1
  • Title: The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM.
• oval:simp.disa.V-225055:def:1
  • Title: Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing.
• oval:simp.disa.V-225056:def:1
  • Title: Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.
• oval:simp.disa.V-225057:def:1
  • Title: Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.
• oval:simp.disa.V-225058:def:1
  • Title: Users must be required to enter a password to access private keys stored on the computer.
• oval:simp.disa.V-225060:def:1
  • Title: The default permissions of global system objects must be strengthened.
• oval:simp.disa.V-225061:def:1
  • Title: User Account Control approval mode for the built-in Administrator must be enabled.
• oval:simp.disa.V-225062:def:1
  • Title: UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
• oval:simp.disa.V-225063:def:1
  • Title: User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.
• oval:simp.disa.V-225064:def:1
  • Title: User Account Control must automatically deny standard user requests for elevation.
• oval:simp.disa.V-225065:def:1
  • Title: User Account Control must be configured to detect application installations and prompt for elevation.
• oval:simp.disa.V-225066:def:1
  • Title: User Account Control must only elevate UIAccess applications that are installed in secure locations.
• oval:simp.disa.V-225067:def:1
  • Title: User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
• oval:simp.disa.V-225068:def:1
  • Title: User Account Control must virtualize file and registry write failures to per-user locations.
• oval:simp.disa.V-225070:def:1
  • Title: The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225071:def:1
  • Title: The Act as part of the operating system user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225072:def:1
  • Title: The Allow log on locally user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225073:def:1
  • Title: The Back up files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225074:def:1
  • Title: The Create a pagefile user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225076:def:1
  • Title: The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-225077:def:1
  • Title: The Create permanent shared objects user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225078:def:1
  • Title: The Create symbolic links user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225079:def:1
  • Title: The Debug programs user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225080:def:1
  • Title: The Force shutdown from a remote system user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225081:def:1
  • Title: The Generate security audits user right must only be assigned to Local Service and Network Service.
• oval:simp.disa.V-225082:def:1
  • Title: The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-225083:def:1
  • Title: The Increase scheduling priority user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225084:def:1
  • Title: The Load and unload device drivers user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225085:def:1
  • Title: The Lock pages in memory user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225086:def:1
  • Title: The Manage auditing and security log user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225087:def:1
  • Title: The Modify firmware environment values user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225088:def:1
  • Title: The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225089:def:1
  • Title: The Profile single process user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225091:def:1
  • Title: The Create a token object user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225092:def:1
  • Title: The Restore files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225093:def:1
  • Title: The Take ownership of files or other objects user right must only be assigned to the Administrators group.

    Windows 2012 R2 (500/520 [96%])

• oval:simp.disa.V-225259:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.
• oval:simp.disa.V-225260:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
• oval:simp.disa.V-225261:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
• oval:simp.disa.V-225265:def:1
  • Title: Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.
• oval:simp.disa.V-225266:def:1
  • Title: Windows 2012 account lockout duration must be configured to 15 minutes or greater.
• oval:simp.disa.V-225267:def:1
  • Title: The number of allowed bad logon attempts must meet minimum requirements.
• oval:simp.disa.V-225268:def:1
  • Title: The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2012.
• oval:simp.disa.V-225269:def:1
  • Title: The password history must be configured to 24 passwords remembered.
• oval:simp.disa.V-225270:def:1
  • Title: The maximum password age must meet requirements.
• oval:simp.disa.V-225271:def:1
  • Title: The minimum password age must meet requirements.
• oval:simp.disa.V-225272:def:1
  • Title: Passwords must, at a minimum, be 14 characters.
• oval:simp.disa.V-225273:def:1
  • Title: The built-in Windows password complexity policy must be enabled.
• oval:simp.disa.V-225274:def:1
  • Title: Reversible password encryption must be disabled.
• oval:simp.disa.V-225275:def:1
  • Title: The system must be configured to audit Account Logon - Credential Validation successes.
• oval:simp.disa.V-225276:def:1
  • Title: The system must be configured to audit Account Logon - Credential Validation failures.
• oval:simp.disa.V-225277:def:1
  • Title: The system must be configured to audit Account Management - Other Account Management Events successes.
• oval:simp.disa.V-225278:def:1
  • Title: The system must be configured to audit Account Management - Security Group Management successes.
• oval:simp.disa.V-225279:def:1
  • Title: The system must be configured to audit Account Management - User Account Management successes.
• oval:simp.disa.V-225280:def:1
  • Title: The system must be configured to audit Account Management - User Account Management failures.
• oval:simp.disa.V-225281:def:1
  • Title: The system must be configured to audit Detailed Tracking - Process Creation successes.
• oval:simp.disa.V-225282:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout successes.
• oval:simp.disa.V-225283:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures.
• oval:simp.disa.V-225284:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logoff successes.
• oval:simp.disa.V-225285:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logon successes.
• oval:simp.disa.V-225286:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logon failures.
• oval:simp.disa.V-225287:def:1
  • Title: The system must be configured to audit Logon/Logoff - Special Logon successes.
• oval:simp.disa.V-225292:def:1
  • Title: The system must be configured to audit Policy Change - Audit Policy Change successes.
• oval:simp.disa.V-225293:def:1
  • Title: The system must be configured to audit Policy Change - Audit Policy Change failures.
• oval:simp.disa.V-225294:def:1
  • Title: The system must be configured to audit Policy Change - Authentication Policy Change successes.
• oval:simp.disa.V-225295:def:1
  • Title: The system must be configured to audit Policy Change - Authorization Policy Change successes.
• oval:simp.disa.V-225296:def:1
  • Title: The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
• oval:simp.disa.V-225297:def:1
  • Title: The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
• oval:simp.disa.V-225298:def:1
  • Title: The system must be configured to audit System - IPsec Driver successes.
• oval:simp.disa.V-225299:def:1
  • Title: The system must be configured to audit System - IPsec Driver failures.
• oval:simp.disa.V-225300:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit System - Other System Events successes.
• oval:simp.disa.V-225301:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit System - Other System Events failures.
• oval:simp.disa.V-225302:def:1
  • Title: The system must be configured to audit System - Security State Change successes.
• oval:simp.disa.V-225303:def:1
  • Title: The system must be configured to audit System - Security System Extension successes.
• oval:simp.disa.V-225304:def:1
  • Title: The system must be configured to audit System - System Integrity successes.
• oval:simp.disa.V-225305:def:1
  • Title: The system must be configured to audit System - System Integrity failures.
• oval:simp.disa.V-225313:def:1
  • Title: Event Viewer must be protected from unauthorized modification and deletion.
• oval:simp.disa.V-225314:def:1
  • Title: The Mapper I/O network protocol (LLTDIO) driver must be disabled.
