1.1 (L1) Ensure 'Allow Cortana Above Lock' is set to 'Block'

800-53|CM-6

800-53|CM-7

CSCv7|16.11

3.1.3.1 (L1) Ensure 'Enable screen saver (User)' is set to 'Enabled'

800-53|AC-2(5)

800-53|AC-11

800-53|AC-11(1)

800-53|AC-12

3.1.3.2 (L1) Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'

3.1.3.3 (L1) Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled'

3.4.1 (L1) Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled'

800-53|AC-2(9)

CSCv7|4.3

3.4.2 (L1) Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'

CSCv7|9.2

CSCv7|14.3

3.4.3 (L1) Ensure 'Configure SMB v1 server' is set to 'Disabled'

3.4.4 (L1) Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled'

800-53|SI-16

CSCv7|8.3

3.4.5 (L1) Ensure 'WDigest Authentication' is set to 'Disabled'

800-53|IA-5(1)

800-53|SC-28

800-53|SC-28(1)

CSCv7|16.4

3.5.1 (L1) Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' is set to 'Disabled'

3.5.2 (L1) Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'

800-53|SC-7(12)

3.5.3 (L1) Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'

3.5.5 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'

800-53|CM-1

800-53|CM-2

800-53|CM-7(1)

800-53|CM-9

800-53|SA-3

800-53|SA-8

800-53|SA-10

3.5.7 (L1) Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'

800-53|AC-18

800-53|AC-18(1)

800-53|AC-18(3)

CSCv7|5.1

3.5.9 (L1) Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' is set to 'Enabled'

3.5.10 (L1) Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set to 'Enabled: 5 or fewer seconds'

3.5.13 (L1) Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less'

800-53|AU-4

CSCv7|6.3

CSCv7|6.4

3.6.4.1 (L1) Ensure 'Turn off multicast name resolution' is set to 'Enabled'

3.6.9.1 (L1) Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled'

CSCv7|11.3

3.6.9.2 (L1) Ensure 'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'

3.6.9.3 (L1) Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled'

3.6.11.1 (L1) Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication' and 'Require Integrity' set for all NETLOGON and SYSVOL shares'

800-53|IA-3(1)

3.6.18.1 (L1) Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet'

CSCv7|15.5

3.6.18.2 (L1) Ensure 'Prohibit connection to non-domain networks when connected to domain authenticated network' is set to 'Enabled'

800-53|SC-7

CSCv7|12.4

3.6.19.1 (L1) Ensure 'Require PIN pairing' is set to 'Enabled'

800-53|SC-15

3.7.1 (L1) Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled'

3.7.2 (L1) Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt'

800-53|AC-6(8)

3.7.3 (L1) Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt'

800-53|CM-6b.

3.9.1.1 (L1) Ensure 'Turn off toast notifications on the lock screen (User)' is set to 'Enabled'

3.10.4.1 (L1) Ensure 'Include command line in process creation events' is set to 'Enabled'

800-53|AU-2

3.10.5.1 (L1) Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients'

CSCv7|3.4

3.10.5.2 (L1) Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled'

800-53|IA-5

CSCv7|16.5

3.10.9.2 (L1) Ensure 'Prevent device metadata retrieval from the Internet' is set to 'Enabled'

800-53|CM-7(5)

800-53|CM-10

3.10.13.1 (L1) Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical'

3.10.19.1 (L1) Ensure 'Configure registry policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE'

CSCv7|5.4

3.10.19.2 (L1) Ensure 'Configure registry policy processing: Process even if the Group Policy objects have not changed' is set to 'Enabled: TRUE'

3.10.19.3 (L1) Ensure 'Configure security policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE'

3.10.19.4 (L1) Ensure 'Configure security policy processing: Process even if the Group Policy objects have not changed' is set to 'Enabled: TRUE'

3.10.19.5 (L1) Ensure 'Continue experiences on this device' is set to 'Disabled'

3.10.19.6 (L1) Ensure 'Turn off background refresh of Group Policy' is set to 'Disabled'

3.10.20.1.2 (L1) Ensure 'Turn off downloading of print drivers over HTTP' is set to 'Enabled'

CSCv7|2.7

3.10.20.1.5 (L1) Ensure 'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'

CSCv7|7.4

3.10.25.1 (L1) Ensure 'Block user from showing account details on sign-in' is set to 'Enabled'

3.10.25.2 (L1) Ensure 'Do not display network selection UI' is set to 'Enabled'

800-53|AC-6(10)

3.10.25.3 (L1) Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled'

3.10.25.4 (L1) Ensure 'Enumerate local users on domain-joined computers' is set to 'Disabled'

3.10.25.5 (L1) Ensure 'Turn off app notifications on the lock screen' is set to 'Enabled'

