| Vulnerability ID | Severity | Description |
|---|
| V-254247 | Medium | Windows Server 2022 must be maintained at a supported servicing level |
| V-205849 | High | Windows Server 2019 must be maintained at a supported servicing level |
| V-253263 | High | Windows 11 systems must be maintained at a supported servicing level |
| V-220706 | High | Windows 10 systems must be maintained at a supported servicing level |
| V-254355 | Medium | Windows Server 2022 administrator accounts must not be enumerated during elevation
|
| V-205714 | Medium | Windows Server 2019 administrator accounts must not be enumerated during elevation
|
| V-253391 | Medium | Windows 11 administrator accounts must not be enumerated during elevation
|
| V-220832 | Medium | Windows 10 administrator accounts must not be enumerated during elevation
|
| V-205751 | Medium | Windows Server 2019 back up files and directories user right must only be assigned to the Adminis...
|
| V-254289 | Medium | Windows Server 2022 maximum password age must be configured to 60 days or less
|
| V-205659 | Medium | Windows Server 2019 maximum password age must be configured to 60 days or less
|
| V-253301 | Medium | The maximum password age must be configured to 60 days or less
|
| V-220743 | Medium | The maximum password age must be configured to 60 days or less.
|
| V-254447 | Medium | Windows Server 2022 built-in administrator account must be renamed
|
| V-205909 | Medium | Windows Server 2019 built-in administrator account must be renamed
|
| V-253435 | Medium | The built-in administrator account must be renamed
|
| V-220911 | Medium | The built-in administrator account must be renamed
|
| V-254291 | Medium | Windows Server 2022 minimum password length must be configured to 14 characters
|
| V-205662 | Medium | Windows Server 2019 minimum password length must be configured to 14 characters
|
| V-253303 | Medium | Passwords must, at a minimum, be 14 characters
|
| V-220745 | Medium | Passwords must, at a minimum, be 14 characters
|
| V-254290 | Medium | Windows Server 2022 minimum password age must be configured to at least one day
|
| V-205656 | Medium | Windows Server 2019 minimum password age must be configured to at least one day.
|
| V-253302 | Medium | The minimum password age must be configured to at least 1 day
|
| V-220744 | Medium | The minimum password age must be configured to at least 1 day
|
| V-253385 | Low | The Application Compatibility Program Inventory must be prevented from collecting data and sendin...
|
| V-220826 | Low | The Application Compatibility Program Inventory must be prevented from collecting data and sendin...
|
| V-254351 | Low | Windows Server 2022 Application Compatibility Program Inventory must be prevented from collecting...
|
| V-205691 | Low | Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting...
|
| V-254448 | Medium | Windows Server 2022 built-in guest account must be renamed
|
| V-205910 | Medium | Windows Server 2019 built-in guest account must be renamed
|
| V-220912 | Medium | The built-in guest account must be renamed
|
| V-253436 | Medium | The built-in guest account must be renamed
|
| V-254424 | Medium | Windows Server 2022 Deny log on locally user right on domain controllers must be configured to pr...
|
| V-254438 | Medium | Windows Server 2022 Deny log on locally user right on domain-joined member servers must be config...
|
| V-205670 | Medium | Windows Server 2019 Deny log on locally user right on domain controllers must be configured to pr...
|
| V-205675 | Medium | Windows Server 2019 Deny log on locally user right on domain-joined member servers must be config...
|
| V-220971 | Medium | The Deny log on locally user right on workstations must be configured to prevent access from high...
|
| V-253494 | Medium | The "Deny log on locally" user right on workstations must be configured to prevent access from hi...
|
| V-254440 | Medium | Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-205748 | Medium | Windows Server 2019 "Enable computer and user accounts to be trusted for delegation" user right m...
|
| V-220973 | Medium | The Enable computer and user accounts to be trusted for delegation user right must not be assigne...
|
| V-253496 | Medium | The "Enable computer and user accounts to be trusted for delegation" user right must not be assig...
|
| V-254426 | Medium | Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-205745 | Medium | Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-205908 | High | Windows Server 2019 must prevent local accounts with blank passwords from being used from the net...
|
| V-254446 | High | Windows Server 2022 must prevent local accounts with blank passwords from being used from the net...
|
| V-220910 | Medium | Local accounts with blank passwords must be restricted to prevent access from the network
|
| V-253434 | Medium | Local accounts with blank passwords must be restricted to prevent access from the network
|
| V-254429 | Medium | Windows Server 2022 local administrator accounts must have their privileged token filtered to pre...
|
| V-205715 | Medium | Windows Server 2019 local administrator accounts must have their privileged token filtered to pre...
|
| V-253357 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-220799 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-253432 | Medium | The built-in administrator account must be disabled.
|
| V-220908 | Medium | The built-in administrator account must be disabled
|
| V-254445 | Medium | Windows Server 2022 must have the built-in guest account disabled
|
| V-205709 | Medium | Windows Server 2019 must have the built-in guest account disabled
|
| V-253433 | Medium | The built-in guest account must be disabled
|
| V-220909 | Medium | The built-in guest account must be disabled
|
| V-254250 | High | Windows Server 2022 local volumes must use a format that supports NTFS attributes
|
| V-205663 | High | Windows Server 2019 local volumes must use a format that supports NTFS attributes
|
| V-253265 | High | Local volumes must be formatted using NTFS
|
| V-220708 | High | Local volumes must be formatted using NTFS
|
| V-254372 | Medium | Windows Server 2022 must prevent Indexing of encrypted files
|
| V-205694 | Medium | Windows Server 2019 must prevent Indexing of encrypted files
|
| V-253409 | Medium | Indexing of encrypted files must be turned off
|
| V-220855 | Medium | Indexing of encrypted files must be turned off
|
| V-254494 | Medium | Windows Server 2022 back up files and directories user right must only be assigned to the Adminis...
|
| V-253483 | Medium | The "Back up files and directories" user right must only be assigned to the Administrators group
|
| V-220960 | Medium | The Back up files and directories user right must only be assigned to the Administrators group
|
| V-254317 | Medium | Windows Server 2022 must be configured to audit Object Access - Removable Storage successes
|
| V-205840 | Medium | Windows Server 2019 must be configured to audit Object Access - Removable Storage successes
|
| V-253324 | Medium | The system must be configured to audit Object Access - Removable Storage successes
|
| V-220766 | Medium | The system must be configured to audit Object Access - Removable Storage successes
|
| V-254285 | Medium | Windows Server 2022 account lockout duration must be configured to 15 minutes or greater
|
| V-205795 | Medium | Windows Server 2019 account lockout duration must be configured to 15 minutes or greater
|
| V-253297 | Medium | Windows 11 account lockout duration must be configured to 15 minutes or greater
|
| V-220739 | Medium | Windows 10 account lockout duration must be configured to 15 minutes or greater
|
| V-254342 | Medium | Windows Server 2022 must be configured to enable Remote host allows delegation of nonexportable c...
|
| V-205863 | Medium | Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable ...
|
| V-253368 | Medium | Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials
|
| V-220810 | Medium | Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials
|
| V-254376 | Medium | Windows Server 2022 must disable automatically signing in the last interactive user after a syste...
|
| V-205925 | Medium | Windows Server 2019 must disable automatically signing in the last interactive user after a syste...
|
| V-253413 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-220859 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-260469 | High | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence
|
| V-254292 | Medium | Windows Server 2022 must have the built-in Windows password complexity policy enabled
|
| V-205652 | Medium | Windows Server 2019 must have the built-in Windows password complexity policy enabled
|
| V-253304 | Medium | The built-in Microsoft password complexity filter must be enabled
|
| V-260650 | High | Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified informatio...
|
| V-220746 | Medium | The built-in Microsoft password complexity filter must be enabled
|
| V-254287 | Medium | Windows Server 2022 must have the period of time before the bad logon counter is reset configured...
|
| V-205630 | Medium | Windows Server 2019 must have the period of time before the bad logon counter is reset configured...
|
| V-253299 | Medium | The period of time before the bad logon counter is reset must be configured to 15 minutes
|
| V-220741 | Medium | The period of time before the bad logon counter is reset must be configured to 15 minutes
|
| V-254257 | Medium | Windows Server 2022 accounts must require passwords
|
| V-205700 | Medium | Windows Server 2019 accounts must require passwords
|
| V-254293 | High | Windows Server 2022 reversible password encryption must be disabled
|
| V-205653 | High | Windows Server 2019 reversible password encryption must be disabled
|
| V-253305 | High | Reversible password encryption must be disabled
|
| V-220747 | High | Reversible password encryption must be disabled
|
| V-254453 | Medium | Windows Server 2022 computer account password must not be prevented from being reset
|
| V-205815 | Medium | Windows Server 2019 computer account password must not be prevented from being reset
|
| V-253441 | Low | The computer account password must not be prevented from being reset
|
| V-220917 | Low | The computer account password must not be prevented from being reset
|
| V-254286 | Medium | Windows Server 2022 must have the number of allowed bad logon attempts configured to three or less
|
| V-205629 | Medium | Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less
|
| V-253298 | Medium | The number of allowed bad logon attempts must be configured to three or less
|
| V-220740 | Medium | The number of allowed bad logon attempts must be configured to 3 or less
|
| V-254483 | Medium | Windows Server 2022 UIAccess applications must not be allowed to prompt for elevation without usi...
|
| V-205716 | Medium | Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without usi...
|
| V-254482 | Medium | Windows Server 2022 User Account Control (UAC) approval mode for the built-in Administrator must ...