• oval:simp.disa.V-225315:def:1
  • Title: The Responder network protocol driver must be disabled.
• oval:simp.disa.V-225316:def:1
  • Title: Windows Peer-to-Peer networking services must be turned off.
• oval:simp.disa.V-225317:def:1
  • Title: Network Bridges must be prohibited in Windows.
• oval:simp.disa.V-225318:def:1
  • Title: Domain users must be required to elevate when setting a networks location.
• oval:simp.disa.V-225319:def:1
  • Title: All Direct Access traffic must be routed through the internal network.
• oval:simp.disa.V-225320:def:1
  • Title: The 6to4 IPv6 transition technology must be disabled.
• oval:simp.disa.V-225321:def:1
  • Title: The IP-HTTPS IPv6 transition technology must be disabled.
• oval:simp.disa.V-225322:def:1
  • Title: The ISATAP IPv6 transition technology must be disabled.
• oval:simp.disa.V-225323:def:1
  • Title: The Teredo IPv6 transition technology must be disabled.
• oval:simp.disa.V-225324:def:1
  • Title: IP stateless autoconfiguration limits state must be enabled.
• oval:simp.disa.V-225325:def:1
  • Title: The configuration of wireless devices using Windows Connect Now must be disabled.
• oval:simp.disa.V-225326:def:1
  • Title: The Windows Connect Now wizards must be disabled.
• oval:simp.disa.V-225327:def:1
  • Title: Windows Update must be prevented from searching for point and print drivers.
• oval:simp.disa.V-225328:def:1
  • Title: Optional component installation and component repair must be prevented from using Windows Update.
• oval:simp.disa.V-225329:def:1
  • Title: Remote access to the Plug and Play interface must be disabled for device installation.
• oval:simp.disa.V-225330:def:1
  • Title: An Error Report must not be sent when a generic device driver is installed.
• oval:simp.disa.V-225331:def:1
  • Title: A system restore point must be created when a new device driver is installed.
• oval:simp.disa.V-225332:def:1
  • Title: Device metadata retrieval from the Internet must be prevented.
• oval:simp.disa.V-225333:def:1
  • Title: Windows must be prevented from sending an error report when a device driver requests additional software during installation.
• oval:simp.disa.V-225334:def:1
  • Title: Device driver searches using Windows Update must be prevented.
• oval:simp.disa.V-225335:def:1
  • Title: Device driver updates must only search managed servers, not Windows Update.
• oval:simp.disa.V-225336:def:1
  • Title: Users must not be prompted to search Windows Update for device drivers.
• oval:simp.disa.V-225337:def:1
  • Title: Early Launch Antimalware, Boot-Start Driver Initialization Policy must be enabled and configured to only Good and Unknown.
• oval:simp.disa.V-225338:def:1
  • Title: Group Policy objects must be reprocessed even if they have not changed.
• oval:simp.disa.V-225339:def:1
  • Title: Group Policies must be refreshed in the background if the user is logged on.
• oval:simp.disa.V-225340:def:1
  • Title: Access to the Windows Store must be turned off.
• oval:simp.disa.V-225341:def:1
  • Title: Downloading print driver packages over HTTP must be prevented.
• oval:simp.disa.V-225342:def:1
  • Title: Event Viewer Events.asp links must be turned off.
• oval:simp.disa.V-225343:def:1
  • Title: Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.
• oval:simp.disa.V-225344:def:1
  • Title: The Internet File Association service must be turned off.
• oval:simp.disa.V-225345:def:1
  • Title: Printing over HTTP must be prevented.
• oval:simp.disa.V-225346:def:1
  • Title: The Windows Customer Experience Improvement Program must be disabled.
• oval:simp.disa.V-225347:def:1
  • Title: Windows must be prevented from using Windows Update to search for drivers.
• oval:simp.disa.V-225348:def:1
  • Title: Copying of user input methods to the system account for sign-in must be prevented.
• oval:simp.disa.V-225349:def:1
  • Title: Local users on domain-joined computers must not be enumerated.
• oval:simp.disa.V-225350:def:1
  • Title: App notifications on the lock screen must be turned off.
• oval:simp.disa.V-225351:def:1
  • Title: Users must be prompted to authenticate on resume from sleep (on battery).
• oval:simp.disa.V-225352:def:1
  • Title: The user must be prompted to authenticate on resume from sleep (plugged in).
• oval:simp.disa.V-225353:def:1
  • Title: The system must be configured to prevent unsolicited remote assistance offers.
• oval:simp.disa.V-225354:def:1
  • Title: Solicited Remote Assistance must not be allowed.
• oval:simp.disa.V-225355:def:1
  • Title: Remote Assistance log files must be generated.
• oval:simp.disa.V-225356:def:1
  • Title: Unauthenticated RPC clients must be restricted from connecting to the RPC server.
• oval:simp.disa.V-225357:def:1
  • Title: The detection of compatibility issues for applications and drivers must be turned off.
• oval:simp.disa.V-225358:def:1
  • Title: Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.
• oval:simp.disa.V-225359:def:1
  • Title: Access to Windows Online Troubleshooting Service (WOTS) must be prevented.
• oval:simp.disa.V-225360:def:1
  • Title: Responsiveness events must be prevented from being aggregated and sent to Microsoft.
• oval:simp.disa.V-225362:def:1
  • Title: Trusted app installation must be enabled to allow for signed enterprise line of business apps.
• oval:simp.disa.V-225363:def:1
  • Title: The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
• oval:simp.disa.V-225364:def:1
  • Title: Autoplay must be turned off for non-volume devices.
• oval:simp.disa.V-225365:def:1
  • Title: The default Autorun behavior must be configured to prevent Autorun commands.
• oval:simp.disa.V-225366:def:1
  • Title: Autoplay must be disabled for all drives.
• oval:simp.disa.V-225367:def:1
  • Title: The use of biometrics must be disabled.
• oval:simp.disa.V-225368:def:1
  • Title: The password reveal button must not be displayed.
• oval:simp.disa.V-225369:def:1
  • Title: Administrator accounts must not be enumerated during elevation.
• oval:simp.disa.V-225370:def:1
  • Title: The Application event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-225371:def:1
  • Title: The Security event log size must be configured to 196608 KB or greater.
• oval:simp.disa.V-225372:def:1
  • Title: The Setup event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-225373:def:1
  • Title: The System event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-225374:def:1
  • Title: Windows SmartScreen must be enabled on Windows 2012/2012 R2.
• oval:simp.disa.V-225375:def:1
  • Title: Explorer Data Execution Prevention must be enabled.
• oval:simp.disa.V-225376:def:1
  • Title: Turning off File Explorer heap termination on corruption must be disabled.
