| Vulnerability ID | Severity | Description |
|---|
| V-254247 | Medium | Windows Server 2022 must be maintained at a supported servicing level |
| V-254355 | Medium | Windows Server 2022 administrator accounts must not be enumerated during elevation
|
| V-205714 | Medium | Windows Server 2019 administrator accounts must not be enumerated during elevation
|
| V-253391 | Medium | Windows 11 administrator accounts must not be enumerated during elevation
|
| V-220832 | Medium | Windows 10 administrator accounts must not be enumerated during elevation
|
| V-205751 | Medium | Windows Server 2019 back up files and directories user right must only be assigned to the Adminis...
|
| V-254289 | Medium | Windows Server 2022 maximum password age must be configured to 60 days or less
|
| V-205659 | Medium | Windows Server 2019 maximum password age must be configured to 60 days or less
|
| V-253301 | Medium | The maximum password age must be configured to 60 days or less
|
| V-220743 | Medium | The maximum password age must be configured to 60 days or less.
|
| V-254447 | Medium | Windows Server 2022 built-in administrator account must be renamed
|
| V-205909 | Medium | Windows Server 2019 built-in administrator account must be renamed
|
| V-253435 | Medium | The built-in administrator account must be renamed
|
| V-220911 | Medium | The built-in administrator account must be renamed
|
| V-254291 | Medium | Windows Server 2022 minimum password length must be configured to 14 characters
|
| V-205662 | Medium | Windows Server 2019 minimum password length must be configured to 14 characters
|
| V-253303 | Medium | Passwords must, at a minimum, be 14 characters
|
| V-220745 | Medium | Passwords must, at a minimum, be 14 characters
|
| V-254290 | Medium | Windows Server 2022 minimum password age must be configured to at least one day
|
| V-205656 | Medium | Windows Server 2019 minimum password age must be configured to at least one day.
|
| V-253302 | Medium | The minimum password age must be configured to at least 1 day
|
| V-220744 | Medium | The minimum password age must be configured to at least 1 day
|
| V-254448 | Medium | Windows Server 2022 built-in guest account must be renamed
|
| V-205910 | Medium | Windows Server 2019 built-in guest account must be renamed
|
| V-220912 | Medium | The built-in guest account must be renamed
|
| V-253436 | Medium | The built-in guest account must be renamed
|
| V-254424 | Medium | Windows Server 2022 Deny log on locally user right on domain controllers must be configured to pr...
|
| V-254438 | Medium | Windows Server 2022 Deny log on locally user right on domain-joined member servers must be config...
|
| V-205670 | Medium | Windows Server 2019 Deny log on locally user right on domain controllers must be configured to pr...
|
| V-205675 | Medium | Windows Server 2019 Deny log on locally user right on domain-joined member servers must be config...
|
| V-220971 | Medium | The Deny log on locally user right on workstations must be configured to prevent access from high...
|
| V-253494 | Medium | The "Deny log on locally" user right on workstations must be configured to prevent access from hi...
|
| V-254440 | Medium | Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-205748 | Medium | Windows Server 2019 "Enable computer and user accounts to be trusted for delegation" user right m...
|
| V-220973 | Medium | The Enable computer and user accounts to be trusted for delegation user right must not be assigne...
|
| V-253496 | Medium | The "Enable computer and user accounts to be trusted for delegation" user right must not be assig...
|
| V-254426 | Medium | Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-205745 | Medium | Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right mus...
|
| V-220910 | Medium | Local accounts with blank passwords must be restricted to prevent access from the network
|
| V-253434 | Medium | Local accounts with blank passwords must be restricted to prevent access from the network
|
| V-254429 | Medium | Windows Server 2022 local administrator accounts must have their privileged token filtered to pre...
|
| V-205715 | Medium | Windows Server 2019 local administrator accounts must have their privileged token filtered to pre...
|
| V-253357 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-220799 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-253432 | Medium | The built-in administrator account must be disabled.
|
| V-220908 | Medium | The built-in administrator account must be disabled
|
| V-254445 | Medium | Windows Server 2022 must have the built-in guest account disabled
|
| V-205709 | Medium | Windows Server 2019 must have the built-in guest account disabled
|
| V-253433 | Medium | The built-in guest account must be disabled
|
| V-220909 | Medium | The built-in guest account must be disabled
|
| V-254372 | Medium | Windows Server 2022 must prevent Indexing of encrypted files
|
| V-205694 | Medium | Windows Server 2019 must prevent Indexing of encrypted files
|
| V-253409 | Medium | Indexing of encrypted files must be turned off
|
| V-220855 | Medium | Indexing of encrypted files must be turned off
|
| V-254494 | Medium | Windows Server 2022 back up files and directories user right must only be assigned to the Adminis...
|
| V-253483 | Medium | The "Back up files and directories" user right must only be assigned to the Administrators group
|
| V-220960 | Medium | The Back up files and directories user right must only be assigned to the Administrators group
|
| V-254317 | Medium | Windows Server 2022 must be configured to audit Object Access - Removable Storage successes
|
| V-205840 | Medium | Windows Server 2019 must be configured to audit Object Access - Removable Storage successes
|
| V-253324 | Medium | The system must be configured to audit Object Access - Removable Storage successes
|
| V-220766 | Medium | The system must be configured to audit Object Access - Removable Storage successes
|
| V-254285 | Medium | Windows Server 2022 account lockout duration must be configured to 15 minutes or greater
|
| V-205795 | Medium | Windows Server 2019 account lockout duration must be configured to 15 minutes or greater
|
| V-253297 | Medium | Windows 11 account lockout duration must be configured to 15 minutes or greater
|
| V-220739 | Medium | Windows 10 account lockout duration must be configured to 15 minutes or greater
|
| V-254342 | Medium | Windows Server 2022 must be configured to enable Remote host allows delegation of nonexportable c...
|
| V-205863 | Medium | Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable ...
|
| V-253368 | Medium | Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials
|
| V-220810 | Medium | Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials
|
| V-254376 | Medium | Windows Server 2022 must disable automatically signing in the last interactive user after a syste...
|
| V-205925 | Medium | Windows Server 2019 must disable automatically signing in the last interactive user after a syste...
|
| V-253413 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-220859 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-254292 | Medium | Windows Server 2022 must have the built-in Windows password complexity policy enabled
|
| V-205652 | Medium | Windows Server 2019 must have the built-in Windows password complexity policy enabled
|
| V-253304 | Medium | The built-in Microsoft password complexity filter must be enabled
|
| V-220746 | Medium | The built-in Microsoft password complexity filter must be enabled
|
| V-254287 | Medium | Windows Server 2022 must have the period of time before the bad logon counter is reset configured...
|
| V-205630 | Medium | Windows Server 2019 must have the period of time before the bad logon counter is reset configured...
|
| V-253299 | Medium | The period of time before the bad logon counter is reset must be configured to 15 minutes
|
| V-220741 | Medium | The period of time before the bad logon counter is reset must be configured to 15 minutes
|
| V-254257 | Medium | Windows Server 2022 accounts must require passwords
|
| V-205700 | Medium | Windows Server 2019 accounts must require passwords
|
| V-254453 | Medium | Windows Server 2022 computer account password must not be prevented from being reset
|
| V-205815 | Medium | Windows Server 2019 computer account password must not be prevented from being reset
|
| V-254286 | Medium | Windows Server 2022 must have the number of allowed bad logon attempts configured to three or less
|
| V-205629 | Medium | Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less
|
| V-253298 | Medium | The number of allowed bad logon attempts must be configured to three or less
|
| V-220740 | Medium | The number of allowed bad logon attempts must be configured to 3 or less
|
| V-254483 | Medium | Windows Server 2022 UIAccess applications must not be allowed to prompt for elevation without usi...
|
| V-205716 | Medium | Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without usi...
|
| V-254482 | Medium | Windows Server 2022 User Account Control (UAC) approval mode for the built-in Administrator must ...
|
| V-205811 | Medium | Windows Server 2019 User Account Control approval mode for the built-in Administrator must be ena...
|
| V-253468 | Medium | User Account Control approval mode for the built-in Administrator must be enabled
|
| V-220944 | Medium | User Account Control approval mode for the built-in Administrator must be enabled
|
| V-254485 | Medium | Windows Server 2022 User Account Control (UAC) must automatically deny standard user requests for...
|
| V-205812 | Medium | Windows Server 2019 User Account Control must automatically deny standard user requests for eleva...
|
| V-253471 | Medium | User Account Control must automatically deny elevation requests for standard users
|
| V-220947 | Medium | User Account Control must automatically deny elevation requests for standard users
|
| V-254488 | Medium | Windows Server 2022 User Account Control (UAC) must run all administrators in Admin Approval Mode...
|
| V-205813 | Medium | Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enab...
|
| V-253474 | Medium | User Account Control must run all administrators in Admin Approval Mode, enabling UAC
|
| V-220950 | Medium | User Account Control must run all administrators in Admin Approval Mode, enabling UAC
|
| V-254486 | Medium | Windows Server 2022 User Account Control (UAC) must be configured to detect application installat...
|
| V-205718 | Medium | Windows Server 2019 User Account Control must be configured to detect application installations a...
|
| V-253472 | Medium | User Account Control must be configured to detect application installations and prompt for elevation
|
| V-220948 | Medium | User Account Control must be configured to detect application installations and prompt for elevation
|
| V-254489 | Medium | Windows Server 2022 User Account Control (UAC) must virtualize file and registry write failures t...
|
| V-205720 | Medium | Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures t...
|
| V-253475 | Medium | User Account Control must virtualize file and registry write failures to per-user locations
|
| V-220951 | Medium | User Account Control must virtualize file and registry write failures to per-user locations
|
| V-254484 | Medium | Windows Server 2022 User Account Control (UAC) must, at a minimum, prompt administrators for cons...
|
| V-205717 | Medium | Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on...
|
| V-253469 | Medium | User Account Control must prompt administrators for consent on the secure desktop
|
| V-220945 | Medium | User Account Control must, at minimum, prompt administrators for consent on the secure desktop
|
| V-254487 | Medium | Windows Server 2022 User Account Control (UAC) must only elevate UIAccess applications that are i...
|
| V-205719 | Medium | Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are i...
|
| V-253473 | Medium | User Account Control must only elevate UIAccess applications that are installed in secure locations
|
| V-220949 | Medium | User Account Control must only elevate UIAccess applications that are installed in secure locations
|
| V-254349 | Medium | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (on b...
|
| V-205867 | Medium | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on b...
|
| V-253380 | Medium | Users must be prompted for a password on resume from sleep (on battery)
|
| V-220821 | Medium | Users must be prompted for a password on resume from sleep (on battery)
|
| V-254350 | Medium | Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (plug...
|
| V-205868 | Medium | Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plug...
|
| V-253381 | Medium | The user must be prompted for a password on resume from sleep (plugged in)
|
| V-220822 | Medium | The user must be prompted for a password on resume from sleep (plugged in)
|
| V-254479 | Medium | Windows Server 2022 users must be required to enter a password to access private keys stored on t...
|
| V-205651 | Medium | Windows Server 2019 users must be required to enter a password to access private keys stored on t...
|
| V-254341 | Medium | Windows Server 2022 command line data must be included in process creation events
|
| V-205638 | Medium | Windows Server 2019 command line data must be included in process creation events
|
| V-220809 | Medium | Command line data must be included in process creation events
|
| V-253367 | Medium | Command line data must be included in process creation events
|
| V-254299 | Medium | Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion
|
| V-205731 | Medium | Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion
|
| V-254358 | Medium | Windows Server 2022 Application event log size must be configured to 32768 KB or greater
|
| V-205796 | Medium | Windows Server 2019 Application event log size must be configured to 32768 KB or greater
|
| V-253337 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-220779 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-254359 | Medium | Windows Server 2022 Security event log size must be configured to 196608 KB or greater
|
| V-205797 | Medium | Windows Server 2019 Security event log size must be configured to 196608 KB or greater
|
| V-253338 | Medium | The Security event log size must be configured to 1024000 KB or greater
|
| V-220780 | Medium | The Security event log size must be configured to 1024000 KB or greater
|
| V-254360 | Medium | Windows Server 2022 System event log size must be configured to 32768 KB or greater
|
| V-205798 | Medium | Windows Server 2019 System event log size must be configured to 32768 KB or greater
|
| V-253339 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-220781 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-254449 | Medium | Windows Server 2022 must force audit policy subcategory settings to override audit policy categor...
|
| V-205644 | Medium | Windows Server 2019 must force audit policy subcategory settings to override audit policy categor...
|
| V-253437 | Medium | Audit policy using subcategories must be enabled
|
| V-220913 | Medium | Audit policy using subcategories must be enabled
|
| V-254297 | Medium | Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged a...
|
| V-205641 | Medium | Windows Server 2019 permissions for the Security event log must prevent access by non-privileged ...
|
| V-253341 | Medium | Windows 11 permissions for the Security event log must prevent access by non-privileged accounts
|
| V-220783 | Medium | Windows 10 permissions for the Security event log must prevent access by non-privileged accounts
|
| V-254298 | Medium | Windows Server 2022 permissions for the System event log must prevent access by nonprivileged acc...
|
| V-205642 | Medium | Windows Server 2019 permissions for the System event log must prevent access by non-privileged ac...
|
| V-253342 | Medium | Windows 11 permissions for the System event log must prevent access by non-privileged accounts
|
| V-220784 | Medium | Windows 10 permissions for the System event log must prevent access by non-privileged accounts
|
| V-220828 | Medium | The default autorun behavior must be configured to prevent autorun commands
|
| V-205624 | Medium | Windows Server 2019 must automatically remove or disable temporary user accounts after 72 hours
|
| V-254334 | Medium | Windows Server 2022 must have WDigest Authentication disabled
|
| V-205687 | Medium | Windows Server 2019 must have WDigest Authentication disabled
|
| V-253358 | Medium | WDigest Authentication must be disabled
|
| V-220800 | Medium | WDigest Authentication must be disabled
|
| V-205876 | Medium | Windows Server 2019 domain controllers must be configured to allow reset of machine account passw...
|
| V-254416 | Medium | Windows Server 2022 domain controllers must require LDAP access signing
|
| V-205820 | Medium | Windows Server 2019 domain controllers must require LDAP access signing
|
| V-254427 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-205877 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-254432 | Medium | Windows Server 2022 must limit the caching of logon credentials to four or less on domain-joined ...
|
| V-205906 | Medium | Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined ...
|
| V-254450 | Medium | Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always)...
|
| V-205821 | Medium | Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always)...
|
| V-254451 | Medium | Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) ...
|
| V-205822 | Medium | Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) ...
|
| V-254452 | Medium | Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) mus...
|
| V-205823 | Medium | Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) mus...
|
| V-254345 | Medium | Windows Server 2022 group policy objects must be reprocessed even if they have not changed
|
| V-205866 | Medium | Windows Server 2019 group policy objects must be reprocessed even if they have not changed
|
| V-253373 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-220814 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-254340 | Medium | Windows Server 2022 hardened Universal Naming Convention (UNC) paths must be defined to require m...
|
| V-205862 | Medium | Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require m...
|
| V-253362 | Medium | Hardened UNC Paths must be defined to require mutual authentication and integrity for at least th...
|
| V-250319 | Medium | Hardened UNC paths must be defined to require mutual authentication and integrity for at least th...
|
| V-254430 | Medium | Windows Server 2022 local users on domain-joined member servers must not be enumerated
|
| V-205696 | Medium | Windows Server 2019 local users on domain-joined member servers must not be enumerated
|
| V-253379 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-220820 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-254454 | Medium | Windows Server 2022 maximum age for machine account passwords must be configured to 30 days or less
|
| V-205911 | Medium | Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less
|
| V-254476 | Medium | Windows Server 2022 must be configured to at least negotiate signing for LDAP client signing
|
| V-205920 | Medium | Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing
|
| V-253463 | Medium | The system must be configured to the required LDAP client signing level
|
| V-220939 | Medium | The system must be configured to the required LDAP client signing level
|
| V-254364 | Medium | Windows Server 2022 File Explorer shell protocol must run in protected mode
|
| V-205872 | Medium | Windows Server 2019 File Explorer shell protocol must run in protected mode
|
| V-253398 | Medium | File Explorer shell protocol must run in protected mode
|
| V-220839 | Medium | File Explorer shell protocol must run in protected mode
|
| V-254248 | Medium | Windows Server 2022 must use an antivirus program
|
| V-254346 | Medium | Windows Server 2022 downloading print driver packages over HTTP must be turned off
|
| V-205688 | Medium | Windows Server 2019 downloading print driver packages over HTTP must be turned off
|
| V-253374 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-220815 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-254344 | Medium | Windows Server 2022 Early Launch Antimalware, Boot-Start Driver Initialization Policy must preven...
|
| V-205865 | Medium | Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must preven...
|
| V-253372 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers
|
| V-220813 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers
|
| V-254456 | Medium | Windows Server 2022 machine inactivity limit must be set to 15 minutes or less, locking the syste...
|
| V-205633 | Medium | Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the syste...
|
| V-253444 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver
|
| V-220920 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver
|
| V-254347 | Medium | Windows Server 2022 printing over HTTP must be turned off
|
| V-205689 | Medium | Windows Server 2019 printing over HTTP must be turned off
|
| V-253376 | Medium | Printing over HTTP must be prevented
|
| V-220817 | Medium | Printing over HTTP must be prevented
|
| V-253395 | Medium | The Microsoft Defender SmartScreen for Explorer must be enabled
|
| V-220836 | Medium | The Windows Defender SmartScreen for Explorer must be enabled
|
| V-254361 | Medium | Windows Server 2022 Microsoft Defender antivirus SmartScreen must be enabled
|
| V-205692 | Medium | Windows Server 2019 Windows Defender SmartScreen must be enabled
|
| V-254333 | Medium | Windows Server 2022 must prevent the display of slide shows on the lock screen
|
| V-205686 | Medium | Windows Server 2019 must prevent the display of slide shows on the lock screen
|
| V-254265 | Medium | Windows Server 2022 must have a host-based firewall installed and enabled
|
| V-253281 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-220724 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-214936 | Medium | Windows Server 2019 must have a host-based firewall installed and enabled
|
| V-254371 | Medium | Windows Server 2022 must disable Basic authentication for RSS feeds over HTTP
|
| V-205693 | Medium | Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP
|
| V-253408 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-220854 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-223079 | Medium | Checking for signatures on downloaded programs must be enforced
|
| V-223077 | Medium | Software must be disallowed to run or install with invalid signatures
|
| V-254348 | Medium | Windows Server 2022 network selection user interface (UI) must not be displayed on the logon screen
|
| V-205690 | Medium | Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen
|
| V-253378 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-220819 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-254370 | Medium | Windows Server 2022 must prevent attachments from being downloaded from RSS feeds
|
| V-205873 | Medium | Windows Server 2019 must prevent attachments from being downloaded from RSS feeds
|
| V-253407 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-220853 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-254457 | Medium | Windows Server 2022 required legal notice must be configured to display before console logon
|
| V-253445 | Medium | The required legal notice must be configured to display before console logon
|
| V-205631 | Medium | Windows Server 2019 required legal notice must be configured to display before console logon
|
| V-220921 | Medium | The required legal notice must be configured to display before console logon
|
| V-220844 | Medium | The Windows Defender SmartScreen filter for Microsoft Edge must be enabled
|
| V-220841 | Medium | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified f...
|
| V-220840 | Medium | Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious we...
|
| V-254339 | Medium | Windows Server 2022 insecure logons to an SMB server must be disabled
|
| V-205861 | Medium | Windows Server 2019 insecure logons to an SMB server must be disabled
|
| V-253360 | Medium | Insecure logons to an SMB server must be disabled
|
| V-220802 | Medium | Insecure logons to an SMB server must be disabled
|
| V-254473 | Medium | Windows Server 2022 Kerberos encryption types must be configured to prevent the use of DES and RC...
|
| V-205708 | Medium | Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC...
|
| V-253460 | Medium | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites
|
| V-220936 | Medium | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites
|
| V-254460 | Medium | Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must...
|
| V-205825 | Medium | Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must...
|
| V-254461 | Medium | Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server ag...
|
| V-205826 | Medium | Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server ag...
|
| V-254463 | Medium | Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must...
|
| V-205827 | Medium | Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must...
|
| V-254464 | Medium | Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client ag...
|
| V-205828 | Medium | Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client ag...
|
| V-254468 | Medium | Windows Server 2022 must be configured to prevent anonymous users from having the same permission...
|
| V-205915 | Medium | Windows Server 2019 must be configured to prevent anonymous users from having the same permission...
|
| V-253455 | Medium | The system must be configured to prevent anonymous users from having the same rights as the Every...
|
| V-254277 | Medium | Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client
|
| V-205684 | Medium | Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client
|
| V-253288 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-220731 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-254276 | Medium | Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server
|
| V-205683 | Medium | Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server
|
| V-253287 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-220730 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-254471 | Medium | Windows Server 2022 must prevent NTLM from falling back to a Null session
|
| V-205917 | Medium | Windows Server 2019 must prevent NTLM from falling back to a Null session
|
| V-253458 | Medium | NTLM must be prevented from falling back to a Null session
|
| V-220934 | Medium | NTLM must be prevented from falling back to a Null session
|
| V-254433 | Medium | Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administr...
|
| V-205747 | Medium | Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administr...
|
| V-253457 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-220933 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-254470 | Medium | Windows Server 2022 services using Local System that use Negotiate when reverting to NTLM authent...
|
| V-205916 | Medium | Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authent...
|
| V-254477 | Medium | Windows Server 2022 session security for NTLM SSP-based clients must be configured to require NTL...
|
| V-205921 | Medium | Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTL...
|
| V-254478 | Medium | Windows Server 2022 session security for NTLM SSP-based servers must be configured to require NTL...
|
| V-205922 | Medium | Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTL...
|
| V-254462 | Medium | Windows Server 2022 unencrypted passwords must not be sent to third-party Server Message Block (S...
|
| V-205655 | Medium | Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (S...
|
| V-253450 | Medium | Unencrypted passwords must not be sent to third-party SMB Servers
|
| V-220926 | Medium | Unencrypted passwords must not be sent to third-party SMB Servers
|
| V-254275 | Medium | Windows Server 2022 must not the Server Message Block (SMB) v1 protocol installed
|
| V-205682 | Medium | Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed
|
| V-253353 | Medium | IPv6 source routing must be configured to highest protection
|
| V-220795 | Medium | IPv6 source routing must be configured to highest protection
|
| V-254272 | Medium | Windows Server 2022 must not have Simple TCP/IP Services installed
|
| V-205680 | Medium | Windows Server 2019 must not have Simple TCP/IP Services installed
|
| V-253277 | Medium | Simple TCP/IP Services must not be installed on the system
|
| V-220720 | Medium | Simple TCP/IP Services must not be installed on the system
|
| V-254288 | Medium | Windows Server 2022 password history must be configured to 24 passwords remembered
|
| V-205660 | Medium | Windows Server 2019 password history must be configured to 24 passwords remembered
|
| V-253300 | Medium | The password history must be configured to 24 passwords remembered
|
| V-220742 | Medium | The password history must be configured to 24 passwords remembered
|
| V-254258 | Medium | Windows Server 2022 passwords must be configured to expire
|
| V-205658 | Medium | Windows Server 2019 passwords must be configured to expire
|
| V-253273 | Medium | Accounts must be configured to require password expiration
|
| V-220716 | Medium | Accounts must be configured to require password expiration
|
| V-254377 | Medium | Windows Server 2022 PowerShell script block logging must be enabled
|
| V-205639 | Medium | Windows Server 2019 PowerShell script block logging must be enabled
|
| V-253414 | Medium | PowerShell script block logging must be enabled on Windows 11
|
| V-220860 | Medium | PowerShell script block logging must be enabled on Windows 10
|
| V-254278 | Medium | Windows Server 2022 must not have Windows PowerShell 2.0 installed
|
| V-205685 | Medium | Windows Server 2019 must not have Windows PowerShell 2.0 installed
|
| V-253285 | Medium | The Windows PowerShell 2.0 feature must be disabled on the system
|
| V-220728 | Medium | The Windows PowerShell 2.0 feature must be disabled on the system
|
| V-205869 | Medium | Windows Server 2019 Telemetry must be configured to Security or Basic
|
| V-253393 | Medium | Windows Telemetry must not be configured to Full
|
| V-220834 | Medium | Windows Telemetry must not be configured to Full
|
| V-254367 | Medium | Windows Server 2022 Remote Desktop Services must always prompt a client for passwords upon connec...