|
| V-205811 | Medium | Windows Server 2019 User Account Control approval mode for the built-in Administrator must be ena...
|
| V-253468 | Medium | User Account Control approval mode for the built-in Administrator must be enabled
|
| V-220944 | Medium | User Account Control approval mode for the built-in Administrator must be enabled
|
| V-254485 | Medium | Windows Server 2022 User Account Control (UAC) must automatically deny standard user requests for...
|
| V-205812 | Medium | Windows Server 2019 User Account Control must automatically deny standard user requests for eleva...
|
| V-253471 | Medium | User Account Control must automatically deny elevation requests for standard users
|
| V-220947 | Medium | User Account Control must automatically deny elevation requests for standard users
|
| V-254488 | Medium | Windows Server 2022 User Account Control (UAC) must run all administrators in Admin Approval Mode...
|
| V-205813 | Medium | Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enab...
|
| V-253474 | Medium | User Account Control must run all administrators in Admin Approval Mode, enabling UAC
|
| V-220950 | Medium | User Account Control must run all administrators in Admin Approval Mode, enabling UAC
|
| V-254486 | Medium | Windows Server 2022 User Account Control (UAC) must be configured to detect application installat...
|
| V-205718 | Medium | Windows Server 2019 User Account Control must be configured to detect application installations a...
|
| V-253472 | Medium | User Account Control must be configured to detect application installations and prompt for elevation
|
| V-220948 | Medium | User Account Control must be configured to detect application installations and prompt for elevation
|
| V-254489 | Medium | Windows Server 2022 User Account Control (UAC) must virtualize file and registry write failures t...
|
| V-205720 | Medium | Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures t...
|
| V-253475 | Medium | User Account Control must virtualize file and registry write failures to per-user locations
|
| V-220951 | Medium | User Account Control must virtualize file and registry write failures to per-user locations
|
| V-254484 | Medium | Windows Server 2022 User Account Control (UAC) must, at a minimum, prompt administrators for cons...
|
| V-205717 | Medium | Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on...
|
| V-253469 | Medium | User Account Control must prompt administrators for consent on the secure desktop
|
| V-220945 | Medium | User Account Control must, at minimum, prompt administrators for consent on the secure desktop
|
| V-254487 | Medium | Windows Server 2022 User Account Control (UAC) must only elevate UIAccess applications that are i...
|
| V-205719 | Medium | Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are i...
|
| V-253473 | Medium | User Account Control must only elevate UIAccess applications that are installed in secure locations
|
| V-220949 | Medium | User Account Control must only elevate UIAccess applications that are installed in secure locations
|
| V-254349 | Medium | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (on b...
|
| V-205867 | Medium | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on b...
|
| V-253380 | Medium | Users must be prompted for a password on resume from sleep (on battery)
|
| V-220821 | Medium | Users must be prompted for a password on resume from sleep (on battery)
|
| V-254350 | Medium | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (plug...
|
| V-205868 | Medium | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plug...
|
| V-253381 | Medium | The user must be prompted for a password on resume from sleep (plugged in)
|
| V-220822 | Medium | The user must be prompted for a password on resume from sleep (plugged in)
|
| V-254479 | Medium | Windows Server 2022 users must be required to enter a password to access private keys stored on t...
|
| V-205651 | Medium | Windows Server 2019 users must be required to enter a password to access private keys stored on t...
|
| V-254341 | Medium | Windows Server 2022 command line data must be included in process creation events
|
| V-205638 | Medium | Windows Server 2019 command line data must be included in process creation events
|
| V-220809 | Medium | Command line data must be included in process creation events
|
| V-253367 | Medium | Command line data must be included in process creation events
|
| V-254299 | Medium | Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion
|
| V-205731 | Medium | Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion
|
| V-254358 | Medium | Windows Server 2022 Application event log size must be configured to 32768 KB or greater
|
| V-205796 | Medium | Windows Server 2019 Application event log size must be configured to 32768 KB or greater
|
| V-253337 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-220779 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-254359 | Medium | Windows Server 2022 Security event log size must be configured to 196608 KB or greater
|
| V-205797 | Medium | Windows Server 2019 Security event log size must be configured to 196608 KB or greater
|
| V-253338 | Medium | The Security event log size must be configured to 1024000 KB or greater
|
| V-220780 | Medium | The Security event log size must be configured to 1024000 KB or greater
|
| V-254360 | Medium | Windows Server 2022 System event log size must be configured to 32768 KB or greater
|
| V-205798 | Medium | Windows Server 2019 System event log size must be configured to 32768 KB or greater
|
| V-253339 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-220781 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-254449 | Medium | Windows Server 2022 must force audit policy subcategory settings to override audit policy categor...
|
| V-205644 | Medium | Windows Server 2019 must force audit policy subcategory settings to override audit policy categor...
|
| V-253437 | Medium | Audit policy using subcategories must be enabled
|
| V-220913 | Medium | Audit policy using subcategories must be enabled
|
| V-254297 | Medium | Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged a...
|
| V-205641 | Medium | Windows Server 2019 permissions for the Security event log must prevent access by non-privileged ...
|
| V-253341 | Medium | Windows 11 permissions for the Security event log must prevent access by non-privileged accounts
|
| V-220783 | Medium | Windows 10 permissions for the Security event log must prevent access by non-privileged accounts
|
| V-254298 | Medium | Windows Server 2022 permissions for the System event log must prevent access by nonprivileged acc...
|
| V-205642 | Medium | Windows Server 2019 permissions for the System event log must prevent access by non-privileged ac...
|
| V-253342 | Medium | Windows 11 permissions for the System event log must prevent access by non-privileged accounts
|
| V-220784 | Medium | Windows 10 permissions for the System event log must prevent access by non-privileged accounts
|
| V-254352 | High | Windows Server 2022 Autoplay must be turned off for nonvolume devices
|
| V-205804 | High | Windows Server 2019 Autoplay must be turned off for non-volume devices
|
| V-253386 | High | Autoplay must be turned off for non-volume devices
|
| V-220827 | High | Autoplay must be turned off for non-volume devices
|
| V-254354 | High | Windows Server 2022 AutoPlay must be disabled for all drives
|
| V-205806 | High | Windows Server 2019 AutoPlay must be disabled for all drives
|
| V-253388 | High | Autoplay must be disabled for all drives
|
| V-220829 | High | Autoplay must be disabled for all drives
|
| V-254353 | High | Windows Server 2022 default AutoRun behavior must be configured to prevent AutoRun commands
|
| V-205805 | High | Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands
|
| V-253387 | High | The default autorun behavior must be configured to prevent autorun commands
|
| V-220828 | Medium | The default autorun behavior must be configured to prevent autorun commands
|
| V-205624 | Medium | Windows Server 2019 must automatically remove or disable temporary user accounts after 72 hours
|
| V-254334 | Medium | Windows Server 2022 must have WDigest Authentication disabled
|
| V-205687 | Medium | Windows Server 2019 must have WDigest Authentication disabled
|
| V-253358 | Medium | WDigest Authentication must be disabled
|
| V-220800 | Medium | WDigest Authentication must be disabled
|
| V-254500 | High | Windows Server 2022 debug programs user right must only be assigned to the Administrators group
|
| V-205757 | High | Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group
|
| V-253490 | High | The "Debug programs" user right must only be assigned to the Administrators group
|
| V-220967 | High | The Debug programs user right must only be assigned to the Administrators group
|
| V-205876 | Medium | Windows Server 2019 domain controllers must be configured to allow reset of machine account passw...
|
| V-254416 | Medium | Windows Server 2022 domain controllers must require LDAP access signing
|
| V-205820 | Medium | Windows Server 2019 domain controllers must require LDAP access signing
|
| V-254391 | High | Windows Server 2022 permissions on the Active Directory data files must only allow System and Adm...
|
| V-254392 | High | Windows Server 2022 Active Directory SYSVOL directory must have the proper access control permiss...
|
| V-205740 | High | Windows Server 2019 Active Directory SYSVOL directory must have the proper access control permiss...
|
| V-254427 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-205877 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-254441 | High | Windows Server 2022 must be running Credential Guard on domain-joined member servers
|
| V-205907 | High | Windows Server 2019 must be running Credential Guard on domain-joined member servers
|
| V-253370 | High | Credential Guard must be running on Windows 11 domain-joined systems
|
| V-220812 | High | Credential Guard must be running on Windows 10 domain-joined systems
|
| V-253447 | Low | Caching of logon credentials must be limited
|
| V-220923 | Low | Caching of logon credentials must be limited
|
| V-254432 | Medium | Windows Server 2022 must limit the caching of logon credentials to four or less on domain-joined ...
|
| V-205906 | Medium | Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined ...
|
| V-254450 | Medium | Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always)...
|
| V-205821 | Medium | Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always)...
|
| V-254451 | Medium | Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) ...
|
| V-205822 | Medium | Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) ...
|
| V-254452 | Medium | Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) mus...
|
| V-205823 | Medium | Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) mus...
|
| V-254345 | Medium | Windows Server 2022 group policy objects must be reprocessed even if they have not changed
|
| V-205866 | Medium | Windows Server 2019 group policy objects must be reprocessed even if they have not changed
|
| V-253373 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-220814 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-254340 | Medium | Windows Server 2022 hardened Universal Naming Convention (UNC) paths must be defined to require m...
|
| V-205862 | Medium | Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require m...
|
| V-253362 | Medium | Hardened UNC Paths must be defined to require mutual authentication and integrity for at least th...
|
| V-250319 | Medium | Hardened UNC paths must be defined to require mutual authentication and integrity for at least th...