• oval:simp.disa.V-225377:def:1
  • Title: File Explorer shell protocol must run in protected mode.
• oval:simp.disa.V-225378:def:1
  • Title: The location feature must be turned off.
• oval:simp.disa.V-225379:def:1
  • Title: Passwords must not be saved in the Remote Desktop Client.
• oval:simp.disa.V-225380:def:1
  • Title: Local drives must be prevented from sharing with Remote Desktop Session Hosts. (Remote Desktop Services Role).
• oval:simp.disa.V-225381:def:1
  • Title: Remote Desktop Services must always prompt a client for passwords upon connection.
• oval:simp.disa.V-225382:def:1
  • Title: Remote Desktop Services must be configured with the client connection encryption set to the required level.
• oval:simp.disa.V-225383:def:1
  • Title: Remote Desktop Services must delete temporary folders when a session is terminated.
• oval:simp.disa.V-225384:def:1
  • Title: Remote Desktop Services must be configured to use session-specific temporary folders.
• oval:simp.disa.V-225385:def:1
  • Title: Attachments must be prevented from being downloaded from RSS feeds.
• oval:simp.disa.V-225386:def:1
  • Title: Basic authentication for RSS feeds over HTTP must be turned off.
• oval:simp.disa.V-225389:def:1
  • Title: Users must be prevented from changing installation options.
• oval:simp.disa.V-225390:def:1
  • Title: The Windows Installer Always install with elevated privileges option must be disabled.
• oval:simp.disa.V-225391:def:1
  • Title: Users must be notified if a web-based program attempts to install software.
• oval:simp.disa.V-225392:def:1
  • Title: Nonadministrators must be prevented from applying vendor-signed updates.
• oval:simp.disa.V-225393:def:1
  • Title: Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.
• oval:simp.disa.V-225394:def:1
  • Title: Users must not be presented with Privacy and Installation options on first use of Windows Media Player.
• oval:simp.disa.V-225395:def:1
  • Title: Windows Media Player must be configured to prevent automatic checking for updates.
• oval:simp.disa.V-225396:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Basic authentication.
• oval:simp.disa.V-225397:def:1
  • Title: The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
• oval:simp.disa.V-225398:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Digest authentication.
• oval:simp.disa.V-225399:def:1
  • Title: The Windows Remote Management (WinRM) service must not use Basic authentication.
• oval:simp.disa.V-225400:def:1
  • Title: The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
• oval:simp.disa.V-225401:def:1
  • Title: The Windows Remote Management (WinRM) service must not store RunAs credentials.
• oval:simp.disa.V-225402:def:1
  • Title: The Remote Desktop Session Host must require secure RPC communications.
• oval:simp.disa.V-225404:def:1
  • Title: Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).
• oval:simp.disa.V-225405:def:1
  • Title: Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).
• oval:simp.disa.V-225406:def:1
  • Title: The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).
• oval:simp.disa.V-225407:def:1
  • Title: Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).
• oval:simp.disa.V-225410:def:1
  • Title: Windows 2012 R2 must include command line data in process creation events.
• oval:simp.disa.V-225445:def:1
  • Title: Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-225446:def:1
  • Title: Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
• oval:simp.disa.V-225447:def:1
  • Title: Anonymous access to the registry must be restricted.
• oval:simp.disa.V-225448:def:1
  • Title: The built-in guest account must be disabled.
• oval:simp.disa.V-225449:def:1
  • Title: Local accounts with blank passwords must be restricted to prevent access from the network.
• oval:simp.disa.V-225450:def:1
  • Title: The built-in administrator account must be renamed.
• oval:simp.disa.V-225451:def:1
  • Title: The built-in guest account must be renamed.
• oval:simp.disa.V-225452:def:1
  • Title: Auditing the Access of Global System Objects must be turned off.
• oval:simp.disa.V-225453:def:1
  • Title: Auditing of Backup and Restore Privileges must be turned off.
• oval:simp.disa.V-225454:def:1
  • Title: Audit policy using subcategories must be enabled.
• oval:simp.disa.V-225455:def:1
  • Title: Ejection of removable NTFS media must be restricted to Administrators.
• oval:simp.disa.V-225456:def:1
  • Title: Outgoing secure channel traffic must be encrypted or signed.
• oval:simp.disa.V-225457:def:1
  • Title: Outgoing secure channel traffic must be encrypted when possible.
• oval:simp.disa.V-225458:def:1
  • Title: Outgoing secure channel traffic must be signed when possible.
• oval:simp.disa.V-225459:def:1
  • Title: The computer account password must not be prevented from being reset.
• oval:simp.disa.V-225460:def:1
  • Title: The maximum age for machine account passwords must be set to requirements.
• oval:simp.disa.V-225461:def:1
  • Title: The system must be configured to require a strong session key.
• oval:simp.disa.V-225462:def:1
  • Title: The system must be configured to prevent the display of the last username on the logon screen.
• oval:simp.disa.V-225463:def:1
  • Title: The Ctrl+Alt+Del security attention sequence for logons must be enabled.
• oval:simp.disa.V-225464:def:1
  • Title: The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
• oval:simp.disa.V-225467:def:1
  • Title: Caching of logon credentials must be limited.
• oval:simp.disa.V-225468:def:1
  • Title: Users must be warned in advance of their passwords expiring.
• oval:simp.disa.V-225469:def:1
  • Title: The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
• oval:simp.disa.V-225470:def:1
  • Title: The Windows SMB client must be configured to always perform SMB packet signing.
• oval:simp.disa.V-225471:def:1
  • Title: The Windows SMB client must be enabled to perform SMB packet signing when possible.
• oval:simp.disa.V-225472:def:1
  • Title: Unencrypted passwords must not be sent to third-party SMB Servers.
• oval:simp.disa.V-225473:def:1
  • Title: The amount of idle time required before suspending a session must be properly set.
• oval:simp.disa.V-225474:def:1
  • Title: The Windows SMB server must be configured to always perform SMB packet signing.
• oval:simp.disa.V-225475:def:1
  • Title: The Windows SMB server must perform SMB packet signing when possible.
• oval:simp.disa.V-225476:def:1
  • Title: Users must be forcibly disconnected when their logon hours expire.
• oval:simp.disa.V-225477:def:1
  • Title: The service principal name (SPN) target name validation level must be turned off.
• oval:simp.disa.V-225478:def:1
  • Title: Automatic logons must be disabled.
• oval:simp.disa.V-225479:def:1
  • Title: IPv6 source routing must be configured to the highest protection level.
• oval:simp.disa.V-225480:def:1
  • Title: The system must be configured to prevent IP source routing.
• oval:simp.disa.V-225481:def:1
  • Title: The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
• oval:simp.disa.V-225482:def:1
  • Title: The system must be configured to limit how often keep-alive packets are sent.
• oval:simp.disa.V-225483:def:1
  • Title: IPSec Exemptions must be limited.
• oval:simp.disa.V-225484:def:1
  • Title: The system must be configured to ignore NetBIOS name release requests except from WINS servers.
• oval:simp.disa.V-225485:def:1
  • Title: The system must be configured to disable the Internet Router Discovery Protocol (IRDP).
• oval:simp.disa.V-225486:def:1
  • Title: The system must be configured to use Safe DLL Search Mode.
• oval:simp.disa.V-225487:def:1
  • Title: The system must be configured to have password protection take effect within a limited time frame when the screen saver becomes active.
• oval:simp.disa.V-225488:def:1
  • Title: IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.
• oval:simp.disa.V-225489:def:1
  • Title: The system must limit how many times unacknowledged TCP data is retransmitted.
• oval:simp.disa.V-225490:def:1
  • Title: The system must generate an audit event when the audit log reaches a percentage of full threshold.
• oval:simp.disa.V-225492:def:1
  • Title: Anonymous enumeration of SAM accounts must not be allowed.
• oval:simp.disa.V-225493:def:1
  • Title: Anonymous enumeration of shares must be restricted.
• oval:simp.disa.V-225494:def:1
  • Title: The system must be configured to prevent anonymous users from having the same rights as the Everyone group.
• oval:simp.disa.V-225495:def:1
  • Title: Named pipes that can be accessed anonymously must be configured to contain no values on member servers.
• oval:simp.disa.V-225496:def:1
  • Title: Unauthorized remotely accessible registry paths must not be configured.
• oval:simp.disa.V-225497:def:1
  • Title: Unauthorized remotely accessible registry paths and sub-paths must not be configured.
• oval:simp.disa.V-225498:def:1
  • Title: Anonymous access to Named Pipes and Shares must be restricted.
• oval:simp.disa.V-225499:def:1
  • Title: Network shares that can be accessed anonymously must not be allowed.
• oval:simp.disa.V-225500:def:1
  • Title: The system must be configured to use the Classic security model.
• oval:simp.disa.V-225501:def:1
  • Title: Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.
• oval:simp.disa.V-225502:def:1
  • Title: NTLM must be prevented from falling back to a Null session.
• oval:simp.disa.V-225503:def:1
  • Title: PKU2U authentication using online identities must be prevented.
• oval:simp.disa.V-225504:def:1
  • Title: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
• oval:simp.disa.V-225505:def:1
  • Title: The system must be configured to prevent the storage of the LAN Manager hash of passwords.
• oval:simp.disa.V-225506:def:1
  • Title: The system must be configured to force users to log off when their allowed logon hours expire.
• oval:simp.disa.V-225507:def:1
  • Title: The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
• oval:simp.disa.V-225508:def:1
  • Title: The system must be configured to the required LDAP client signing level.
• oval:simp.disa.V-225509:def:1
  • Title: The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.
• oval:simp.disa.V-225510:def:1
  • Title: The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.
• oval:simp.disa.V-225511:def:1
  • Title: The shutdown option must not be available from the logon dialog box.
• oval:simp.disa.V-225513:def:1
  • Title: The system must be configured to require case insensitivity for non-Windows subsystems.
• oval:simp.disa.V-225514:def:1
  • Title: The default permissions of global system objects must be increased.
• oval:simp.disa.V-225515:def:1
  • Title: User Account Control approval mode for the built-in Administrator must be enabled.
• oval:simp.disa.V-225516:def:1
  • Title: User Account Control must, at minimum, prompt administrators for consent.
• oval:simp.disa.V-225517:def:1
  • Title: User Account Control must automatically deny standard user requests for elevation.
• oval:simp.disa.V-225518:def:1
  • Title: User Account Control must be configured to detect application installations and prompt for elevation.
• oval:simp.disa.V-225519:def:1
  • Title: Windows must elevate all applications in User Account Control, not just signed ones.
• oval:simp.disa.V-225520:def:1
  • Title: User Account Control must only elevate UIAccess applications that are installed in secure locations.
• oval:simp.disa.V-225521:def:1
  • Title: User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
• oval:simp.disa.V-225522:def:1
  • Title: User Account Control must switch to the secure desktop when prompting for elevation.
• oval:simp.disa.V-225523:def:1
  • Title: User Account Control must virtualize file and registry write failures to per-user locations.
• oval:simp.disa.V-225524:def:1
  • Title: UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
• oval:simp.disa.V-225525:def:1
  • Title: Optional Subsystems must not be permitted to operate on the system.
• oval:simp.disa.V-225526:def:1
  • Title: The print driver installation privilege must be restricted to administrators.
• oval:simp.disa.V-225527:def:1
  • Title: Users must be required to enter a password to access private keys stored on the computer.
• oval:simp.disa.V-225528:def:1
  • Title: The Fax service must be disabled if installed.
• oval:simp.disa.V-225529:def:1
  • Title: The Microsoft FTP service must not be installed unless required.
• oval:simp.disa.V-225530:def:1
  • Title: The Peer Networking Identity Manager service must be disabled if installed.
• oval:simp.disa.V-225531:def:1
  • Title: The Simple TCP/IP Services service must be disabled if installed.
• oval:simp.disa.V-225532:def:1
  • Title: The Telnet service must be disabled if installed.
• oval:simp.disa.V-225533:def:1
  • Title: The Smart Card Removal Policy service must be configured to automatic.
• oval:simp.disa.V-225545:def:1
  • Title: The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225546:def:1
  • Title: The Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on member servers.
• oval:simp.disa.V-225547:def:1
  • Title: The Act as part of the operating system user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225548:def:1
  • Title: The Allow log on locally user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225549:def:1
  • Title: The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group and other approved groups.
• oval:simp.disa.V-225550:def:1
  • Title: The Back up files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225551:def:1
  • Title: The Create a pagefile user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225552:def:1
  • Title: The Create a token object user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225553:def:1
  • Title: The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-225554:def:1
  • Title: The Create permanent shared objects user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225555:def:1
  • Title: The Create symbolic links user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225556:def:1
  • Title: The Debug programs user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225557:def:1
  • Title: The Deny access to this computer from the network user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems, and from unauthenticated access on all systems.
• oval:simp.disa.V-225558:def:1
  • Title: The Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.
• oval:simp.disa.V-225559:def:1
  • Title: The Deny log on as a service user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.
• oval:simp.disa.V-225560:def:1
  • Title: The Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.
• oval:simp.disa.V-225561:def:1
  • Title: The Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems, and from unauthenticated access on all systems.
• oval:simp.disa.V-225562:def:1
  • Title: Unauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on member servers.