|
| V-205809 | Medium | Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connec...
|
| V-253404 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-220850 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-254369 | Medium | Windows Server 2022 Remote Desktop Services must be configured with the client connection encrypt...
|
| V-205637 | Medium | Windows Server 2019 Remote Desktop Services must be configured with the client connection encrypt...
|
| V-253406 | Medium | Remote Desktop Services must be configured with the client connection encryption set to the requi...
|
| V-220852 | Medium | Remote Desktop Services must be configured with the client connection encryption set to the requi...
|
| V-260471 | Medium | Ubuntu 22.04 LTS must initiate session audits at system startup
|
| V-260473 | Medium | Ubuntu 22.04 LTS must disable kernel core dumps so that it can fail to a secure state if system i...
|
| V-260474 | Medium | Ubuntu 22.04 LTS must implement address space layout randomization to protect its memory from una...
|
| V-260475 | Medium | Ubuntu 22.04 LTS must implement nonexecutable data to protect its memory from unauthorized code e...
|
| V-260477 | Medium | Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) removes all software c...
|
| V-260478 | Medium | Ubuntu 22.04 LTS must have the "libpam-pwquality" package installed
|
| V-260484 | Medium | Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and m...
|
| V-260485 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of "755" or les...
|
| V-260486 | Medium | Ubuntu 22.04 LTS must have system commands set to a mode of "755" or less permissive
|
| V-260487 | Medium | Ubuntu 22.04 LTS library files must have mode "755" or less permissive
|
| V-260488 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to have mode "755" or less permissive
|
| V-260489 | Medium | Ubuntu 22.04 LTS must generate error messages that provide information necessary for corrective a...
|
| V-260490 | Medium | Ubuntu 22.04 LTS must generate system journal entries without revealing information that could be...
|
| V-260491 | Medium | Ubuntu 22.04 LTS must configure "/var/log/syslog" file with mode "640" or less permissive
|
| V-260492 | Medium | Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive
|
| V-260493 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands owned by "root"
|
| V-260494 | Medium | Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root"
|
| V-260495 | Medium | Ubuntu 22.04 LTS must have system commands owned by "root" or a system account
|
| V-260496 | Medium | Ubuntu 22.04 LTS must have system commands group-owned by "root" or a system account
|
| V-260497 | Medium | Ubuntu 22.04 LTS library directories must be owned by "root"
|
| V-260498 | Medium | Ubuntu 22.04 LTS library directories must be group-owned by "root"
|
| V-260499 | Medium | Ubuntu 22.04 LTS library files must be owned by "root"
|
| V-260500 | Medium | Ubuntu 22.04 LTS library files must be group-owned by "root"
|
| V-260501 | Medium | Ubuntu 22.04 LTS must configure the directories used by the system journal to be owned by "root"
|
| V-260502 | Medium | Ubuntu 22.04 LTS must configure the directories used by the system journal to be group-owned by "...
|
| V-260503 | Medium | Ubuntu 22.04 LTS must configure the files used by the system journal to be owned by "root"
|
| V-260504 | Medium | Ubuntu 22.04 LTS must configure the files used by the system journal to be group-owned by "system...
|
| V-260505 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is owned by "root"
|
| V-260506 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is group-owned by "root"
|
| V-260507 | Medium | Ubuntu 22.04 LTS must configure audit tools to be owned by "root"
|
| V-260508 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to be owned by "root"
|
| V-260509 | Medium | Ubuntu 22.04 LTS must configure the "/var/log" directory to be group-owned by "syslog"
|
| V-260510 | Medium | Ubuntu 22.04 LTS must configure "/var/log/syslog" file to be owned by "syslog"
|
| V-260511 | Medium | Ubuntu 22.04 LTS must configure the "/var/log/syslog" file to be group-owned by "adm"
|
| V-260512 | Medium | Ubuntu 22.04 LTS must be configured so that the "journalctl" command is not accessible by unautho...
|
| V-260513 | Medium | Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unin...
|
| V-260514 | Medium | Ubuntu 22.04 LTS must have an application firewall installed in order to control remote access me...
|
| V-260515 | Medium | Ubuntu 22.04 LTS must enable and run the Uncomplicated Firewall (ufw)
|
| V-260516 | Medium | Ubuntu 22.04 LTS must have an application firewall enabled
|
| V-260517 | Medium | Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network i...
|
| V-260518 | Medium | Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocol...
|
| V-260522 | Medium | Ubuntu 22.04 LTS must be configured to use TCP syncookies
|
| V-260533 | Medium | Ubuntu 22.04 LTS SSH server must be configured to use only FIPS-validated key exchange algorithms
|
| V-260534 | Medium | Ubuntu 22.04 LTS must use strong authenticators in establishing nonlocal maintenance and diagnost...
|
| V-260537 | Medium | Ubuntu 22.04 LTS must retain a user's session lock until that user reestablishes access using est...
|
| V-260538 | Medium | Ubuntu 22.04 LTS must initiate a graphical session lock after 15 minutes of inactivity
|
| V-260540 | Medium | Ubuntu 22.04 LTS must disable automatic mounting of Universal Serial Bus (USB) mass storage driver
|
| V-260541 | Medium | Ubuntu 22.04 LTS must disable all wireless network adapters
|
| V-260542 | Medium | Ubuntu 22.04 LTS must prevent direct login into the root account
|
| V-260543 | Medium | Ubuntu 22.04 LTS must uniquely identify interactive users
|
| V-260545 | Medium | Ubuntu 22.04 LTS must enforce 24 hours/one day as the minimum password lifetime. Passwords for ne...
|
| V-260546 | Medium | Ubuntu 22.04 LTS must enforce a 60-day maximum password lifetime restriction. Passwords for new u...
|
| V-260547 | Medium | Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after...
|
| V-260548 | Medium | Ubuntu 22.04 LTS must automatically expire temporary accounts within 72 hours
|
| V-260553 | Medium | Ubuntu 22.04 LTS must allow users to directly initiate a session lock for all connection types
|
| V-260554 | Medium | Ubuntu 22.04 LTS must automatically exit interactive command shell user sessions after 15 minutes...
|
| V-260535 | Medium | Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DO...
|
| V-260536 | Medium | Ubuntu 22.04 LTS must display the Standard Mandatory DOD Notice and Consent Banner before grantin...
|
| V-260555 | Medium | Ubuntu 22.04 LTS default filesystem permissions must be defined in such a way that all authentica...
|
| V-260556 | Medium | Ubuntu 22.04 LTS must have the "apparmor" package installed
|
| V-260557 | Medium | Ubuntu 22.04 LTS must be configured to use AppArmor
|
| V-260558 | Medium | Ubuntu 22.04 LTS must require users to reauthenticate for privilege escalation or when changing r...
|
| V-260560 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one uppercase character b...
|
| V-260561 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring at least one lowercase character b...
|
| V-260562 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one numeric characte...
|
| V-260563 | Medium | Ubuntu 22.04 LTS must enforce password complexity by requiring that at least one special characte...