|
| V-254430 | Medium | Windows Server 2022 local users on domain-joined member servers must not be enumerated
|
| V-205696 | Medium | Windows Server 2019 local users on domain-joined member servers must not be enumerated
|
| V-253379 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-220820 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-254454 | Medium | Windows Server 2022 maximum age for machine account passwords must be configured to 30 days or less
|
| V-205911 | Medium | Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less
|
| V-253442 | Low | The maximum age for machine account passwords must be configured to 30 days or less
|
| V-220918 | Low | The maximum age for machine account passwords must be configured to 30 days or less
|
| V-254476 | Medium | Windows Server 2022 must be configured to at least negotiate signing for LDAP client signing
|
| V-205920 | Medium | Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing
|
| V-253463 | Medium | The system must be configured to the required LDAP client signing level
|
| V-220939 | Medium | The system must be configured to the required LDAP client signing level
|
| V-253284 | High | Structured Exception Handling Overwrite Protection (SEHOP) must be enabled
|
| V-220727 | High | Structured Exception Handling Overwrite Protection (SEHOP) must be enabled
|
| V-254364 | Medium | Windows Server 2022 File Explorer shell protocol must run in protected mode
|
| V-205872 | Medium | Windows Server 2019 File Explorer shell protocol must run in protected mode
|
| V-253398 | Medium | File Explorer shell protocol must run in protected mode
|
| V-220839 | Medium | File Explorer shell protocol must run in protected mode
|
| V-254248 | Medium | Windows Server 2022 must use an antivirus program
|
| V-205850 | High | Windows Server 2019 must use an anti-virus program
|
| V-253264 | High | The Windows 11 system must use an antivirus program
|
| V-220707 | High | The Windows 10 system must use an anti-virus program
|
| V-254346 | Medium | Windows Server 2022 downloading print driver packages over HTTP must be turned off
|
| V-205688 | Medium | Windows Server 2019 downloading print driver packages over HTTP must be turned off
|
| V-253374 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-220815 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-254344 | Medium | Windows Server 2022 Early Launch Antimalware, Boot-Start Driver Initialization Policy must preven...
|
| V-205865 | Medium | Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must preven...
|
| V-253372 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers
|
| V-220813 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers
|
| V-253275 | High | Internet Information System (IIS) or its subcomponents must not be installed on a workstation
|
| V-220718 | High | Internet Information System (IIS) or its subcomponents must not be installed on a workstation
|
| V-254456 | Medium | Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the syste...
|
| V-205633 | Medium | Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the syste...
|
| V-253444 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver
|
| V-220920 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver
|
| V-254347 | Medium | Windows Server 2022 printing over HTTP must be turned off
|
| V-205689 | Medium | Windows Server 2019 printing over HTTP must be turned off
|
| V-253376 | Medium | Printing over HTTP must be prevented
|
| V-220817 | Medium | Printing over HTTP must be prevented
|
| V-253382 | High | Solicited Remote Assistance must not be allowed
|
| V-220823 | High | Solicited Remote Assistance must not be allowed
|
| V-253395 | Medium | The Microsoft Defender SmartScreen for Explorer must be enabled
|
| V-220836 | Medium | The Windows Defender SmartScreen for Explorer must be enabled
|
| V-254361 | Medium | Windows Server 2022 Microsoft Defender antivirus SmartScreen must be enabled
|
| V-205692 | Medium | Windows Server 2019 Windows Defender SmartScreen must be enabled
|
| V-254333 | Medium | Windows Server 2022 must prevent the display of slide shows on the lock screen
|
| V-205686 | Medium | Windows Server 2019 must prevent the display of slide shows on the lock screen
|
| V-254265 | Medium | Windows Server 2022 must have a host-based firewall installed and enabled
|
| V-253281 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-220724 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-214936 | Medium | Windows Server 2019 must have a host-based firewall installed and enabled
|
| V-254371 | Medium | Windows Server 2022 must disable Basic authentication for RSS feeds over HTTP
|
| V-205693 | Medium | Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP
|
| V-253408 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-220854 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-223079 | Medium | Checking for signatures on downloaded programs must be enforced
|
| V-223077 | Medium | Software must be disallowed to run or install with invalid signatures
|
| V-254348 | Medium | Windows Server 2022 network selection user interface (UI) must not be displayed on the logon screen
|
| V-205690 | Medium | Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen
|
| V-253378 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-220819 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-254370 | Medium | Windows Server 2022 must prevent attachments from being downloaded from RSS feeds
|
| V-205873 | Medium | Windows Server 2019 must prevent attachments from being downloaded from RSS feeds
|
| V-253407 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-220853 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-254457 | Medium | Windows Server 2022 required legal notice must be configured to display before console logon
|
| V-253445 | Medium | The required legal notice must be configured to display before console logon
|
| V-205631 | Medium | Windows Server 2019 required legal notice must be configured to display before console logon
|
| V-220921 | Medium | The required legal notice must be configured to display before console logon
|
| V-220844 | Medium | The Windows Defender SmartScreen filter for Microsoft Edge must be enabled
|
| V-220841 | Medium | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified f...
|
| V-220840 | Medium | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious we...
|
| V-254466 | High | Windows Server 2022 must not allow anonymous enumeration of Security Account Manager (SAM) accounts
|
| V-205914 | High | Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts
|
| V-253453 | High | Anonymous enumeration of SAM accounts must not be allowed
|
| V-220929 | High | Anonymous enumeration of SAM accounts must not be allowed
|
| V-254467 | High | Windows Server 2022 must not allow anonymous enumeration of shares
|
| V-205724 | High | Windows Server 2019 must not allow anonymous enumeration of shares
|
| V-253454 | High | Anonymous enumeration of shares must be restricted
|
| V-220930 | High | Anonymous enumeration of shares must be restricted
|
| V-254339 | Medium | Windows Server 2022 insecure logons to an SMB server must be disabled
|
| V-205861 | Medium | Windows Server 2019 insecure logons to an SMB server must be disabled
|
| V-253360 | Medium | Insecure logons to an SMB server must be disabled
|
| V-220802 | Medium | Insecure logons to an SMB server must be disabled
|
| V-254473 | Medium | Windows Server 2022 Kerberos encryption types must be configured to prevent the use of DES and RC...
|
| V-205708 | Medium | Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC...
|
| V-253460 | Medium | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites
|
| V-220936 | Medium | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites
|
| V-254460 | Medium | Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must...
|
| V-205825 | Medium | Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must...
|
| V-254475 | High | Windows Server 2022 LAN Manager authentication level must be configured to send NTLMv2 response o...
|
| V-205919 | High | Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response o...
|
| V-253462 | High | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM
|
| V-220938 | High | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM
|
| V-254461 | Medium | Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server ag...
|
| V-205826 | Medium | Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server ag...
|
| V-254463 | Medium | Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must...
|
| V-205827 | Medium | Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must...
|
| V-254464 | Medium | Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client ag...
|
| V-205828 | Medium | Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client ag...
|
| V-254468 | Medium | Windows Server 2022 must be configured to prevent anonymous users from having the same permission...
|
| V-205915 | Medium | Windows Server 2019 must be configured to prevent anonymous users from having the same permission...
|
| V-253455 | Medium | The system must be configured to prevent anonymous users from having the same rights as the Every...
|
| V-220937 | High | The system must be configured to prevent the storage of the LAN Manager hash of passwords
|
| V-254277 | Medium | Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client
|
| V-205684 | Medium | Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client
|
| V-253288 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-220731 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-254276 | Medium | Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server
|
| V-205683 | Medium | Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server
|
| V-253287 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-220730 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-254471 | Medium | Windows Server 2022 must prevent NTLM from falling back to a Null session
|
| V-205917 | Medium | Windows Server 2019 must prevent NTLM from falling back to a Null session
|
| V-253458 | Medium | NTLM must be prevented from falling back to a Null session
|
| V-220934 | Medium | NTLM must be prevented from falling back to a Null session
|
| V-254469 | High | Windows Server 2022 must restrict anonymous access to Named Pipes and Shares
|
| V-205725 | High | Windows Server 2019 must restrict anonymous access to Named Pipes and Shares
|
| V-253456 | High | Anonymous access to Named Pipes and Shares must be restricted
|
| V-220932 | High | Anonymous access to Named Pipes and Shares must be restricted
|
| V-254433 | Medium | Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administr...
|
| V-205747 | Medium | Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administr...
|
| V-253457 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-220933 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-254470 | Medium | Windows Server 2022 services using Local System that use Negotiate when reverting to NTLM authent...
|
| V-205916 | Medium | Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authent...
|
| V-254477 | Medium | Windows Server 2022 session security for NTLM SSP-based clients must be configured to require NTL...
|
| V-205921 | Medium | Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTL...
|
| V-254478 | Medium | Windows Server 2022 session security for NTLM SSP-based servers must be configured to require NTL...
|
| V-205922 | Medium | Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTL...
|
| V-254462 | Medium | Windows Server 2022 unencrypted passwords must not be sent to third-party Server Message Block (S...
|
| V-205655 | Medium | Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (S...
|
| V-253450 | Medium | Unencrypted passwords must not be sent to third-party SMB Servers
|
| V-220926 | Medium | Unencrypted passwords must not be sent to third-party SMB Servers
|
| V-254275 | Medium | Windows Server 2022 must not the Server Message Block (SMB) v1 protocol installed
|
| V-205682 | Medium | Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed
|
| V-254335 | Low | Windows Server 2022 Internet Protocol version 6 (IPv6) source routing must be configured to the h...
|
| V-205858 | Low | Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the h...
|
| V-253353 | Medium | IPv6 source routing must be configured to highest protection
|
| V-220795 | Medium | IPv6 source routing must be configured to highest protection
|
| V-254272 | Medium | Windows Server 2022 must not have Simple TCP/IP Services installed
|
| V-205680 | Medium | Windows Server 2019 must not have Simple TCP/IP Services installed
|
| V-253277 | Medium | Simple TCP/IP Services must not be installed on the system
|
| V-220720 | Medium | Simple TCP/IP Services must not be installed on the system
|
| V-254336 | Low | Windows Server 2022 source routing must be configured to the highest protection level to prevent ...
|
| V-205859 | Low | Windows Server 2019 source routing must be configured to the highest protection level to prevent ...
|
| V-254288 | Medium | Windows Server 2022 password history must be configured to 24 passwords remembered
|
| V-205660 | Medium | Windows Server 2019 password history must be configured to 24 passwords remembered
|
| V-253300 | Medium | The password history must be configured to 24 passwords remembered
|
| V-220742 | Medium | The password history must be configured to 24 passwords remembered
|
| V-254258 | Medium | Windows Server 2022 passwords must be configured to expire
|
| V-205658 | Medium | Windows Server 2019 passwords must be configured to expire
|
| V-253273 | Medium | Accounts must be configured to require password expiration
|
| V-220716 | Medium | Accounts must be configured to require password expiration
|
| V-254474 | High | Windows Server 2022 must be configured to prevent the storage of the LAN Manager hash of passwords
|
| V-205654 | High | Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords
|
| V-253461 | High | The system must be configured to prevent the storage of the LAN Manager hash of passwords
|
| V-254377 | Medium | Windows Server 2022 PowerShell script block logging must be enabled
|
| V-205639 | Medium | Windows Server 2019 PowerShell script block logging must be enabled
|
| V-253414 | Medium | PowerShell script block logging must be enabled on Windows 11
|
| V-220860 | Medium | PowerShell script block logging must be enabled on Windows 10
|
| V-254278 | Medium | Windows Server 2022 must not have Windows PowerShell 2.0 installed
|
| V-205685 | Medium | Windows Server 2019 must not have Windows PowerShell 2.0 installed
|
| V-253285 | Medium | The Windows PowerShell 2.0 feature must be disabled on the system
|
| V-220728 | Medium | The Windows PowerShell 2.0 feature must be disabled on the system
|
| V-205869 | Medium | Windows Server 2019 Telemetry must be configured to Security or Basic
|
| V-253393 | Medium | Windows Telemetry must not be configured to Full
|
| V-220834 | Medium | Windows Telemetry must not be configured to Full
|
| V-254367 | Medium | Windows Server 2022 Remote Desktop Services must always prompt a client for passwords upon connec...
|
| V-205809 | Medium | Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connec...
|
| V-253404 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-220850 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-254369 | Medium | Windows Server 2022 Remote Desktop Services must be configured with the client connection encrypt...
|
| V-205637 | Medium | Windows Server 2019 Remote Desktop Services must be configured with the client connection encrypt...
|
| V-253406 | Medium | Remote Desktop Services must be configured with the client connection encryption set to the requi...
|
| V-220852 | Medium | Remote Desktop Services must be configured with the client connection encryption set to the requi...
|
| V-260470 | High | Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and main...
|
| V-260471 | Medium | Ubuntu 22.04 LTS must initiate session audits at system startup
|
| V-260472 | Low | Ubuntu 22.04 LTS must restrict access to the kernel message buffer
|
| V-260473 | Medium | Ubuntu 22.04 LTS must disable kernel core dumps so that it can fail to a secure state if system i...
|
| V-260474 | Medium | Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from una...
|
| V-260475 | Medium | Ubuntu 22.04 LTS must implement nonexecutable data to protect its memory from unauthorized code e...
|
| V-260476 | Low | Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installat...
|
| V-260477 | Medium | Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) removes all software c...
|
| V-260478 | Medium | Ubuntu 22.04 LTS must have the "libpam-pwquality" package installed
|
| V-260479 | Low | Ubuntu 22.04 LTS must have the "chrony" package installed
|
| V-260480 | Low | Ubuntu 22.04 LTS must not have the "systemd-timesyncd" package installed
|
| V-260481 | Low | Ubuntu 22.04 LTS must not have the "ntp" package installed
|
| V-260482 | High | Ubuntu 22.04 LTS must not have the "rsh-server" package installed
|
| V-260483 | High | Ubuntu 22.04 LTS must not have the "telnet" package installed
|
| V-260484 | Medium | Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and m...
|
| V-260485 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of "755" or les...
|
| V-260486 | Medium | Ubuntu 22.04 LTS must have system commands set to a mode of "755" or less permissive
|
| V-260487 | Medium | Ubuntu 22.04 LTS library files must have mode "755" or less permissive
|
| V-260488 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to have mode "755" or less permissive
|
| V-260489 | Medium | Ubuntu 22.04 LTS must generate error messages that provide information necessary for corrective a...
|
| V-260490 | Medium | Ubuntu 22.04 LTS must generate system journal entries without revealing information that could be...
|
| V-260491 | Medium | Ubuntu 22.04 LTS must configure "/var/log/syslog" file with mode "640" or less permissive
|
| V-260492 | Medium | Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive
|
| V-260493 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands owned by "root"
|
| V-260494 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root"
|
| V-260495 | Medium | Ubuntu 22.04 LTS must have system commands owned by "root" or a system account
|
| V-260496 | Medium | Ubuntu 22.04 LTS must have system commands group-owned by "root" or a system account
|
| V-260497 | Medium | Ubuntu 22.04 LTS library directories must be owned by "root"
|
| V-260498 | Medium | Ubuntu 22.04 LTS library directories must be group-owned by "root"
|
| V-260499 | Medium | Ubuntu 22.04 LTS library files must be owned by "root"
|
| V-260500 | Medium | Ubuntu 22.04 LTS library files must be group-owned by "root"
|
| V-260501 | Medium | Ubuntu 22.04 LTS must configure the directories used by the system journal to be owned by "root"
|
| V-260502 | Medium | Ubuntu 22.04 LTS must configure the directories used by the system journal to be group-owned by "...
|
| V-260503 | Medium | Ubuntu 22.04 LTS must configure the files used by the system journal to be owned by "root"
|
| V-260504 | Medium | Ubuntu 22.04 LTS must configure the files used by the system journal to be group-owned by "system...
|
| V-260505 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is owned by "root"
|
| V-260506 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is group-owned by "root"
|
| V-260507 | Medium | Ubuntu 22.04 LTS must configure audit tools to be owned by "root"
|
| V-260508 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to be owned by "root"
|
| V-260509 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to be group-owned by "syslog"
|
| V-260510 | Medium | Ubuntu 22.04 LTS must configure "/var/log/syslog" file to be owned by "syslog"
|
| V-260511 | Medium | Ubuntu 22.04 LTS must configure the "/var/log/syslog" file to be group-owned by "adm"
|
| V-260512 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is not accessible by unautho...
|
| V-260513 | Medium | Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unin...
|
| V-260514 | Medium | Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access me...
|
| V-260515 | Medium | Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw)
|
| V-260516 | Medium | Ubuntu 22.04 LTS must have an application firewall enabled
|
| V-260517 | Medium | Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network i...
|
| V-260518 | Medium | Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocol...
|
| V-260519 | Low | Ubuntu 22.04 LTS must, for networked systems, compare internal information system clocks at least...
|
| V-260520 | Low | Ubuntu 22.04 LTS must synchronize internal information system clocks to the authoritative time so...
|
| V-260521 | Low | Ubuntu 22.04 LTS must record time stamps for audit records that can be mapped to Coordinated Univ...
|
| V-260522 | Medium | Ubuntu 22.04 LTS must be configured to use TCP syncookies
|
| V-260523 | High | Ubuntu 22.04 LTS must have SSH installed
|
| V-260524 | High | Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted informa...
|
| V-260533 | Medium | Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms
|
| V-260534 | Medium | Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnost...
|
| V-260537 | Medium | Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using est...
|
| V-260538 | Medium | Ubuntu 22.04 LTS must initiate a graphical session lock after 15 minutes of inactivity
|
| V-260539 | High | Ubuntu 22.04 LTS must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface ...
|
| V-260540 | Medium | Ubuntu 22.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver
|
| V-260541 | Medium | Ubuntu 22.04 LTS must disable all wireless network adapters
|
| V-260542 | Medium | Ubuntu 22.04 LTS must prevent direct login into the root account
|
| V-260543 | Medium | Ubuntu 22.04 LTS must uniquely identify interactive users
|
| V-260545 | Medium | Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for ne...
|
| V-260546 | Medium | Ubuntu 22.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new u...
|
| V-260547 | Medium | Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after...
|
| V-260548 | Medium | Ubuntu 22.04 LTS must automatically expire temporary accounts within 72 hours
|
| V-260549 | Low | Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an ad...
|
| V-260550 | Low | Ubuntu 22.04 LTS must enforce a delay of at least four seconds between logon prompts following a ...
|
| V-260552 | Low | Ubuntu 22.04 LTS must limit the number of concurrent sessions to ten for all accounts and/or acco...
|
| V-260553 | Medium | Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types
|
| V-260554 | Medium | Ubuntu 22.04 LTS must automatically exit interactive command shell user sessions after 15 minutes...
|
| V-260535 | Medium | Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DO...
|
| V-260536 | Medium | Ubuntu 22.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before grantin...
|
| V-260555 | Medium | Ubuntu 22.04 LTS default filesystem permissions must be defined in such a way that all authentica...
|
| V-260556 | Medium | Ubuntu 22.04 LTS must have the "apparmor" package installed
|
| V-260557 | Medium | Ubuntu 22.04 LTS must be configured to use AppArmor
|
| V-260558 | Medium | Ubuntu 22.04 LTS must require users to reauthenticate for privilege escalation or when changing r...
|
| V-260559 | High | Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group
|
| V-260560 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one uppercase character b...
|
| V-260561 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character b...
|
| V-260562 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric characte...
|
| V-260563 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one special characte...
|
| V-260564 | Medium | Ubuntu 22.04 LTS must prevent the use of dictionary words for passwords
|
| V-260565 | Medium | Ubuntu 22.04 LTS must enforce a minimum 15-character password length
|
| V-260566 | Medium | Ubuntu 22.04 LTS must require the change of at least eight characters when passwords are changed
|
| V-260567 | Medium | Ubuntu 22.04 LTS must be configured so that when passwords are changed or new passwords are estab...
|
| V-260569 | Medium | Ubuntu 22.04 LTS must store only encrypted representations of passwords
|
| V-260570 | High | Ubuntu 22.04 LTS must not allow accounts configured with blank or null passwords
|
| V-260571 | High | Ubuntu 22.04 LTS must not have accounts configured with blank or null passwords
|
| V-260572 | Medium | Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashi...
|
| V-260573 | Medium | Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accoun...
|
| V-260574 | Medium | Ubuntu 22.04 LTS must accept personal identity verification (PIV) credentials
|
| V-260575 | Medium | Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and ne...
|
| V-260576 | Medium | Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials
|
| V-260577 | Medium | Ubuntu 22.04 LTS, for PKI-based authentication, must validate certificates by constructing a cert...
|
| V-260578 | Medium | Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in...
|
| V-260579 | High | Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based a...
|
| V-260580 | Medium | Ubuntu 22.04 LTS must use DOD PKI-established certificate authorities for verification of the est...
|
| V-260581 | Low | Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the...
|
| V-260582 | Medium | Ubuntu 22.04 LTS must use a file integrity tool to verify correct operation of all security funct...
|
| V-260583 | Medium | Ubuntu 22.04 LTS must configure AIDE to perform file integrity checking on the file system
|
| V-260584 | Medium | Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an un...
|
| V-260585 | Medium | Ubuntu 22.04 LTS must be configured so that the script that runs each 30 days or less to check fi...
|
| V-260586 | Medium | Ubuntu 22.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools
|
| V-260587 | Low | Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone ...
|
| V-260588 | Medium | Ubuntu 22.04 LTS must be configured to preserve log records from failure events
|
| V-260589 | Medium | Ubuntu 22.04 LTS must monitor remote access methods
|
| V-260590 | Medium | Ubuntu 22.04 LTS must have the "auditd" package installed
|
| V-260591 | Medium | Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when,...
|
| V-260592 | Low | Ubuntu 22.04 LTS audit event multiplexor must be configured to offload audit logs onto a differen...
|
| V-260593 | Low | Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrat...
|
| V-260594 | Medium | Ubuntu 22.04 LTS must shut down by default upon audit failure
|
| V-260595 | Low | Ubuntu 22.04 LTS must allocate audit record storage capacity to store at least one weeks' worth o...
|
| V-260596 | Low | Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system sec...
|
| V-260597 | Medium | Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by ...
|
| V-260598 | Medium | Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files
|
| V-260599 | Medium | Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files
|
| V-260600 | Medium | Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by un...
|
| V-260601 | Medium | Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by...
|
| V-260602 | Medium | Ubuntu 22.04 LTS must permit only authorized accounts to own the audit configuration files
|
| V-260603 | Medium | Ubuntu 22.04 LTS must permit only authorized groups to own the audit configuration files
|
| V-260604 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_par...
|
| V-260605 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command
|
| V-260606 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chage command
|
| V-260607 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command
|
| V-260608 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command
|
| V-260609 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command
|
| V-260610 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command
|
| V-260611 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the fdis...
|
| V-260612 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command
|
| V-260613 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the kmod...
|
| V-260614 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use modprobe...
|
| V-260615 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the mount command
|
| V-260616 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command
|
| V-260617 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestam...
|
| V-260618 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command
|
| V-260619 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command
|
| V-260620 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent co...
|
| V-260621 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign ...
|
| V-260622 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the su command
|
| V-260623 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command
|
| V-260624 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit com...
|
| V-260625 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the umount command
|
| V-260626 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update ...
|
| V-260627 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command
|
| V-260628 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260629 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260630 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260631 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260632 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260633 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmo...
|
| V-260634 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchow...
|
| V-260635 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open,...
|
| V-260636 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the delete_modul...
|
| V-260637 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module ...
|
| V-260638 | Medium | Ubuntu 22.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, r...
|
| V-260639 | Medium | Ubuntu 22.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlin...
|
| V-260640 | Medium | Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files
|
| V-260641 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/log/btmp file
|
| V-260642 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/log/wtmp file
|
| V-260643 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/run/utmp file
|
| V-260644 | Medium | Ubuntu 22.04 LTS must generate audit records for the use and modification of faillog file
|
| V-260645 | Medium | Ubuntu 22.04 LTS must generate audit records for the use and modification of the lastlog file
|
| V-260646 | Medium | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the ...
|
| V-260647 | Medium | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the ...
|
| V-260648 | Medium | Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users e...
|
| V-260649 | Medium | Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, dia...
|
| V-260650 | High | Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified informatio...
|
| V-224819 | High | Users with Administrative privileges must have separate accounts for administrative duties and no...
|
| V-254365 | Medium | Windows Server 2022 must not save passwords in the Remote Desktop Client
|
| V-205808 | Medium | Windows Server 2019 must not save passwords in the Remote Desktop Client
|
| V-253402 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-220848 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-254366 | Medium | Windows Server 2022 Remote Desktop Services must prevent drive redirection
|
| V-205722 | Medium | Windows Server 2019 Remote Desktop Services must prevent drive redirection
|
| V-224820 | Medium | Passwords for the built-in Administrator account must be changed at least every 60 days
|
| V-224821 | High | Administrative accounts must not be used with applications that access the Internet, such as web ...
|
| V-224822 | Medium | Members of the Backup Operators group must have separate accounts for backup duties and normal op...
|
| V-224823 | Medium | Manually managed application account passwords must be at least 14 characters in length
|
| V-224824 | Medium | Manually managed application account passwords must be changed at least annually or when a system...
|
| V-224825 | Medium | Shared user accounts must not be permitted on the system
|
| V-224826 | Medium | Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-224827 | Medium | Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-224828 | High | Systems must be maintained at a supported servicing level
|
| V-224829 | High | The Windows Server 2016 system must use an anti-virus program
|
| V-224830 | Medium | Servers must have a host-based intrusion detection or prevention system
|
| V-224831 | High | Local volumes must use a format that supports NTFS attributes
|
| V-224832 | Medium | Permissions for the system drive root directory (usually C:\) must conform to minimum requirements
|
| V-224833 | Medium | Permissions for program file directories must conform to minimum requirements
|
| V-224834 | Medium | Permissions for the Windows installation directory must conform to minimum requirements
|
| V-224835 | Medium | Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained
|
| V-224836 | Low | Non-administrative accounts or groups must only have print permissions on printer shares
|
| V-224837 | Medium | Outdated or unused accounts must be removed from the system or disabled
|
| V-224838 | Medium | Windows Server 2016 accounts must require passwords
|
| V-224839 | Medium | Passwords must be configured to expire
|
| V-224840 | Medium | System files must be monitored for unauthorized changes
|
| V-224841 | Medium | Non-system-created file shares on a system must limit access to groups that require it
|
| V-254368 | Medium | Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) commu...
|
| V-205636 | Medium | Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) commu...
|
| V-254431 | Medium | Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connec...
|
| V-205814 | Medium | Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connec...
|
| V-253383 | Medium | Unauthenticated RPC clients must be restricted from connecting to the RPC server
|
| V-220824 | Medium | Unauthenticated RPC clients must be restricted from connecting to the RPC server
|
| V-254379 | Medium | Windows Server 2022 Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-205816 | Medium | Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-253417 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-220863 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-224842 | Medium | Software certificate installation files must be removed from Windows Server 2016
|
| V-224843 | High | Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauth...
|
| V-224844 | Medium | Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner ha...
|
| V-224845 | Medium | The roles and features required by the system must be documented
|
| V-224846 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-224847 | Medium | Windows Server 2016 must employ automated mechanisms to determine the state of system components ...
|
| V-224848 | Medium | Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours
|
| V-224849 | Medium | Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is r...
|
| V-224850 | Medium | The Fax Server role must not be installed
|
| V-224851 | Medium | The Microsoft FTP service must not be installed unless required
|
| V-224852 | Medium | The Peer Name Resolution Protocol must not be installed
|
| V-224853 | Medium | Simple TCP/IP Services must not be installed
|
| V-224854 | Medium | The Telnet Client must not be installed
|
| V-224855 | Medium | The TFTP Client must not be installed
|
| V-224856 | Medium | The Server Message Block (SMB) v1 protocol must be uninstalled
|
| V-224857 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-224858 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-224859 | Medium | Windows PowerShell 2.0 must not be installed
|
| V-224860 | Medium | FTP servers must be configured to prevent anonymous logons
|
| V-224861 | Medium | FTP servers must be configured to prevent access to the system drive
|
| V-224862 | Low | The time service must synchronize with an appropriate DoD time source
|
| V-224863 | Medium | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016
|
| V-224864 | Low | Secure Boot must be enabled on Windows Server 2016 systems
|
| V-224865 | Low | Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be confi...