• oval:simp.disa.V-225563:def:1
  • Title: The Force shutdown from a remote system user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225564:def:1
  • Title: The Generate security audits user right must only be assigned to Local Service and Network Service.
• oval:simp.disa.V-225565:def:1
  • Title: The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-225566:def:1
  • Title: The Increase scheduling priority user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225567:def:1
  • Title: The Load and unload device drivers user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225568:def:1
  • Title: The Lock pages in memory user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-225569:def:1
  • Title: The Manage auditing and security log user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225570:def:1
  • Title: The Modify firmware environment values user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225571:def:1
  • Title: The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225572:def:1
  • Title: The Profile single process user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225573:def:1
  • Title: The Restore files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-225574:def:1
  • Title: The Take ownership of files or other objects user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226049:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.
• oval:simp.disa.V-226050:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
• oval:simp.disa.V-226051:def:1
  • Title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
• oval:simp.disa.V-226055:def:1
  • Title: Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.
• oval:simp.disa.V-226056:def:1
  • Title: Windows 2012 account lockout duration must be configured to 15 minutes or greater.
• oval:simp.disa.V-226057:def:1
  • Title: The number of allowed bad logon attempts must meet minimum requirements.
• oval:simp.disa.V-226058:def:1
  • Title: The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2012.
• oval:simp.disa.V-226059:def:1
  • Title: The password history must be configured to 24 passwords remembered.
• oval:simp.disa.V-226060:def:1
  • Title: The maximum password age must meet requirements.
• oval:simp.disa.V-226061:def:1
  • Title: The minimum password age must meet requirements.
• oval:simp.disa.V-226062:def:1
  • Title: Passwords must, at a minimum, be 14 characters.
• oval:simp.disa.V-226063:def:1
  • Title: The built-in Windows password complexity policy must be enabled.
• oval:simp.disa.V-226064:def:1
  • Title: Reversible password encryption must be disabled.
• oval:simp.disa.V-226085:def:1
  • Title: The system must be configured to audit Account Logon - Credential Validation successes.
• oval:simp.disa.V-226086:def:1
  • Title: The system must be configured to audit Account Logon - Credential Validation failures.
• oval:simp.disa.V-226087:def:1
  • Title: Windows Server 2012/2012 R2 domain controllers must be configured to audit Account Management - Computer Account Management successes.
• oval:simp.disa.V-226088:def:1
  • Title: The system must be configured to audit Account Management - Other Account Management Events successes.
• oval:simp.disa.V-226089:def:1
  • Title: The system must be configured to audit Account Management - Security Group Management successes.
• oval:simp.disa.V-226090:def:1
  • Title: The system must be configured to audit Account Management - User Account Management successes.
• oval:simp.disa.V-226091:def:1
  • Title: The system must be configured to audit Account Management - User Account Management failures.
• oval:simp.disa.V-226092:def:1
  • Title: The system must be configured to audit Detailed Tracking - Process Creation successes.
• oval:simp.disa.V-226093:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout successes.
• oval:simp.disa.V-226094:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures.
• oval:simp.disa.V-226095:def:1
  • Title: The system must be configured to audit DS Access - Directory Service Access successes.
• oval:simp.disa.V-226096:def:1
  • Title: The system must be configured to audit DS Access - Directory Service Access failures.
• oval:simp.disa.V-226097:def:1
  • Title: The system must be configured to audit DS Access - Directory Service Changes successes.
• oval:simp.disa.V-226098:def:1
  • Title: The system must be configured to audit DS Access - Directory Service Changes failures.
• oval:simp.disa.V-226099:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logoff successes.
• oval:simp.disa.V-226100:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logon successes.
• oval:simp.disa.V-226101:def:1
  • Title: The system must be configured to audit Logon/Logoff - Logon failures.
• oval:simp.disa.V-226102:def:1
  • Title: The system must be configured to audit Logon/Logoff - Special Logon successes.
• oval:simp.disa.V-226107:def:1
  • Title: The system must be configured to audit Policy Change - Audit Policy Change successes.
• oval:simp.disa.V-226108:def:1
  • Title: The system must be configured to audit Policy Change - Audit Policy Change failures.
• oval:simp.disa.V-226109:def:1
  • Title: The system must be configured to audit Policy Change - Authentication Policy Change successes.
• oval:simp.disa.V-226110:def:1
  • Title: The system must be configured to audit Policy Change - Authorization Policy Change successes.
• oval:simp.disa.V-226111:def:1
  • Title: The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
• oval:simp.disa.V-226112:def:1
  • Title: The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
• oval:simp.disa.V-226113:def:1
  • Title: The system must be configured to audit System - IPsec Driver successes.
• oval:simp.disa.V-226114:def:1
  • Title: The system must be configured to audit System - IPsec Driver failures.
• oval:simp.disa.V-226115:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit System - Other System Events successes.
• oval:simp.disa.V-226116:def:1
  • Title: Windows Server 2012/2012 R2 must be configured to audit System - Other System Events failures.
• oval:simp.disa.V-226117:def:1
  • Title: The system must be configured to audit System - Security State Change successes.
• oval:simp.disa.V-226118:def:1
  • Title: The system must be configured to audit System - Security System Extension successes.
• oval:simp.disa.V-226119:def:1
  • Title: The system must be configured to audit System - System Integrity successes.
• oval:simp.disa.V-226120:def:1
  • Title: The system must be configured to audit System - System Integrity failures.
• oval:simp.disa.V-226134:def:1
  • Title: Event Viewer must be protected from unauthorized modification and deletion.
• oval:simp.disa.V-226135:def:1
  • Title: The Mapper I/O network protocol (LLTDIO) driver must be disabled.
• oval:simp.disa.V-226136:def:1
  • Title: The Responder network protocol driver must be disabled.
• oval:simp.disa.V-226137:def:1
  • Title: Windows Peer-to-Peer networking services must be turned off.
• oval:simp.disa.V-226138:def:1
  • Title: Network Bridges must be prohibited in Windows.
• oval:simp.disa.V-226139:def:1
  • Title: Domain users must be required to elevate when setting a networks location.
• oval:simp.disa.V-226140:def:1
  • Title: All Direct Access traffic must be routed through the internal network.
• oval:simp.disa.V-226141:def:1
  • Title: The 6to4 IPv6 transition technology must be disabled.
• oval:simp.disa.V-226142:def:1
  • Title: The IP-HTTPS IPv6 transition technology must be disabled.
• oval:simp.disa.V-226143:def:1
  • Title: The ISATAP IPv6 transition technology must be disabled.
• oval:simp.disa.V-226144:def:1
  • Title: The Teredo IPv6 transition technology must be disabled.
• oval:simp.disa.V-226145:def:1
  • Title: IP stateless autoconfiguration limits state must be enabled.