|
| V-260564 | Medium | Ubuntu 22.04 LTS must prevent the use of dictionary words for passwords
|
| V-260565 | Medium | Ubuntu 22.04 LTS must enforce a minimum 15-character password length
|
| V-260566 | Medium | Ubuntu 22.04 LTS must require the change of at least eight characters when passwords are changed
|
| V-260567 | Medium | Ubuntu 22.04 LTS must be configured so that when passwords are changed or new passwords are estab...
|
| V-260569 | Medium | Ubuntu 22.04 LTS must store only encrypted representations of passwords
|
| V-260572 | Medium | Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashi...
|
| V-260573 | Medium | Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accoun...
|
| V-260574 | Medium | Ubuntu 22.04 LTS must accept personal identity verification (PIV) credentials
|
| V-260575 | Medium | Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and ne...
|
| V-260576 | Medium | Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials
|
| V-260577 | Medium | Ubuntu 22.04 LTS, for PKI-based authentication, must validate certificates by constructing a cert...
|
| V-260578 | Medium | Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in...
|
| V-260580 | Medium | Ubuntu 22.04 LTS must use DOD PKI-established certificate authorities for verification of the est...
|
| V-260582 | Medium | Ubuntu 22.04 LTS must use a file integrity tool to verify correct operation of all security funct...
|
| V-260583 | Medium | Ubuntu 22.04 LTS must configure AIDE to perform file integrity checking on the file system
|
| V-260584 | Medium | Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an un...
|
| V-260585 | Medium | Ubuntu 22.04 LTS must be configured so that the script that runs each 30 days or less to check fi...
|
| V-260586 | Medium | Ubuntu 22.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools
|
| V-260588 | Medium | Ubuntu 22.04 LTS must be configured to preserve log records from failure events
|
| V-260589 | Medium | Ubuntu 22.04 LTS must monitor remote access methods
|
| V-260590 | Medium | Ubuntu 22.04 LTS must have the "auditd" package installed
|
| V-260591 | Medium | Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when,...
|
| V-260594 | Medium | Ubuntu 22.04 LTS must shut down by default upon audit failure
|
| V-260597 | Medium | Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by ...
|
| V-260598 | Medium | Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files
|
| V-260599 | Medium | Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files
|
| V-260600 | Medium | Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by un...
|
| V-260601 | Medium | Ubuntu 22.04 LTS must be configured so that audit configuration files are not write-accessible by...
|
| V-260602 | Medium | Ubuntu 22.04 LTS must permit only authorized accounts to own the audit configuration files
|
| V-260603 | Medium | Ubuntu 22.04 LTS must permit only authorized groups to own the audit configuration files
|
| V-260604 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the apparmor_par...
|
| V-260605 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chacl command
|
| V-260606 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chage command
|
| V-260607 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chcon command
|
| V-260608 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chfn command
|
| V-260609 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chsh command
|
| V-260610 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the crontab command
|
| V-260611 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the fdis...
|
| V-260612 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the gpasswd command
|
| V-260613 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use the kmod...
|
| V-260614 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful attempts to use modprobe...
|
| V-260615 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the mount command
|
| V-260616 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the newgrp command
|
| V-260617 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the pam_timestam...
|
| V-260618 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the passwd command
|
| V-260619 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the setfacl command
|
| V-260620 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-agent co...
|
| V-260621 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the ssh-keysign ...
|
| V-260622 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the su command
|
| V-260623 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudo command
|
| V-260624 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the sudoedit com...
|
| V-260625 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the umount command
|
| V-260626 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the unix_update ...
|
| V-260627 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the usermod command
|
| V-260628 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260629 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260630 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260631 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260632 | Medium | Ubuntu 22.04 LTS must generate audit records for all account creations, modifications, disabling,...
|
| V-260633 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chmod, fchmo...
|
| V-260634 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the chown, fchow...
|
| V-260635 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the creat, open,...
|
| V-260636 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the delete_modul...
|
| V-260637 | Medium | Ubuntu 22.04 LTS must generate audit records for successful/unsuccessful uses of the init_module ...
|
| V-260638 | Medium | Ubuntu 22.04 LTS must generate audit records for any use of the setxattr, fsetxattr, lsetxattr, r...
|
| V-260639 | Medium | Ubuntu 22.04 LTS must generate audit records for any successful/unsuccessful use of unlink, unlin...
|
| V-260640 | Medium | Ubuntu 22.04 LTS must generate audit records for all events that affect the systemd journal files
|
| V-260641 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/log/btmp file
|
| V-260642 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/log/wtmp file
|
| V-260643 | Medium | Ubuntu 22.04 LTS must generate audit records for the /var/run/utmp file
|
| V-260644 | Medium | Ubuntu 22.04 LTS must generate audit records for the use and modification of faillog file
|
| V-260645 | Medium | Ubuntu 22.04 LTS must generate audit records for the use and modification of the lastlog file
|
| V-260646 | Medium | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the ...
|
| V-260647 | Medium | Ubuntu 22.04 LTS must generate audit records when successful/unsuccessful attempts to modify the ...
|
| V-260648 | Medium | Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users e...
|
| V-260649 | Medium | Ubuntu 22.04 LTS must generate audit records for privileged activities, nonlocal maintenance, dia...
|
| V-254365 | Medium | Windows Server 2022 must not save passwords in the Remote Desktop Client
|
| V-205808 | Medium | Windows Server 2019 must not save passwords in the Remote Desktop Client
|
| V-253402 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-220848 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-254366 | Medium | Windows Server 2022 Remote Desktop Services must prevent drive redirection
|
| V-205722 | Medium | Windows Server 2019 Remote Desktop Services must prevent drive redirection
|
| V-224820 | Medium | Passwords for the built-in Administrator account must be changed at least every 60 days
|
| V-224822 | Medium | Members of the Backup Operators group must have separate accounts for backup duties and normal op...
|
| V-224823 | Medium | Manually managed application account passwords must be at least 14 characters in length
|
| V-224824 | Medium | Manually managed application account passwords must be changed at least annually or when a system...
|
| V-224825 | Medium | Shared user accounts must not be permitted on the system
|
| V-224826 | Medium | Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-224827 | Medium | Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-224830 | Medium | Servers must have a host-based intrusion detection or prevention system
|
| V-224832 | Medium | Permissions for the system drive root directory (usually C:\) must conform to minimum requirements
|
| V-224833 | Medium | Permissions for program file directories must conform to minimum requirements
|
| V-224834 | Medium | Permissions for the Windows installation directory must conform to minimum requirements
|
| V-224835 | Medium | Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained
|
| V-224837 | Medium | Outdated or unused accounts must be removed from the system or disabled
|
| V-224838 | Medium | Windows Server 2016 accounts must require passwords
|
| V-224839 | Medium | Passwords must be configured to expire
|
| V-224840 | Medium | System files must be monitored for unauthorized changes
|
| V-224841 | Medium | Non-system-created file shares on a system must limit access to groups that require it
|
| V-254368 | Medium | Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) commu...
|
| V-205636 | Medium | Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) commu...
|
| V-254431 | Medium | Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connec...
|
| V-205814 | Medium | Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connec...
|
| V-253383 | Medium | Unauthenticated RPC clients must be restricted from connecting to the RPC server
|
| V-220824 | Medium | Unauthenticated RPC clients must be restricted from connecting to the RPC server
|
| V-254379 | Medium | Windows Server 2022 Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-205816 | Medium | Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-253417 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-220863 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-224842 | Medium | Software certificate installation files must be removed from Windows Server 2016
|
| V-224844 | Medium | Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner ha...
|
| V-224845 | Medium | The roles and features required by the system must be documented
|
| V-224846 | Medium | A host-based firewall must be installed and enabled on the system
|
| V-224847 | Medium | Windows Server 2016 must employ automated mechanisms to determine the state of system components ...
|
| V-224848 | Medium | Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours
|
| V-224849 | Medium | Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is r...