3.10.25.6 (L1) Ensure 'Turn off picture password sign-in' is set to 'Enabled'

3.10.25.7 (L1) Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled'

3.10.28.5.1 (L1) Ensure 'Allow network connectivity during connected-standby (on battery)' is set to 'Disabled'

800-53|SI-4

3.10.28.5.2 (L1) Ensure 'Allow network connectivity during connected-standby (plugged in)' is set to 'Disabled'

3.10.28.5.5 (L1) Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled'

3.10.28.5.6 (L1) Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled'

3.10.29.1 (L1) Ensure 'Configure Offer Remote Assistance' is set to 'Disabled'

3.10.29.2 (L1) Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled'

3.10.30.1 (L1) Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled'

3.10.30.2 (L1) Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated'

3.10.42.1.1 (L1) Ensure 'Enable Windows NTP Client' is set to 'Enabled'

800-53|AU-7

800-53|AU-8

CSCv7|6.1

3.10.42.1.2 (L1) Ensure 'Enable Windows NTP Server' is set to 'Disabled'

3.11.3.1 (L1) Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled'

800-53|AC-2(1)

CSCv7|16.2

3.11.5.1 (L1) Ensure 'Do not preserve zone information in file attachments (User)' is set to 'Disabled'

3.11.5.2 (L1) Ensure 'Notify antivirus programs when opening attachments (User)' is set to 'Enabled'

800-53|SI-3

CSCv7|8.1

3.11.6.1 (L1) Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'

800-53|MP-7

CSCv7|8.5

3.11.6.2 (L1) Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'

3.11.6.3 (L1) Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'

3.11.8.1 (L1) Ensure 'Do not display the password reveal button' is set to 'Enabled'

3.11.8.2 (L1) Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled'

3.11.8.3 (L1) Ensure 'Prevent the use of security questions for local accounts' is set to 'Enabled'

3.11.15.1.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

3.11.15.1.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

3.11.15.2.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

3.11.15.2.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater'

3.11.15.3.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

3.11.15.3.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

3.11.15.4.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

3.11.15.4.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

3.11.18.1 (L1) Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass'

3.11.18.2 (L1) Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled'

3.11.18.3 (L1) Ensure 'Turn off heap termination on corruption' is set to 'Disabled'

3.11.18.4 (L1) Ensure 'Turn off shell protocol protected mode' is set to 'Disabled'

3.11.20.1 (L1) Ensure 'Prevent the computer from joining a homegroup' is set to 'Enabled'

3.11.27.1 (L1) Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled'

CSCv7|16.8

3.11.28.3.1 (L1) Ensure 'Configure local setting override for reporting to Microsoft MAPS' is set to 'Disabled'

3.11.28.11 (L1) Ensure 'Turn off Microsoft Defender Antivirus' is set to 'Disabled'

3.11.31.1 (L1) Ensure 'Prevent users from sharing files within their profile. (User)' is set to 'Enabled'

800-53|AC-3

CSCv7|14.6

3.11.36.3.2 (L1) Ensure 'Do not allow passwords to be saved' is set to 'Enabled'

800-53|IA-5(13)

3.11.36.4.3.2 (L1) Ensure 'Do not allow drive redirection' is set to 'Enabled'

3.11.36.4.9.1 (L1) Ensure 'Always prompt for password upon connection' is set to 'Enabled'

3.11.36.4.9.2 (L1) Ensure 'Require secure RPC communication' is set to 'Enabled'

800-53|AC-17(2)

800-53|SC-8

800-53|SC-8(1)

3.11.36.4.9.3 (L1) Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL'

3.11.36.4.9.4 (L1) Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled'

3.11.36.4.9.5 (L1) Ensure 'Set client connection encryption level' is set to 'Enabled: High Level'

3.11.36.4.11.1 (L1) Ensure 'Do not delete temp folders upon exit' is set to 'Disabled'

800-53|AU-11

800-53|SI-12

3.11.37.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled'

800-53|CM-11

800-53|SC-18

CSCv7|7.2

3.11.42.1 (L1) Ensure 'Turn off the offer to update to the latest version of Windows' is set to 'Enabled'

3.11.50.1 (L1) Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled'

3.11.54.1 (L1) Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled'

CSCv7|8.8

3.11.54.2 (L1) Ensure 'Turn on PowerShell Transcription' is set to 'Enabled'

3.11.55.1.1 (L1) Ensure 'Allow Basic authentication' is set to 'Disabled'

3.11.55.1.2 (L1) Ensure 'Allow unencrypted traffic' is set to 'Disabled'

Detections

Analytics

CIS Microsoft Intune for Windows 11 v3.0.1 L1

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous