Security Technical Implementation Guides (STIGs)


Product
Severity
SRG
CCIs
STIG IDs
Rule IDs
Tags
AppLocker
EventSentry
Security
stig
Vulnerability ID Severity Description
V-205849 High Windows Server 2019 must be maintained at a supported servicing level
V-205714 Medium Windows Server 2019 administrator accounts must not be enumerated during elevation
V-205751 Medium Windows Server 2019 back up files and directories user right must only be assigned to the Adminis...
V-205659 Medium Windows Server 2019 maximum password age must be configured to 60 days or less
V-205909 Medium Windows Server 2019 built-in administrator account must be renamed
V-205662 Medium Windows Server 2019 minimum password length must be configured to 14 characters
V-205656 Medium Windows Server 2019 minimum password age must be configured to at least one day.
V-205691 Low Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting...
V-205910 Medium Windows Server 2019 built-in guest account must be renamed
V-205670 Medium Windows Server 2019 Deny log on locally user right on domain controllers must be configured to pr...
V-205675 Medium Windows Server 2019 Deny log on locally user right on domain-joined member servers must be config...
V-205748 Medium Windows Server 2019 "Enable computer and user accounts to be trusted for delegation" user right m...
V-205745 Medium Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right mus...
V-205908 High Windows Server 2019 must prevent local accounts with blank passwords from being used from the net...
V-205715 Medium Windows Server 2019 local administrator accounts must have their privileged token filtered to pre...
V-205709 Medium Windows Server 2019 must have the built-in guest account disabled
V-205663 High Windows Server 2019 local volumes must use a format that supports NTFS attributes
V-205694 Medium Windows Server 2019 must prevent Indexing of encrypted files
V-205840 Medium Windows Server 2019 must be configured to audit Object Access - Removable Storage successes
V-205795 Medium Windows Server 2019 account lockout duration must be configured to 15 minutes or greater
V-205863 Medium Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable ...
V-205925 Medium Windows Server 2019 must disable automatically signing in the last interactive user after a syste...
V-205652 Medium Windows Server 2019 must have the built-in Windows password complexity policy enabled
V-205630 Medium Windows Server 2019 must have the period of time before the bad logon counter is reset configured...
V-205700 Medium Windows Server 2019 accounts must require passwords
V-205653 High Windows Server 2019 reversible password encryption must be disabled
V-205815 Medium Windows Server 2019 computer account password must not be prevented from being reset
V-205629 Medium Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less
V-205716 Medium Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without usi...
V-205811 Medium Windows Server 2019 User Account Control approval mode for the built-in Administrator must be ena...
V-205812 Medium Windows Server 2019 User Account Control must automatically deny standard user requests for eleva...
V-205813 Medium Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enab...
V-205718 Medium Windows Server 2019 User Account Control must be configured to detect application installations a...
V-205720 Medium Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures t...
V-205717 Medium Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on...
V-205719 Medium Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are i...
V-205867 Medium Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on b...
V-205868 Medium Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plug...
V-205651 Medium Windows Server 2019 users must be required to enter a password to access private keys stored on t...
V-205638 Medium Windows Server 2019 command line data must be included in process creation events
V-205731 Medium Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion
V-205796 Medium Windows Server 2019 Application event log size must be configured to 32768 KB or greater
V-205797 Medium Windows Server 2019 Security event log size must be configured to 196608 KB or greater
V-205798 Medium Windows Server 2019 System event log size must be configured to 32768 KB or greater
V-205644 Medium Windows Server 2019 must force audit policy subcategory settings to override audit policy categor...
V-205641 Medium Windows Server 2019 permissions for the Security event log must prevent access by non-privileged ...
V-205642 Medium Windows Server 2019 permissions for the System event log must prevent access by non-privileged ac...
V-205804 High Windows Server 2019 Autoplay must be turned off for non-volume devices
V-205806 High Windows Server 2019 AutoPlay must be disabled for all drives
V-205805 High Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands
V-205687 Medium Windows Server 2019 must have WDigest Authentication disabled
V-205757 High Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group
V-205876 Medium Windows Server 2019 domain controllers must be configured to allow reset of machine account passw...
V-205820 Medium Windows Server 2019 domain controllers must require LDAP access signing
V-205740 High Windows Server 2019 Active Directory SYSVOL directory must have the proper access control permiss...
V-205877 Medium The password for the krbtgt account on a domain must be reset at least every 180 days
V-205907 High Windows Server 2019 must be running Credential Guard on domain-joined member servers
V-205906 Medium Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined ...
V-205821 Medium Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always)...
V-205822 Medium Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) ...
V-205823 Medium Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) mus...
V-205866 Medium Windows Server 2019 group policy objects must be reprocessed even if they have not changed
V-205862 Medium Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require m...
V-205696 Medium Windows Server 2019 local users on domain-joined member servers must not be enumerated
V-205911 Medium Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less
V-205920 Medium Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing
V-205872 Medium Windows Server 2019 File Explorer shell protocol must run in protected mode
V-205850 High Windows Server 2019 must use an anti-virus program
V-205688 Medium Windows Server 2019 downloading print driver packages over HTTP must be turned off
V-205865 Medium Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must preven...
V-205633 Medium Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the syste...
V-205689 Medium Windows Server 2019 printing over HTTP must be turned off
V-205692 Medium Windows Server 2019 Windows Defender SmartScreen must be enabled
V-205686 Medium Windows Server 2019 must prevent the display of slide shows on the lock screen
V-214936 Medium Windows Server 2019 must have a host-based firewall installed and enabled
V-205693 Medium Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP
V-205690 Medium Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen
V-205873 Medium Windows Server 2019 must prevent attachments from being downloaded from RSS feeds
V-205631 Medium Windows Server 2019 required legal notice must be configured to display before console logon
V-205914 High Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts
V-205724 High Windows Server 2019 must not allow anonymous enumeration of shares
V-205861 Medium Windows Server 2019 insecure logons to an SMB server must be disabled
V-205708 Medium Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC...
V-205825 Medium Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must...
V-205919 High Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response o...
V-205826 Medium Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server ag...
V-205827 Medium Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must...
V-205828 Medium Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client ag...
V-205915 Medium Windows Server 2019 must be configured to prevent anonymous users from having the same permission...
V-205684 Medium Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client
V-205683 Medium Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server
V-205917 Medium Windows Server 2019 must prevent NTLM from falling back to a Null session
V-205725 High Windows Server 2019 must restrict anonymous access to Named Pipes and Shares
V-205747 Medium Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administr...
V-205916 Medium Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authent...
V-205921 Medium Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTL...
V-205922 Medium Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTL...
V-205655 Medium Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (S...
V-205682 Medium Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed
V-205858 Low Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the h...
V-205680 Medium Windows Server 2019 must not have Simple TCP/IP Services installed
V-205859 Low Windows Server 2019 source routing must be configured to the highest protection level to prevent ...
V-205660 Medium Windows Server 2019 password history must be configured to 24 passwords remembered
V-205658 Medium Windows Server 2019 passwords must be configured to expire
V-205654 High Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords
V-205639 Medium Windows Server 2019 PowerShell script block logging must be enabled
V-205685 Medium Windows Server 2019 must not have Windows PowerShell 2.0 installed
V-205869 Medium Windows Server 2019 Telemetry must be configured to Security or Basic
V-205809 Medium Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connec...