|
| V-224850 | Medium | The Fax Server role must not be installed
|
| V-224851 | Medium | The Microsoft FTP service must not be installed unless required
|
| V-224852 | Medium | The Peer Name Resolution Protocol must not be installed
|
| V-224853 | Medium | Simple TCP/IP Services must not be installed
|
| V-224854 | Medium | The Telnet Client must not be installed
|
| V-224855 | Medium | The TFTP Client must not be installed
|
| V-224856 | Medium | The Server Message Block (SMB) v1 protocol must be uninstalled
|
| V-224857 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
|
| V-224858 | Medium | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
|
| V-224859 | Medium | Windows PowerShell 2.0 must not be installed
|
| V-224860 | Medium | FTP servers must be configured to prevent anonymous logons
|
| V-224861 | Medium | FTP servers must be configured to prevent access to the system drive
|
| V-224863 | Medium | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016
|
| V-224866 | Medium | Windows 2016 account lockout duration must be configured to 15 minutes or greater
|
| V-254380 | Medium | Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-205712 | Medium | Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-253421 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-220868 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-253426 | Medium | Windows 11 Kernel (Direct Memory Access) DMA Protection must be enabled
|
| V-220902 | Medium | Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled
|
| V-224867 | Medium | Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less
|
| V-224868 | Medium | Windows Server 2016 must have the period of time before the bad logon counter is reset configured...
|
| V-224869 | Medium | Windows Server 2016 password history must be configured to 24 passwords remembered
|
| V-224870 | Medium | Windows Server 2016 maximum password age must be configured to 60 days or less
|
| V-224871 | Medium | Windows Server 2016 minimum password age must be configured to at least one day
|
| V-224872 | Medium | Windows Server 2016 minimum password length must be configured to 14 characters
|
| V-224873 | Medium | Windows Server 2016 must have the built-in Windows password complexity policy enabled
|
| V-224875 | Medium | Audit records must be backed up to a different system or media than the system being audited
|
| V-224876 | Medium | Windows Server 2016 must, at a minimum, offload audit records of interconnected systems in real t...
|
| V-224877 | Medium | Permissions for the Application event log must prevent access by non-privileged accounts
|
| V-224878 | Medium | Permissions for the Security event log must prevent access by non-privileged accounts
|
| V-224879 | Medium | Permissions for the System event log must prevent access by non-privileged accounts
|
| V-254263 | Medium | Windows Server 2022 must implement protection methods such as TLS, encrypted VPNs, or IPsec if th...
|
| V-205829 | Medium | Windows Server 2019 must implement protection methods such as TLS, encrypted VPNs, or IPsec if th...
|
| V-254343 | Medium | Windows Server 2022 virtualization-based security must be enabled with the platform security leve...
|
| V-205864 | Medium | Windows Server 2019 virtualization-based security must be enabled with the platform security leve...
|
| V-253369 | Medium | Virtualization-based Security must be enabled on Windows 11 with the platform security level conf...
|
| V-220811 | Medium | Virtualization Based Security must be enabled on Windows 10 with the platform security level conf...
|
| V-224880 | Medium | Event Viewer must be protected from unauthorized modification and deletion
|
| V-224881 | Medium | Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes
|
| V-224882 | Medium | Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures
|
| V-224883 | Medium | Windows Server 2016 must be configured to audit Account Management - Other Account Management Eve...
|
| V-224884 | Medium | Windows Server 2016 must be configured to audit Account Management - Security Group Management su...
|
| V-224885 | Medium | Windows Server 2016 must be configured to audit Account Management - User Account Management succ...
|
| V-224886 | Medium | Windows Server 2016 must be configured to audit Account Management - User Account Management fail...
|
| V-224887 | Medium | Windows Server 2016 must be configured to audit Detailed Tracking - Plug and Play Events successes
|
| V-224888 | Medium | Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes
|
| V-224890 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-224891 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Group Membership successes
|
| V-224892 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes
|
| V-224893 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes
|
| V-224894 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures
|
| V-224895 | Medium | Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes
|
| V-224896 | Medium | Windows 2016 must be configured to audit Object Access - Other Object Access Events successes
|
| V-224897 | Medium | Windows 2016 must be configured to audit Object Access - Other Object Access Events failures
|
| V-224898 | Medium | Windows Server 2016 must be configured to audit Object Access - Removable Storage successes
|
| V-224899 | Medium | Windows Server 2016 must be configured to audit Object Access - Removable Storage failures
|
| V-224900 | Medium | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes
|
| V-224901 | Medium | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures
|
| V-224902 | Medium | Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change succ...
|
| V-224903 | Medium | Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change succe...
|
| V-224904 | Medium | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-224905 | Medium | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-224906 | Medium | Windows Server 2016 must be configured to audit System - IPsec Driver successes
|
| V-224907 | Medium | Windows Server 2016 must be configured to audit System - IPsec Driver failures
|
| V-224908 | Medium | Windows Server 2016 must be configured to audit System - Other System Events successes
|
| V-224909 | Medium | Windows Server 2016 must be configured to audit System - Other System Events failures
|
| V-224910 | Medium | Windows Server 2016 must be configured to audit System - Security State Change successes
|
| V-224911 | Medium | Windows Server 2016 must be configured to audit System - Security System Extension successes
|
| V-224912 | Medium | Windows Server 2016 must be configured to audit System - System Integrity successes
|
| V-224913 | Medium | Windows Server 2016 must be configured to audit System - System Integrity failures
|
| V-224914 | Medium | The display of slide shows on the lock screen must be disabled
|
| V-224915 | Medium | WDigest Authentication must be disabled on Windows Server 2016
|
| V-224920 | Medium | Insecure logons to an SMB server must be disabled
|
| V-224921 | Medium | Hardened UNC paths must be defined to require mutual authentication and integrity for at least th...
|
| V-224922 | Medium | Command line data must be included in process creation events
|
| V-224923 | Medium | Windows Server 2016 virtualization-based security must be enabled with the platform security leve...
|
| V-224924 | Medium | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers ident...
|
| V-224925 | Medium | Group Policy objects must be reprocessed even if they have not changed
|
| V-224926 | Medium | Downloading print driver packages over HTTP must be prevented
|
| V-224927 | Medium | Printing over HTTP must be prevented
|
| V-224928 | Medium | The network selection user interface (UI) must not be displayed on the logon screen
|
| V-224929 | Medium | Users must be prompted to authenticate when the system wakes from sleep (on battery)
|
| V-224930 | Medium | Users must be prompted to authenticate when the system wakes from sleep (plugged in)
|
| V-224935 | Medium | Administrator accounts must not be enumerated during elevation
|
| V-224936 | Medium | Windows Telemetry must be configured to Security or Basic
|
| V-224937 | Medium | The Application event log size must be configured to 32768 KB or greater
|
| V-224938 | Medium | The Security event log size must be configured to 196608 KB or greater
|
| V-224939 | Medium | The System event log size must be configured to 32768 KB or greater
|
| V-224940 | Medium | Windows Server 2016 Windows SmartScreen must be enabled
|
| V-224941 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-224943 | Medium | File Explorer shell protocol must run in protected mode
|
| V-224944 | Medium | Passwords must not be saved in the Remote Desktop Client
|
| V-224945 | Medium | Local drives must be prevented from sharing with Remote Desktop Session Hosts
|
| V-224946 | Medium | Remote Desktop Services must always prompt a client for passwords upon connection
|
| V-224947 | Medium | The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications
|
| V-224948 | Medium | Remote Desktop Services must be configured with the client connection encryption set to High Level
|
| V-224949 | Medium | Attachments must be prevented from being downloaded from RSS feeds
|
| V-236000 | Medium | The Windows Explorer Preview pane must be disabled for Windows Server 2016
|
| V-224951 | Medium | Basic authentication for RSS feeds over HTTP must not be used
|
| V-224952 | Medium | Indexing of encrypted files must be turned off
|
| V-224953 | Medium | Users must be prevented from changing installation options
|
| V-224955 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-224956 | Medium | Automatically signing in the last interactive user after a system-initiated restart must be disabled
|
| V-224957 | Medium | PowerShell script block logging must be enabled
|
| V-224959 | Medium | The Windows Remote Management (WinRM) client must not allow unencrypted traffic
|
| V-224960 | Medium | The Windows Remote Management (WinRM) client must not use Digest authentication
|
| V-224962 | Medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-224963 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-257502 | Medium | Windows Server 2016 must have PowerShell Transcription enabled
|
| V-224965 | Medium | Kerberos user logon restrictions must be enforced
|
| V-224966 | Medium | The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less
|
| V-224967 | Medium | The Kerberos user ticket lifetime must be limited to 10 hours or less
|
| V-224968 | Medium | The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less
|
| V-224969 | Medium | The computer clock synchronization tolerance must be limited to 5 minutes or less
|
| V-224975 | Medium | Data files owned by users must be on a different logical partition from the directory server data...
|
| V-224976 | Medium | Domain controllers must run on a machine dedicated to that function
|
| V-224977 | Medium | Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data in transi...
|
| V-224980 | Medium | Active Directory Group Policy objects must be configured with proper audit settings
|
| V-224981 | Medium | The Active Directory Domain object must be configured with proper audit settings
|
| V-224982 | Medium | The Active Directory Infrastructure object must be configured with proper audit settings
|
| V-224983 | Medium | The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with p...
|
| V-224984 | Medium | The Active Directory AdminSDHolder object must be configured with proper audit settings
|
| V-224985 | Medium | The Active Directory RID Manager$ object must be configured with proper audit settings
|
| V-224986 | Medium | Windows Server 2016 must be configured to audit Account Management - Computer Account Management ...
|
| V-224987 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes
|
| V-224988 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures
|
| V-224989 | Medium | Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes
|
| V-224991 | Medium | Domain controllers must have a PKI server certificate
|
| V-224994 | Medium | Active Directory user accounts, including administrators, must be configured to require the use o...
|
| V-254373 | Medium | Windows Server 2022 must prevent users from changing installation options
|
| V-205801 | Medium | Windows Server 2019 must prevent users from changing installation options
|
| V-253410 | Medium | Users must be prevented from changing installation options
|
| V-220856 | Medium | Users must be prevented from changing installation options
|
| V-254375 | Medium | Windows Server 2022 users must be notified if a web-based program attempts to install software
|
| V-205874 | Medium | Windows Server 2019 users must be notified if a web-based program attempts to install software
|
| V-253412 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-220858 | Medium | Users must be notified if a web-based program attempts to install software
|
| V-254362 | Medium | Windows Server 2022 Explorer Data Execution Prevention must be enabled
|
| V-205830 | Medium | Windows Server 2019 Explorer Data Execution Prevention must be enabled
|
| V-253396 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-220837 | Medium | Explorer Data Execution Prevention must be enabled
|
| V-254442 | Medium | Windows Server 2022 must have the DoD Root Certificate Authority (CA) certificates installed in t...
|
| V-205648 | Medium | Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in t...
|
| V-253427 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-220903 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-254269 | Medium | Windows Server 2022 must not have the Fax Server role installed
|
| V-205678 | Medium | Windows Server 2019 must not have the Fax Server role installed
|
| V-254270 | Medium | Windows Server 2022 must not have the Microsoft FTP service installed unless required by the orga...
|
| V-205697 | Medium | Windows Server 2019 must not have the Microsoft FTP service installed unless required by the orga...
|
| V-254271 | Medium | Windows Server 2022 must not have the Peer Name Resolution Protocol installed
|
| V-205679 | Medium | Windows Server 2019 must not have the Peer Name Resolution Protocol installed
|
| V-254273 | Medium | Windows Server 2022 must not have the Telnet Client installed
|
| V-205698 | Medium | Windows Server 2019 must not have the Telnet Client installed
|
| V-253278 | Medium | The Telnet Client must not be installed on the system
|
| V-220721 | Medium | The Telnet Client must not be installed on the system
|
| V-254274 | Medium | Windows Server 2022 must not have the TFTP Client installed
|
| V-205681 | Medium | Windows Server 2019 must not have the TFTP Client installed
|
| V-253279 | Medium | The TFTP Client must not be installed on the system
|
| V-220722 | Medium | The TFTP Client must not be installed on the system
|
| V-254284 | Medium | Windows Server 2022 must have Secure Boot enabled
|
| V-253257 | Medium | Secure Boot must be enabled on Windows 11 systems
|
| V-224995 | Medium | Domain controllers must require LDAP access signing
|
| V-224996 | Medium | Domain controllers must be configured to allow reset of machine account passwords
|
| V-224997 | Medium | The Access this computer from the network user right must only be assigned to the Administrators,...
|
| V-224998 | Medium | The Add workstations to domain user right must only be assigned to the Administrators group
|
| V-224999 | Medium | The Allow log on through Remote Desktop Services user right must only be assigned to the Administ...
|
| V-225000 | Medium | The Deny access to this computer from the network user right on domain controllers must be config...
|
| V-225001 | Medium | The Deny log on as a batch job user right on domain controllers must be configured to prevent una...
|
| V-225002 | Medium | The Deny log on as a service user right must be configured to include no accounts or groups (blan...
|
| V-225003 | Medium | The Deny log on locally user right on domain controllers must be configured to prevent unauthenti...
|
| V-225004 | Medium | The Deny log on through Remote Desktop Services user right on domain controllers must be configur...
|
| V-225005 | Medium | The Enable computer and user accounts to be trusted for delegation user right must only be assign...
|
| V-225006 | Medium | The password for the krbtgt account on a domain must be reset at least every 180 days
|
| V-225008 | Medium | Local administrator accounts must have their privileged token filtered to prevent elevated privil...
|
| V-225009 | Medium | Local users on domain-joined computers must not be enumerated
|
| V-225010 | Medium | Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC...
|
| V-225011 | Medium | Caching of logon credentials must be limited
|
| V-225013 | Medium | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
|
| V-225014 | Medium | The "Access this computer from the network" user right must only be assigned to the Administrator...
|
| V-225015 | Medium | The "Deny access to this computer from the network" user right on member servers must be configur...
|
| V-225016 | Medium | The "Deny log on as a batch job" user right on member servers must be configured to prevent acces...
|
| V-225017 | Medium | The "Deny log on as a service" user right on member servers must be configured to prevent access ...
|
| V-225018 | Medium | The "Deny log on locally" user right on member servers must be configured to prevent access from ...
|
| V-225019 | Medium | The "Deny log on through Remote Desktop Services" user right on member servers must be configured...
|
| V-225020 | Medium | The "Enable computer and user accounts to be trusted for delegation" user right must not be assig...
|
| V-225021 | Medium | The DoD Root CA certificates must be installed in the Trusted Root Store
|
| V-225022 | Medium | The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificat...
|
| V-225023 | Medium | The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Ce...
|
| V-225024 | Medium | Windows Server 2016 built-in guest account must be disabled
|
| V-225026 | Medium | Windows Server 2016 built-in administrator account must be renamed
|
| V-225027 | Medium | Windows Server 2016 built-in guest account must be renamed
|
| V-225028 | Medium | Audit policy using subcategories must be enabled
|
| V-225029 | Medium | The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configu...
|
| V-225030 | Medium | The setting Domain member: Digitally encrypt secure channel data (when possible) must be configur...
|
| V-225031 | Medium | The setting Domain member: Digitally sign secure channel data (when possible) must be configured ...
|
| V-225032 | Medium | The computer account password must not be prevented from being reset
|
| V-225033 | Medium | The maximum age for machine account passwords must be configured to 30 days or less
|
| V-225034 | Medium | Windows Server 2016 must be configured to require a strong session key
|
| V-225035 | Medium | The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver
|
| V-225036 | Medium | The required legal notice must be configured to display before console logon
|
| V-225038 | Medium | The Smart Card removal option must be configured to Force Logoff or Lock Workstation
|
| V-225039 | Medium | The setting Microsoft network client: Digitally sign communications (always) must be configured t...