|
| V-224866 | Medium | Windows 2016 account lockout duration must be configured to 15 minutes or greater
|
| V-254378 | High | Windows Server 2022 Windows Remote Management (WinRM) client must not use Basic authentication
|
| V-205711 | High | Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication
|
| V-253416 | High | The Windows Remote Management (WinRM) client must not use Basic authentication
|
| V-220862 | High | The Windows Remote Management (WinRM) client must not use Basic authentication
|
| V-254380 | Medium | Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-205712 | Medium | Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-253421 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-220868 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-254381 | High | Windows Server 2022 Windows Remote Management (WinRM) service must not use Basic authentication
|
| V-205713 | High | Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication
|
| V-253418 | High | The Windows Remote Management (WinRM) service must not use Basic authentication
|
| V-220865 | High | The Windows Remote Management (WinRM) service must not use Basic authentication
|
| V-253426 | Medium | Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled
|
| V-220902 | Medium | Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled
|
| V-224867 | Medium | Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less
|
| V-224868 | Medium | Windows Server 2016 must have the period of time before the bad logon counter is reset configured...
|
| V-224869 | Medium | Windows Server 2016 password history must be configured to 24 passwords remembered
|
| V-224870 | Medium | Windows Server 2016 maximum password age must be configured to 60 days or less
|
| V-224871 | Medium | Windows Server 2016 minimum password age must be configured to at least one day
|
| V-224872 | Medium | Windows Server 2016 minimum password length must be configured to 14 characters
|
| V-224873 | Medium | Windows Server 2016 must have the built-in Windows password complexity policy enabled
|
| V-224874 | High | Windows Server 2016 reversible password encryption must be disabled
|
| V-224875 | Medium | Audit records must be backed up to a different system or media than the system being audited
|
| V-224876 | Medium | Windows Server 2016 must, at a minimum, offload audit records of interconnected systems in real t...
|
| V-224877 | Medium | Permissions for the Application event log must prevent access by non-privileged accounts
|
| V-224878 | Medium | Permissions for the Security event log must prevent access by non-privileged accounts
|
| V-224879 | Medium | Permissions for the System event log must prevent access by non-privileged accounts
|
| V-254263 | Medium | Windows Server 2022 must implement protection methods such as TLS, encrypted VPNs, or IPsec if th...
|
| V-205829 | Medium | Windows Server 2019 must implement protection methods such as TLS, encrypted VPNs, or IPsec if th...
|
| V-254343 | Medium | Windows Server 2022 virtualization-based security must be enabled with the platform security leve...
|
| V-205864 | Medium | Windows Server 2019 virtualization-based security must be enabled with the platform security leve...
|
| V-253369 | Medium | Virtualization-based Security must be enabled on Windows 11 with the platform security level conf...
|
| V-220811 | Medium | Virtualization Based Security must be enabled on Windows 10 with the platform security level conf...
|
| V-254374 | High | Windows Server 2022 must disable the Windows Installer Always install with elevated privileges op...
|
| V-205802 | High | Windows Server 2019 must disable the Windows Installer Always install with elevated privileges op...
|
| V-253411 | High | The Windows Installer feature "Always install with elevated privileges" must be disabled
|
| V-220857 | High | The Windows Installer Always install with elevated privileges must be disabled
|
| V-224880 | Medium | Event Viewer must be protected from unauthorized modification and deletion
|
| V-224881 | Medium | Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes
|
| V-224882 | Medium | Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures
|
| V-224883 | Medium | Windows Server 2016 must be configured to audit Account Management - Other Account Management Eve...
|
| V-224884 | Medium | Windows Server 2016 must be configured to audit Account Management - Security Group Management su...
|
| V-224885 | Medium | Windows Server 2016 must be configured to audit Account Management - User Account Management succ...
|
| V-224886 | Medium | Windows Server 2016 must be configured to audit Account Management - User Account Management fail...
|
| V-224887 | Medium | Windows Server 2016 must be configured to audit Detailed Tracking - Plug and Play Events successes
|
| V-224888 | Medium | Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes
|
| V-224890 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-224891 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Group Membership successes
|
| V-224892 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes
|
| V-224893 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes
|
| V-224894 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures
|
| V-224895 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes
|
| V-224896 | Medium | Windows 2016 must be configured to audit Object Access - Other Object Access Events successes
|
| V-224897 | Medium | Windows 2016 must be configured to audit Object Access - Other Object Access Events failures
|
| V-224898 | Medium | Windows Server 2016 must be configured to audit Object Access - Removable Storage successes
|
| V-224899 | Medium | Windows Server 2016 must be configured to audit Object Access - Removable Storage failures
|
| V-224900 | Medium | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes
|
| V-224901 | Medium | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures
|
| V-224902 | Medium | Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change succ...
|
| V-224903 | Medium | Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change succe...
|
| V-224904 | Medium | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-224905 | Medium | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-224906 | Medium | Windows Server 2016 must be configured to audit System - IPsec Driver successes
|
| V-224907 | Medium | Windows Server 2016 must be configured to audit System - IPsec Driver failures
|
| V-224908 | Medium | Windows Server 2016 must be configured to audit System - Other System Events successes
|
| V-224909 | Medium | Windows Server 2016 must be configured to audit System - Other System Events failures
|
| V-224910 | Medium | Windows Server 2016 must be configured to audit System - Security State Change successes
|
| V-224911 | Medium | Windows Server 2016 must be configured to audit System - Security System Extension successes
|
| V-224912 | Medium | Windows Server 2016 must be configured to audit System - System Integrity successes
|
| V-224913 | Medium | Windows Server 2016 must be configured to audit System - System Integrity failures
|
| V-224914 | Medium | The display of slide shows on the lock screen must be disabled
|
| V-224915 | Medium | WDigest Authentication must be disabled on Windows Server 2016
|
| V-224916 | Low | Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection le...
|
| V-224917 | Low | Source routing must be configured to the highest protection level to prevent Internet Protocol (I...
|
| V-224918 | Low | Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redire...
|
| V-224919 | Low | Windows Server 2016 must be configured to ignore NetBIOS name release requests except from WINS s...
|
| V-224920 | Medium | Insecure logons to an SMB server must be disabled
|
| V-224921 | Medium | Hardened UNC paths must be defined to require mutual authentication and integrity for at least th...
|
| V-224922 | Medium | Command line data must be included in process creation events
|
| V-224923 | Medium | Windows Server 2016 virtualization-based security must be enabled with the platform security leve...
|
| V-224924 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers ident...
|
| V-224925 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-224926 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-224927 | Medium | Printing over HTTP must be prevented
|
| V-224928 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-224929 | Medium | Users must be prompted to authenticate when the system wakes from sleep (on battery)
|
| V-224930 | Medium | Users must be prompted to authenticate when the system wakes from sleep (plugged in)
|
| V-224931 | Low | The Application Compatibility Program Inventory must be prevented from collecting data and sendin...
|
| V-224932 | High | AutoPlay must be turned off for non-volume devices
|
| V-224933 | High | The default AutoRun behavior must be configured to prevent AutoRun commands
|
| V-224934 | High | AutoPlay must be disabled for all drives
|
| V-224935 | Medium | Administrator accounts must not be enumerated during elevation
|
| V-224936 | Medium | Windows Telemetry must be configured to Security or Basic
|
| V-224937 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-224938 | Medium | The Security event log size must be configured to 196608 KB or greater
|
| V-224939 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-224940 | Medium | Windows Server 2016 Windows SmartScreen must be enabled
|
| V-224941 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-224942 | Low | Turning off File Explorer heap termination on corruption must be disabled
|
| V-224943 | Medium | File Explorer shell protocol must run in protected mode
|
| V-224944 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-224945 | Medium | Local drives must be prevented from sharing with Remote Desktop Session Hosts
|
| V-224946 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-224947 | Medium | The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications
|
| V-224948 | Medium | Remote Desktop Services must be configured with the client connection encryption set to High Level
|
| V-224949 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-236000 | Medium | The Windows Explorer Preview pane must be disabled for Windows Server 2016
|
| V-224951 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-224952 | Medium | Indexing of encrypted files must be turned off
|
| V-224953 | Medium | Users must be prevented from changing installation options
|
| V-224954 | High | The Windows Installer Always install with elevated privileges option must be disabled
|
| V-224955 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-224956 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-224957 | Medium | PowerShell script block logging must be enabled
|
| V-224958 | High | The Windows Remote Management (WinRM) client must not use Basic authentication
|
| V-224959 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-224960 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-224961 | High | The Windows Remote Management (WinRM) service must not use Basic authentication
|
| V-224962 | Medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-224963 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-257502 | Medium | Windows Server 2016 must have PowerShell Transcription enabled
|
| V-224964 | High | Only administrators responsible for the domain controller must have Administrator rights on the s...
|
| V-224965 | Medium | Kerberos user logon restrictions must be enforced
|
| V-224966 | Medium | The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less
|
| V-224967 | Medium | The Kerberos user ticket lifetime must be limited to 10 hours or less
|
| V-224968 | Medium | The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less
|
| V-224969 | Medium | The computer clock synchronization tolerance must be limited to 5 minutes or less
|
| V-224970 | High | Permissions on the Active Directory data files must only allow System and Administrators access
|
| V-224971 | High | The Active Directory SYSVOL directory must have the proper access control permissions
|
| V-224972 | High | Active Directory Group Policy objects must have proper access control permissions
|
| V-224973 | High | The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper acce...
|
| V-224974 | High | Domain-created Active Directory Organizational Unit (OU) objects must have proper access control ...
|
| V-224975 | Medium | Data files owned by users must be on a different logical partition from the directory server data...
|
| V-224976 | Medium | Domain controllers must run on a machine dedicated to that function
|
| V-224977 | Medium | Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data in transi...
|
| V-224978 | High | Directory data (outside the root DSE) of a non-public directory must be configured to prevent ano...
|
| V-224979 | Low | The directory service must be configured to terminate LDAP-based network connections to the direc...
|
| V-224980 | Medium | Active Directory Group Policy objects must be configured with proper audit settings
|
| V-224981 | Medium | The Active Directory Domain object must be configured with proper audit settings
|
| V-224982 | Medium | The Active Directory Infrastructure object must be configured with proper audit settings
|
| V-224983 | Medium | The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with p...
|
| V-224984 | Medium | The Active Directory AdminSDHolder object must be configured with proper audit settings
|
| V-224985 | Medium | The Active Directory RID Manager$ object must be configured with proper audit settings
|
| V-224986 | Medium | Windows Server 2016 must be configured to audit Account Management - Computer Account Management ...
|
| V-224987 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes
|
| V-224988 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures
|
| V-224989 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes
|
| V-224991 | Medium | Domain controllers must have a PKI server certificate
|
| V-224992 | High | Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certific...
|
| V-224993 | High | PKI certificates associated with user accounts must be issued by the DoD PKI or an approved Exter...
|
| V-224994 | Medium | Active Directory user accounts, including administrators, must be configured to require the use o...
|
| V-254373 | Medium | Windows Server 2022 must prevent users from changing installation options
|
| V-205801 | Medium | Windows Server 2019 must prevent users from changing installation options
|
| V-253410 | Medium | Users must be prevented from changing installation options
|
| V-220856 | Medium | Users must be prevented from changing installation options
|
| V-254375 | Medium | Windows Server 2022 users must be notified if a web-based program attempts to install software
|
| V-205874 | Medium | Windows Server 2019 users must be notified if a web-based program attempts to install software
|
| V-253412 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-220858 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-253283 | High | Data Execution Prevention (DEP) must be configured to at least OptOut
|
| V-220726 | High | Data Execution Prevention (DEP) must be configured to at least OptOut
|
| V-254362 | Medium | Windows Server 2022 Explorer Data Execution Prevention must be enabled
|
| V-205830 | Medium | Windows Server 2019 Explorer Data Execution Prevention must be enabled
|
| V-253396 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-220837 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-254442 | Medium | Windows Server 2022 must have the DoD Root Certificate Authority (CA) certificates installed in t...
|
| V-205648 | Medium | Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in t...
|
| V-253427 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-220903 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-254269 | Medium | Windows Server 2022 must not have the Fax Server role installed
|
| V-205678 | Medium | Windows Server 2019 must not have the Fax Server role installed
|
| V-254270 | Medium | Windows Server 2022 must not have the Microsoft FTP service installed unless required by the orga...
|
| V-205697 | Medium | Windows Server 2019 must not have the Microsoft FTP service installed unless required by the orga...
|
| V-254271 | Medium | Windows Server 2022 must not have the Peer Name Resolution Protocol installed
|
| V-205679 | Medium | Windows Server 2019 must not have the Peer Name Resolution Protocol installed
|
| V-254273 | Medium | Windows Server 2022 must not have the Telnet Client installed
|
| V-205698 | Medium | Windows Server 2019 must not have the Telnet Client installed
|
| V-253278 | Medium | The Telnet Client must not be installed on the system
|
| V-220721 | Medium | The Telnet Client must not be installed on the system
|
| V-254274 | Medium | Windows Server 2022 must not have the TFTP Client installed
|
| V-205681 | Medium | Windows Server 2019 must not have the TFTP Client installed
|
| V-253279 | Medium | The TFTP Client must not be installed on the system
|
| V-220722 | Medium | The TFTP Client must not be installed on the system
|
| V-254284 | Medium | Windows Server 2022 must have Secure Boot enabled
|
| V-205857 | Low | Windows Server 2019 must have Secure Boot enabled
|
| V-253257 | Medium | Secure Boot must be enabled on Windows 11 systems
|
| V-220700 | Low | Secure Boot must be enabled on Windows 10 systems
|
| V-254357 | Low | Windows Server 2022 Windows Update must not obtain updates from other PCs on the internet
|
| V-205870 | Low | Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet
|
| V-253394 | Low | Windows Update must not obtain updates from other PCs on the internet
|
| V-220835 | Low | Windows Update must not obtain updates from other PCs on the internet
|
| V-224995 | Medium | Domain controllers must require LDAP access signing
|
| V-224996 | Medium | Domain controllers must be configured to allow reset of machine account passwords
|
| V-224997 | Medium | The Access this computer from the network user right must only be assigned to the Administrators,...
|
| V-224998 | Medium | The Add workstations to domain user right must only be assigned to the Administrators group
|
| V-224999 | Medium | The Allow log on through Remote Desktop Services user right must only be assigned to the Administ...
|
| V-225000 | Medium | The Deny access to this computer from the network user right on domain controllers must be config...
|
| V-225001 | Medium | The Deny log on as a batch job user right on domain controllers must be configured to prevent una...
|
| V-225002 | Medium | The Deny log on as a service user right must be configured to include no accounts or groups (blan...
|
| V-225003 | Medium | The Deny log on locally user right on domain controllers must be configured to prevent unauthenti...
|
| V-271430 | High | Windows Server 2016 must be configured for name-based strong mappings for certificates
|
| V-225004 | Medium | The Deny log on through Remote Desktop Services user right on domain controllers must be configur...
|
| V-225005 | Medium | The Enable computer and user accounts to be trusted for delegation user right must only be assign...
|
| V-225006 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-225007 | High | Only administrators responsible for the member server or standalone or nondomain-joined system mu...
|
| V-225008 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-225009 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-225010 | Medium | Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC...
|
| V-225011 | Medium | Caching of logon credentials must be limited
|
| V-225012 | High | Windows Server 2016 must be running Credential Guard on domain-joined member servers
|
| V-225013 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-225014 | Medium | The "Access this computer from the network" user right must only be assigned to the Administrator...
|
| V-225015 | Medium | The "Deny access to this computer from the network" user right on member servers must be configur...
|
| V-225016 | Medium | The "Deny log on as a batch job" user right on member servers must be configured to prevent acces...
|
| V-225017 | Medium | The "Deny log on as a service" user right on member servers must be configured to prevent access ...
|
| V-225018 | Medium | The "Deny log on locally" user right on member servers must be configured to prevent access from ...
|
| V-225019 | Medium | The "Deny log on through Remote Desktop Services" user right on member servers must be configured...
|
| V-225020 | Medium | The "Enable computer and user accounts to be trusted for delegation" user right must not be assig...
|
| V-225021 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-225022 | Medium | The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificat...
|
| V-225023 | Medium | The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Ce...
|
| V-225024 | Medium | Windows Server 2016 built-in guest account must be disabled
|
| V-225025 | High | Local accounts with blank passwords must be restricted to prevent access from the network
|
| V-225026 | Medium | Windows Server 2016 built-in administrator account must be renamed
|
| V-225027 | Medium | Windows Server 2016 built-in guest account must be renamed
|
| V-225028 | Medium | Audit policy using subcategories must be enabled
|
| V-225029 | Medium | The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configu...
|
| V-225030 | Medium | The setting Domain member: Digitally encrypt secure channel data (when possible) must be configur...
|
| V-225031 | Medium | The setting Domain member: Digitally sign secure channel data (when possible) must be configured ...
|
| V-225032 | Medium | The computer account password must not be prevented from being reset
|
| V-225033 | Medium | The maximum age for machine account passwords must be configured to 30 days or less
|
| V-225034 | Medium | Windows Server 2016 must be configured to require a strong session key
|
| V-225035 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver
|
| V-225036 | Medium | The required legal notice must be configured to display before console logon
|
| V-225037 | Low | The Windows dialog box title for the legal banner must be configured with the appropriate text
|
| V-225038 | Medium | The Smart Card removal option must be configured to Force Logoff or Lock Workstation
|
| V-225039 | Medium | The setting Microsoft network client: Digitally sign communications (always) must be configured t...
|
| V-225040 | Medium | The setting Microsoft network client: Digitally sign communications (if server agrees) must be co...
|
| V-225041 | Medium | Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers
|
| V-225042 | Medium | The setting Microsoft network server: Digitally sign communications (always) must be configured t...
|
| V-225043 | Medium | The setting Microsoft network server: Digitally sign communications (if client agrees) must be co...
|
| V-225044 | High | Anonymous SID/Name translation must not be allowed
|
| V-225045 | High | Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed
|
| V-225046 | High | Anonymous enumeration of shares must not be allowed
|
| V-225047 | Medium | Windows Server 2016 must be configured to prevent anonymous users from having the same permission...
|
| V-225048 | High | Anonymous access to Named Pipes and Shares must be restricted
|
| V-225093 | Medium | The Take ownership of files or other objects user right must only be assigned to the Administrato...
|
| V-254383 | Medium | Windows Server 2022 Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-205810 | Medium | Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-253420 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-220867 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-254382 | Medium | Windows Server 2022 Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-205817 | Medium | Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-253419 | Medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-254238 | Medium | Windows Server 2022 users with Administrative privileges must have separate accounts for administ...
|
| V-205844 | High | Windows Server 2019 users with Administrative privileges must have separate accounts for administ...
|
| V-254239 | Medium | Windows Server 2022 passwords for the built-in Administrator account must be changed at least eve...