• oval:simp.disa.V-226146:def:1
  • Title: The configuration of wireless devices using Windows Connect Now must be disabled.
• oval:simp.disa.V-226147:def:1
  • Title: The Windows Connect Now wizards must be disabled.
• oval:simp.disa.V-226148:def:1
  • Title: Windows Update must be prevented from searching for point and print drivers.
• oval:simp.disa.V-226149:def:1
  • Title: Optional component installation and component repair must be prevented from using Windows Update.
• oval:simp.disa.V-226150:def:1
  • Title: Remote access to the Plug and Play interface must be disabled for device installation.
• oval:simp.disa.V-226151:def:1
  • Title: An Error Report must not be sent when a generic device driver is installed.
• oval:simp.disa.V-226152:def:1
  • Title: A system restore point must be created when a new device driver is installed.
• oval:simp.disa.V-226153:def:1
  • Title: Device metadata retrieval from the Internet must be prevented.
• oval:simp.disa.V-226154:def:1
  • Title: Windows must be prevented from sending an error report when a device driver requests additional software during installation.
• oval:simp.disa.V-226155:def:1
  • Title: Device driver searches using Windows Update must be prevented.
• oval:simp.disa.V-226156:def:1
  • Title: Device driver updates must only search managed servers, not Windows Update.
• oval:simp.disa.V-226157:def:1
  • Title: Users must not be prompted to search Windows Update for device drivers.
• oval:simp.disa.V-226158:def:1
  • Title: Early Launch Antimalware, Boot-Start Driver Initialization Policy must be enabled and configured to only Good and Unknown.
• oval:simp.disa.V-226159:def:1
  • Title: Group Policy objects must be reprocessed even if they have not changed.
• oval:simp.disa.V-226160:def:1
  • Title: Group Policies must be refreshed in the background if the user is logged on.
• oval:simp.disa.V-226161:def:1
  • Title: Access to the Windows Store must be turned off.
• oval:simp.disa.V-226162:def:1
  • Title: Downloading print driver packages over HTTP must be prevented.
• oval:simp.disa.V-226163:def:1
  • Title: Event Viewer Events.asp links must be turned off.
• oval:simp.disa.V-226164:def:1
  • Title: Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.
• oval:simp.disa.V-226165:def:1
  • Title: The Internet File Association service must be turned off.
• oval:simp.disa.V-226166:def:1
  • Title: Printing over HTTP must be prevented.
• oval:simp.disa.V-226167:def:1
  • Title: The Windows Customer Experience Improvement Program must be disabled.
• oval:simp.disa.V-226168:def:1
  • Title: Windows must be prevented from using Windows Update to search for drivers.
• oval:simp.disa.V-226169:def:1
  • Title: Copying of user input methods to the system account for sign-in must be prevented.
• oval:simp.disa.V-226170:def:1
  • Title: Local users on domain-joined computers must not be enumerated.
• oval:simp.disa.V-226171:def:1
  • Title: App notifications on the lock screen must be turned off.
• oval:simp.disa.V-226172:def:1
  • Title: Users must be prompted to authenticate on resume from sleep (on battery).
• oval:simp.disa.V-226173:def:1
  • Title: The user must be prompted to authenticate on resume from sleep (plugged in).
• oval:simp.disa.V-226174:def:1
  • Title: The system must be configured to prevent unsolicited remote assistance offers.
• oval:simp.disa.V-226175:def:1
  • Title: Solicited Remote Assistance must not be allowed.
• oval:simp.disa.V-226176:def:1
  • Title: Remote Assistance log files must be generated.
• oval:simp.disa.V-226177:def:1
  • Title: The detection of compatibility issues for applications and drivers must be turned off.
• oval:simp.disa.V-226178:def:1
  • Title: Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.
• oval:simp.disa.V-226179:def:1
  • Title: Access to Windows Online Troubleshooting Service (WOTS) must be prevented.
• oval:simp.disa.V-226180:def:1
  • Title: Responsiveness events must be prevented from being aggregated and sent to Microsoft.
• oval:simp.disa.V-226182:def:1
  • Title: Trusted app installation must be enabled to allow for signed enterprise line of business apps.
• oval:simp.disa.V-226183:def:1
  • Title: The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
• oval:simp.disa.V-226184:def:1
  • Title: Autoplay must be turned off for non-volume devices.
• oval:simp.disa.V-226185:def:1
  • Title: The default Autorun behavior must be configured to prevent Autorun commands.
• oval:simp.disa.V-226186:def:1
  • Title: Autoplay must be disabled for all drives.
• oval:simp.disa.V-226187:def:1
  • Title: The use of biometrics must be disabled.
• oval:simp.disa.V-226188:def:1
  • Title: The password reveal button must not be displayed.
• oval:simp.disa.V-226189:def:1
  • Title: Administrator accounts must not be enumerated during elevation.
• oval:simp.disa.V-226190:def:1
  • Title: The Application event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-226191:def:1
  • Title: The Security event log size must be configured to 196608 KB or greater.
• oval:simp.disa.V-226192:def:1
  • Title: The Setup event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-226193:def:1
  • Title: The System event log size must be configured to 32768 KB or greater.
• oval:simp.disa.V-226194:def:1
  • Title: Windows SmartScreen must be enabled on Windows 2012/2012 R2.
• oval:simp.disa.V-226195:def:1
  • Title: Explorer Data Execution Prevention must be enabled.
• oval:simp.disa.V-226196:def:1
  • Title: Turning off File Explorer heap termination on corruption must be disabled.
• oval:simp.disa.V-226197:def:1
  • Title: File Explorer shell protocol must run in protected mode.
• oval:simp.disa.V-226198:def:1
  • Title: The location feature must be turned off.
• oval:simp.disa.V-226199:def:1
  • Title: Passwords must not be saved in the Remote Desktop Client.
• oval:simp.disa.V-226200:def:1
  • Title: Local drives must be prevented from sharing with Remote Desktop Session Hosts. (Remote Desktop Services Role).
• oval:simp.disa.V-226201:def:1
  • Title: Remote Desktop Services must always prompt a client for passwords upon connection.
• oval:simp.disa.V-226202:def:1
  • Title: Remote Desktop Services must be configured with the client connection encryption set to the required level.
• oval:simp.disa.V-226203:def:1
  • Title: Remote Desktop Services must delete temporary folders when a session is terminated.
• oval:simp.disa.V-226204:def:1
  • Title: Remote Desktop Services must be configured to use session-specific temporary folders.
• oval:simp.disa.V-226205:def:1
  • Title: Attachments must be prevented from being downloaded from RSS feeds.
• oval:simp.disa.V-226206:def:1
  • Title: Basic authentication for RSS feeds over HTTP must be turned off.
• oval:simp.disa.V-226209:def:1
  • Title: Users must be prevented from changing installation options.
• oval:simp.disa.V-226210:def:1
  • Title: The Windows Installer Always install with elevated privileges option must be disabled.
• oval:simp.disa.V-226211:def:1
  • Title: Users must be notified if a web-based program attempts to install software.
• oval:simp.disa.V-226212:def:1
  • Title: Nonadministrators must be prevented from applying vendor-signed updates.
• oval:simp.disa.V-226213:def:1
  • Title: Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.
• oval:simp.disa.V-226214:def:1
  • Title: Users must not be presented with Privacy and Installation options on first use of Windows Media Player.
• oval:simp.disa.V-226215:def:1
  • Title: Windows Media Player must be configured to prevent automatic checking for updates.
• oval:simp.disa.V-226216:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Basic authentication.
• oval:simp.disa.V-226217:def:1
  • Title: The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
• oval:simp.disa.V-226218:def:1
  • Title: The Windows Remote Management (WinRM) client must not use Digest authentication.
• oval:simp.disa.V-226219:def:1
  • Title: The Windows Remote Management (WinRM) service must not use Basic authentication.
• oval:simp.disa.V-226220:def:1
  • Title: The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
• oval:simp.disa.V-226221:def:1
  • Title: The Windows Remote Management (WinRM) service must not store RunAs credentials.
• oval:simp.disa.V-226222:def:1
  • Title: The Remote Desktop Session Host must require secure RPC communications.
• oval:simp.disa.V-226224:def:1
  • Title: Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).
• oval:simp.disa.V-226225:def:1
  • Title: Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).
• oval:simp.disa.V-226226:def:1
  • Title: The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).
• oval:simp.disa.V-226227:def:1
  • Title: Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).
• oval:simp.disa.V-226230:def:1
  • Title: Windows 2012 R2 must include command line data in process creation events.
• oval:simp.disa.V-226269:def:1
  • Title: Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
  • NOTE: Discussing the best approach to enforcement.
• oval:simp.disa.V-226270:def:1
  • Title: Anonymous access to the registry must be restricted.
• oval:simp.disa.V-226271:def:1
  • Title: The built-in guest account must be disabled.
• oval:simp.disa.V-226272:def:1
  • Title: Local accounts with blank passwords must be restricted to prevent access from the network.
• oval:simp.disa.V-226273:def:1
  • Title: The built-in administrator account must be renamed.
• oval:simp.disa.V-226274:def:1
  • Title: The built-in guest account must be renamed.
• oval:simp.disa.V-226275:def:1
  • Title: Auditing the Access of Global System Objects must be turned off.
• oval:simp.disa.V-226276:def:1
  • Title: Auditing of Backup and Restore Privileges must be turned off.
• oval:simp.disa.V-226277:def:1
  • Title: Audit policy using subcategories must be enabled.
• oval:simp.disa.V-226278:def:1
  • Title: Ejection of removable NTFS media must be restricted to Administrators.
• oval:simp.disa.V-226279:def:1
  • Title: Outgoing secure channel traffic must be encrypted or signed.
• oval:simp.disa.V-226280:def:1
  • Title: Outgoing secure channel traffic must be encrypted when possible.
• oval:simp.disa.V-226281:def:1
  • Title: Outgoing secure channel traffic must be signed when possible.
• oval:simp.disa.V-226282:def:1
  • Title: The computer account password must not be prevented from being reset.
• oval:simp.disa.V-226283:def:1
  • Title: The maximum age for machine account passwords must be set to requirements.
• oval:simp.disa.V-226284:def:1
  • Title: The system must be configured to require a strong session key.
• oval:simp.disa.V-226285:def:1
  • Title: The system must be configured to prevent the display of the last username on the logon screen.
• oval:simp.disa.V-226286:def:1
  • Title: The Ctrl+Alt+Del security attention sequence for logons must be enabled.
• oval:simp.disa.V-226287:def:1
  • Title: The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
• oval:simp.disa.V-226290:def:1
  • Title: Caching of logon credentials must be limited.
• oval:simp.disa.V-226291:def:1
  • Title: Users must be warned in advance of their passwords expiring.
• oval:simp.disa.V-226292:def:1
  • Title: The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
• oval:simp.disa.V-226293:def:1
  • Title: The Windows SMB client must be configured to always perform SMB packet signing.
• oval:simp.disa.V-226294:def:1
  • Title: The Windows SMB client must be enabled to perform SMB packet signing when possible.
• oval:simp.disa.V-226295:def:1
  • Title: Unencrypted passwords must not be sent to third-party SMB Servers.
• oval:simp.disa.V-226296:def:1
  • Title: The amount of idle time required before suspending a session must be properly set.
• oval:simp.disa.V-226297:def:1
  • Title: The Windows SMB server must be configured to always perform SMB packet signing.
• oval:simp.disa.V-226298:def:1
  • Title: The Windows SMB server must perform SMB packet signing when possible.
• oval:simp.disa.V-226299:def:1
  • Title: Users must be forcibly disconnected when their logon hours expire.
• oval:simp.disa.V-226300:def:1
  • Title: The service principal name (SPN) target name validation level must be turned off.
• oval:simp.disa.V-226301:def:1
  • Title: Automatic logons must be disabled.
• oval:simp.disa.V-226302:def:1
  • Title: IPv6 source routing must be configured to the highest protection level.
• oval:simp.disa.V-226303:def:1
  • Title: The system must be configured to prevent IP source routing.
• oval:simp.disa.V-226304:def:1
  • Title: The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
• oval:simp.disa.V-226305:def:1
  • Title: The system must be configured to limit how often keep-alive packets are sent.
• oval:simp.disa.V-226306:def:1
  • Title: IPSec Exemptions must be limited.
• oval:simp.disa.V-226307:def:1
  • Title: The system must be configured to ignore NetBIOS name release requests except from WINS servers.
• oval:simp.disa.V-226308:def:1
  • Title: The system must be configured to disable the Internet Router Discovery Protocol (IRDP).
• oval:simp.disa.V-226309:def:1
  • Title: The system must be configured to use Safe DLL Search Mode.
• oval:simp.disa.V-226310:def:1
  • Title: The system must be configured to have password protection take effect within a limited time frame when the screen saver becomes active.
• oval:simp.disa.V-226311:def:1
  • Title: IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.
• oval:simp.disa.V-226312:def:1
  • Title: The system must limit how many times unacknowledged TCP data is retransmitted.
• oval:simp.disa.V-226313:def:1
  • Title: The system must generate an audit event when the audit log reaches a percentage of full threshold.