|
| V-205657 | Medium | Windows Server 2019 passwords for the built-in Administrator account must be changed at least eve...
|
| V-253476 | Medium | Passwords for enabled local Administrator accounts must be changed at least every 60 days
|
| V-220952 | Medium | Passwords for enabled local Administrator accounts must be changed at least every 60 days
|
| V-254240 | High | Windows Server 2022 administrative accounts must not be used with applications that access the in...
|
| V-205845 | High | Windows Server 2019 administrative accounts must not be used with applications that access the In...
|
| V-253294 | High | Administrative accounts must not be used with applications that access the internet, such as web ...
|
| V-220737 | High | Administrative accounts must not be used with applications that access the Internet, such as web ...
|
| V-254241 | Medium | Windows Server 2022 members of the Backup Operators group must have separate accounts for backup ...
|
| V-205846 | Medium | Windows Server 2019 members of the Backup Operators group must have separate accounts for backup ...
|
| V-253270 | Medium | Only accounts responsible for the backup operations must be members of the Backup Operators group
|
| V-220713 | Medium | Only accounts responsible for the backup operations must be members of the Backup Operators group
|
| V-254242 | Medium | Windows Server 2022 manually managed application account passwords must be at least 14 characters...
|
| V-205661 | Medium | Windows Server 2019 manually managed application account passwords must be at least 14 characters...
|
| V-254243 | Medium | Windows Server 2022 manually managed application account passwords must be changed at least annua...
|
| V-205847 | Medium | Windows Server 2019 manually managed application account passwords must be changed at least annua...
|
| V-254244 | Medium | Windows Server 2022 shared user accounts must not be permitted
|
| V-205699 | Medium | Windows Server 2019 shared user accounts must not be permitted
|
| V-254245 | Medium | Windows Server 2022 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-205807 | Medium | Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-253262 | Medium | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of...
|
| V-220705 | Medium | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of...
|
| V-254246 | Medium | Windows Server 2022 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-205848 | Medium | Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-253255 | Medium | Windows 11 domain-joined systems must have a Trusted Platform Module (TPM) enabled
|
| V-220698 | Medium | Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use
|
| V-263646 | Medium | The DNS server implementation must compare the internal system clocks on an organization-defined ...
|
| V-205215 | High | The DNS server implementation must utilize cryptographic mechanisms to prevent unauthorized discl...
|
| V-205214 | High | The DNS server implementation must utilize cryptographic mechanisms to prevent unauthorized modif...
|
| V-205216 | High | The DNS server implementation must protect the integrity of transmitted information.
|
| V-263645 | Medium | The DNS server implementation must synchronize system clocks within and between systems or system...
|
| V-263644 | Medium | The DNS server implementation must provide protected storage for cryptographic keys with organiza...
|
| V-263643 | Medium | The DNS server implementation must include only approved trust anchors in trust stores or certifi...
|
| V-263642 | Medium | The DNS server implementation must protect nonlocal maintenance sessions by separating the mainte...
|
| V-263641 | Medium | The DNS server implementation must, for public key-based authentication, implement a local cache ...
|
| V-263640 | Medium | The DNS server implementation must, for password-based authentication, enforce organization-defin...
|
| V-263639 | Medium | The DNS server implementation must, for password-based authentication, employ automated tools to ...
|
| V-263638 | Medium | The DNS server implementation must, for password-based authentication, allow user selection of lo...
|
| V-263637 | Medium | The DNS server implementation must, for password-based authentication, require immediate selectio...
|
| V-263636 | Medium | The DNS server implementation must, for password-based authentication, store passwords using an a...
|
| V-263635 | Medium | The DNS server implementation must, for password-based authentication, verify when users create o...
|
| V-263634 | Medium | The DNS server implementation must, for password-based authentication, update the list of passwor...
|
| V-263633 | Medium | The DNS server implementation must, for password-based authentication, update the list of passwor...
|
| V-263632 | Medium | The DNS server implementation must, for password-based authentication, maintain a list of commonl...
|
| V-263631 | Medium | The DNS server implementation must implement multifactor authentication for local; network; and/o...
|
| V-263630 | Medium | The DNS server implementation must implement multifactor authentication for local; network; and/o...
|
| V-263629 | Medium | The DNS server implementation must require users to be individually authenticated before granting...
|
| V-263628 | Medium | The DNS server implementation must prevent the installation of organization-defined software and ...
|
| V-263627 | Medium | The DNS server implementation must automatically generate audit records of the enforcement actions.
|
| V-263626 | Medium | The DNS server implementation must alert organization-defined personnel or roles upon detection o...
|
| V-263625 | Medium | The DNS server implementation must implement the capability to centrally review and analyze audit...
|
| V-263624 | Medium | The DNS server implementation must disable accounts when the accounts are no longer associated to...
|
| V-263623 | Medium | The DNS server implementation must disable accounts when the accounts have expired.
|
| V-220317 | Medium | All authoritative name servers for a zone must be geographically disbursed.
|
| V-220316 | Medium | A unique TSIG key must be generated for each pair of communicating hosts.
|
| V-205253 | Medium | The DNS server implementation must be configured in accordance with the security configuration se...
|
| V-205252 | Medium | CNAME records must not point to a zone with lesser security for more than six months.
|
| V-205251 | Medium | A zone file must not include resource records that resolve to a fully qualified domain name resid...
|
| V-205250 | Medium | The private keys corresponding to both the ZSK and the KSK must not be kept on the DNSSEC-aware p...
|
| V-205249 | Medium | The private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must ...
|
| V-205248 | Medium | The platform on which the name server software is hosted must be configured to send outgoing DNS ...
|
| V-205247 | Medium | The platform on which the name server software is hosted must be configured to respond to DNS tra...
|
| V-205246 | Medium | The IP address for hidden master authoritative name servers must not appear in the name servers s...
|
| V-205245 | Medium | The DNS Name Server software must run with restricted privileges.
|
| V-205244 | Medium | The DNS name server software must be at the latest version.
|
| V-205243 | Medium | The DNS must utilize valid root name servers in the local root zone file.
|
| V-205242 | Medium | The DNS implementation must implement internal/external role separation.
|
| V-205241 | Medium | The DNS implementation must enforce a Discretionary Access Control (DAC) policy that limits propa...
|
| V-205240 | Medium | The DNS implementation must be conformant to the IETF DNS specification.
|
| V-205239 | Medium | Primary authoritative name servers must be configured to only receive zone transfer requests from...
|
| V-205238 | Medium | In a split DNS configuration, where separate name servers are used between the external and inter...
|
| V-205237 | Medium | In a split DNS configuration, where separate name servers are used between the external and inter...
|
| V-205236 | Medium | For zones split between the external and internal sides of a network, the RRs for the external ho...
|
| V-205235 | Medium | Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.
|
| V-205234 | Medium | An authoritative name server must be configured to enable DNSSEC Resource Records.
|
| V-205233 | Medium | All authoritative name servers for a zone must have the same version of zone information.
|
| V-205232 | Medium | All authoritative name servers for a zone must be located on different network segments.
|
| V-205231 | Medium | The two files generated by the dnssec-keygen program must be made accessible only to the server a...
|
| V-205230 | Medium | The DNS implementation must ensure each NS record in a zone file points to an active name server ...
|
| V-205229 | Medium | NSEC3 must be used for all internal DNS zones.
|
| V-205228 | Medium | The validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days an...
|
| V-205227 | Medium | The salt value for zones signed using NSEC3 RRs must be changed every time the zone is completely...
|
| V-205226 | Medium | The DNS server must implement NIST FIPS-validated cryptography for provisioning digital signature...
|
| V-205225 | Medium | The DNS implementation must generate audit records for the success and failure of all name server...
|
| V-205224 | Medium | The DNS implementation must generate audit records for the success and failure of start and stop ...
|
| V-205223 | Medium | The DNS server implementation must log the event and notify the system administrator when anomali...
|
| V-205222 | Medium | The DNS server implementation must perform verification of the correct operation of security func...
|
| V-205221 | Medium | The DNS server implementation must follow procedures to re-role a secondary name server as the ma...
|
| V-205220 | Medium | The DNS server implementation must behave in a predictable and documented manner that reflects or...
|
| V-205219 | Medium | The DNS server implementation must maintain the integrity of information during reception.
|
| V-205218 | Medium | The DNS server implementation must maintain the integrity of information during preparation for t...
|
| V-205217 | Medium | The DNS server implementation must implement cryptographic mechanisms to detect changes to inform...
|
| V-205213 | Medium | If the DNS server is using SIG(0), the DNS server implementation must only allow the use of DoD P...
|
| V-205212 | Medium | A DNS server implementation must perform data origin verification authentication on the name/addr...
|
| V-205211 | Medium | A DNS server implementation must perform data integrity verification on the name/address resoluti...
|
| V-205210 | Medium | A DNS server implementation must request data integrity verification on the name/address resoluti...
|
| V-205209 | Medium | A DNS server implementation must request data origin authentication verification on the name/addr...
|
| V-205208 | Medium | A DNS server implementation must provide additional integrity artifacts along with the authoritat...
|
| V-205207 | Medium | A DNS server implementation must provide data integrity protection artifacts for internal name/ad...
|
| V-205206 | Medium | A DNS server implementation must provide data origin artifacts for internal name/address resoluti...
|
| V-205205 | Medium | The DNS server implementation, for PKI-based authentication, must implement a local cache of revo...
|
| V-205204 | Medium | The DNS server implementation must authenticate another DNS server before establishing a remote a...
|