• oval:simp.disa.V-226315:def:1
  • Title: Anonymous enumeration of SAM accounts must not be allowed.
• oval:simp.disa.V-226316:def:1
  • Title: Anonymous enumeration of shares must be restricted.
• oval:simp.disa.V-226317:def:1
  • Title: The system must be configured to prevent anonymous users from having the same rights as the Everyone group.
• oval:simp.disa.V-226318:def:1
  • Title: Named pipes that can be accessed anonymously must be configured with limited values on domain controllers.
• oval:simp.disa.V-226319:def:1
  • Title: Unauthorized remotely accessible registry paths must not be configured.
• oval:simp.disa.V-226320:def:1
  • Title: Unauthorized remotely accessible registry paths and sub-paths must not be configured.
• oval:simp.disa.V-226321:def:1
  • Title: Anonymous access to Named Pipes and Shares must be restricted.
• oval:simp.disa.V-226322:def:1
  • Title: Network shares that can be accessed anonymously must not be allowed.
• oval:simp.disa.V-226323:def:1
  • Title: The system must be configured to use the Classic security model.
• oval:simp.disa.V-226324:def:1
  • Title: Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.
• oval:simp.disa.V-226325:def:1
  • Title: NTLM must be prevented from falling back to a Null session.
• oval:simp.disa.V-226326:def:1
  • Title: PKU2U authentication using online identities must be prevented.
• oval:simp.disa.V-226327:def:1
  • Title: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
• oval:simp.disa.V-226328:def:1
  • Title: The system must be configured to prevent the storage of the LAN Manager hash of passwords.
• oval:simp.disa.V-226329:def:1
  • Title: The system must be configured to force users to log off when their allowed logon hours expire.
• oval:simp.disa.V-226330:def:1
  • Title: The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
• oval:simp.disa.V-226331:def:1
  • Title: The system must be configured to the required LDAP client signing level.
• oval:simp.disa.V-226332:def:1
  • Title: The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.
• oval:simp.disa.V-226333:def:1
  • Title: The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.
• oval:simp.disa.V-226334:def:1
  • Title: The shutdown option must not be available from the logon dialog box.
• oval:simp.disa.V-226336:def:1
  • Title: The system must be configured to require case insensitivity for non-Windows subsystems.
• oval:simp.disa.V-226337:def:1
  • Title: The default permissions of global system objects must be increased.
• oval:simp.disa.V-226338:def:1
  • Title: User Account Control approval mode for the built-in Administrator must be enabled.
• oval:simp.disa.V-226339:def:1
  • Title: User Account Control must, at minimum, prompt administrators for consent.
• oval:simp.disa.V-226340:def:1
  • Title: User Account Control must automatically deny standard user requests for elevation.
• oval:simp.disa.V-226341:def:1
  • Title: User Account Control must be configured to detect application installations and prompt for elevation.
• oval:simp.disa.V-226342:def:1
  • Title: Windows must elevate all applications in User Account Control, not just signed ones.
• oval:simp.disa.V-226343:def:1
  • Title: User Account Control must only elevate UIAccess applications that are installed in secure locations.
• oval:simp.disa.V-226344:def:1
  • Title: User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
• oval:simp.disa.V-226345:def:1
  • Title: User Account Control must switch to the secure desktop when prompting for elevation.
• oval:simp.disa.V-226346:def:1
  • Title: User Account Control must virtualize file and registry write failures to per-user locations.
• oval:simp.disa.V-226347:def:1
  • Title: UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.
• oval:simp.disa.V-226348:def:1
  • Title: Optional Subsystems must not be permitted to operate on the system.
• oval:simp.disa.V-226349:def:1
  • Title: The print driver installation privilege must be restricted to administrators.
• oval:simp.disa.V-226350:def:1
  • Title: Domain controllers must require LDAP access signing.
• oval:simp.disa.V-226351:def:1
  • Title: Domain controllers must be configured to allow reset of machine account passwords.
• oval:simp.disa.V-226352:def:1
  • Title: Users must be required to enter a password to access private keys stored on the computer.
• oval:simp.disa.V-226353:def:1
  • Title: The Fax service must be disabled if installed.
• oval:simp.disa.V-226354:def:1
  • Title: The Microsoft FTP service must not be installed unless required.
• oval:simp.disa.V-226355:def:1
  • Title: The Peer Networking Identity Manager service must be disabled if installed.
• oval:simp.disa.V-226356:def:1
  • Title: The Simple TCP/IP Services service must be disabled if installed.
• oval:simp.disa.V-226357:def:1
  • Title: The Telnet service must be disabled if installed.
• oval:simp.disa.V-226358:def:1
  • Title: The Smart Card Removal Policy service must be configured to automatic.
• oval:simp.disa.V-226370:def:1
  • Title: The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-226371:def:1
  • Title: Unauthorized accounts must not have the Access this computer from the network user right on domain controllers.
• oval:simp.disa.V-226372:def:1
  • Title: The Act as part of the operating system user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-226373:def:1
  • Title: The Allow log on locally user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226374:def:1
  • Title: The Back up files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226375:def:1
  • Title: The Create a pagefile user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226376:def:1
  • Title: The Create a token object user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-226377:def:1
  • Title: The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-226378:def:1
  • Title: The Create permanent shared objects user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-226379:def:1
  • Title: The Create symbolic links user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226380:def:1
  • Title: The Debug programs user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226381:def:1
  • Title: The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-226382:def:1
  • Title: The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-226383:def:1
  • Title: The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.
• oval:simp.disa.V-226384:def:1
  • Title: The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-226385:def:1
  • Title: The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
• oval:simp.disa.V-226386:def:1
  • Title: Unauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on domain controllers.
• oval:simp.disa.V-226387:def:1
  • Title: The Force shutdown from a remote system user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226388:def:1
  • Title: The Generate security audits user right must only be assigned to Local Service and Network Service.
• oval:simp.disa.V-226389:def:1
  • Title: The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
• oval:simp.disa.V-226390:def:1
  • Title: The Increase scheduling priority user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226391:def:1
  • Title: The Load and unload device drivers user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226392:def:1
  • Title: The Lock pages in memory user right must not be assigned to any groups or accounts.
• oval:simp.disa.V-226393:def:1
  • Title: The Manage auditing and security log user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226394:def:1
  • Title: The Modify firmware environment values user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226395:def:1
  • Title: The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226396:def:1
  • Title: The Profile single process user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226397:def:1
  • Title: The Restore files and directories user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226398:def:1
  • Title: The Take ownership of files or other objects user right must only be assigned to the Administrators group.
• oval:simp.disa.V-226399:def:1
  • Title: Unauthorized accounts must not have the Add workstations to domain user right.
• oval:simp.disa.V-226400:def:1
  • Title: The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.