|
| V-225040 | Medium | The setting Microsoft network client: Digitally sign communications (if server agrees) must be co...
|
| V-225041 | Medium | Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers
|
| V-225042 | Medium | The setting Microsoft network server: Digitally sign communications (always) must be configured t...
|
| V-225043 | Medium | The setting Microsoft network server: Digitally sign communications (if client agrees) must be co...
|
| V-225047 | Medium | Windows Server 2016 must be configured to prevent anonymous users from having the same permission...
|
| V-225093 | Medium | The Take ownership of files or other objects user right must only be assigned to the Administrato...
|
| V-254383 | Medium | Windows Server 2022 Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-205810 | Medium | Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-253420 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-220867 | Medium | The Windows Remote Management (WinRM) service must not store RunAs credentials
|
| V-254382 | Medium | Windows Server 2022 Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-205817 | Medium | Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-253419 | Medium | The Windows Remote Management (WinRM) service must not allow unencrypted traffic
|
| V-254238 | Medium | Windows Server 2022 users with Administrative privileges must have separate accounts for administ...
|
| V-254239 | Medium | Windows Server 2022 passwords for the built-in Administrator account must be changed at least eve...
|
| V-205657 | Medium | Windows Server 2019 passwords for the built-in Administrator account must be changed at least eve...
|
| V-253476 | Medium | Passwords for enabled local Administrator accounts must be changed at least every 60 days
|
| V-220952 | Medium | Passwords for enabled local Administrator accounts must be changed at least every 60 days
|
| V-254241 | Medium | Windows Server 2022 members of the Backup Operators group must have separate accounts for backup ...
|
| V-205846 | Medium | Windows Server 2019 members of the Backup Operators group must have separate accounts for backup ...
|
| V-253270 | Medium | Only accounts responsible for the backup operations must be members of the Backup Operators group
|
| V-220713 | Medium | Only accounts responsible for the backup operations must be members of the Backup Operators group
|
| V-254242 | Medium | Windows Server 2022 manually managed application account passwords must be at least 14 characters...
|
| V-205661 | Medium | Windows Server 2019 manually managed application account passwords must be at least 14 characters...
|
| V-254243 | Medium | Windows Server 2022 manually managed application account passwords must be changed at least annua...
|
| V-205847 | Medium | Windows Server 2019 manually managed application account passwords must be changed at least annua...
|
| V-254244 | Medium | Windows Server 2022 shared user accounts must not be permitted
|
| V-205699 | Medium | Windows Server 2019 shared user accounts must not be permitted
|
| V-254245 | Medium | Windows Server 2022 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-205807 | Medium | Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of ...
|
| V-253262 | Medium | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of...
|
| V-220705 | Medium | The operating system must employ a deny-all, permit-by-exception policy to allow the execution of...
|
| V-254246 | Medium | Windows Server 2022 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-205848 | Medium | Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and r...
|
| V-253255 | Medium | Windows 11 domain-joined systems must have a Trusted Platform Module (TPM) enabled
|
| V-220698 | Medium | Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use
|
| V-263646 | Medium | The DNS server implementation must compare the internal system clocks on an organization-defined ...
|
| V-263645 | Medium | The DNS server implementation must synchronize system clocks within and between systems or system...
|
| V-263644 | Medium | The DNS server implementation must provide protected storage for cryptographic keys with organiza...
|
| V-263643 | Medium | The DNS server implementation must include only approved trust anchors in trust stores or certifi...
|
| V-263642 | Medium | The DNS server implementation must protect nonlocal maintenance sessions by separating the mainte...
|
| V-263641 | Medium | The DNS server implementation must, for public key-based authentication, implement a local cache ...
|
| V-263640 | Medium | The DNS server implementation must, for password-based authentication, enforce organization-defin...
|
| V-263639 | Medium | The DNS server implementation must, for password-based authentication, employ automated tools to ...
|
| V-263638 | Medium | The DNS server implementation must, for password-based authentication, allow user selection of lo...
|
| V-263637 | Medium | The DNS server implementation must, for password-based authentication, require immediate selectio...
|
| V-263636 | Medium | The DNS server implementation must, for password-based authentication, store passwords using an a...
|
| V-263635 | Medium | The DNS server implementation must, for password-based authentication, verify when users create o...
|
| V-263634 | Medium | The DNS server implementation must, for password-based authentication, update the list of passwor...
|
| V-263633 | Medium | The DNS server implementation must, for password-based authentication, update the list of passwor...
|
| V-263632 | Medium | The DNS server implementation must, for password-based authentication, maintain a list of commonl...
|
| V-263631 | Medium | The DNS server implementation must implement multifactor authentication for local; network; and/o...
|
| V-263630 | Medium | The DNS server implementation must implement multifactor authentication for local; network; and/o...
|
| V-263629 | Medium | The DNS server implementation must require users to be individually authenticated before granting...
|
| V-263628 | Medium | The DNS server implementation must prevent the installation of organization-defined software and ...
|
| V-263627 | Medium | The DNS server implementation must automatically generate audit records of the enforcement actions.
|
| V-263626 | Medium | The DNS server implementation must alert organization-defined personnel or roles upon detection o...
|
| V-263625 | Medium | The DNS server implementation must implement the capability to centrally review and analyze audit...
|
| V-263624 | Medium | The DNS server implementation must disable accounts when the accounts are no longer associated to...
|
| V-263623 | Medium | The DNS server implementation must disable accounts when the accounts have expired.
|
| V-220317 | Medium | All authoritative name servers for a zone must be geographically disbursed.
|
| V-220316 | Medium | A unique TSIG key must be generated for each pair of communicating hosts.
|
| V-205253 | Medium | The DNS server implementation must be configured in accordance with the security configuration se...
|
| V-205252 | Medium | CNAME records must not point to a zone with lesser security for more than six months.
|
| V-205251 | Medium | A zone file must not include resource records that resolve to a fully qualified domain name resid...
|
| V-205250 | Medium | The private keys corresponding to both the ZSK and the KSK must not be kept on the DNSSEC-aware p...
|
| V-205249 | Medium | The private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must ...
|
| V-205248 | Medium | The platform on which the name server software is hosted must be configured to send outgoing DNS ...
|
| V-205247 | Medium | The platform on which the name server software is hosted must be configured to respond to DNS tra...
|
| V-205246 | Medium | The IP address for hidden master authoritative name servers must not appear in the name servers s...
|
| V-205245 | Medium | The DNS Name Server software must run with restricted privileges.
|
| V-205244 | Medium | The DNS name server software must be at the latest version.
|
| V-205243 | Medium | The DNS must utilize valid root name servers in the local root zone file.
|
| V-205242 | Medium | The DNS implementation must implement internal/external role separation.
|
| V-205241 | Medium | The DNS implementation must enforce a Discretionary Access Control (DAC) policy that limits propa...
|
| V-205240 | Medium | The DNS implementation must be conformant to the IETF DNS specification.
|
| V-205239 | Medium | Primary authoritative name servers must be configured to only receive zone transfer requests from...
|
| V-205238 | Medium | In a split DNS configuration, where separate name servers are used between the external and inter...
|
| V-205237 | Medium | In a split DNS configuration, where separate name servers are used between the external and inter...
|
| V-205236 | Medium | For zones split between the external and internal sides of a network, the RRs for the external ho...
|
| V-205235 | Medium | Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.
|
| V-205234 | Medium | An authoritative name server must be configured to enable DNSSEC Resource Records.
|
| V-205233 | Medium | All authoritative name servers for a zone must have the same version of zone information.
|
| V-205232 | Medium | All authoritative name servers for a zone must be located on different network segments.
|
| V-205231 | Medium | The two files generated by the dnssec-keygen program must be made accessible only to the server a...
|
| V-205230 | Medium | The DNS implementation must ensure each NS record in a zone file points to an active name server ...
|
| V-205229 | Medium | NSEC3 must be used for all internal DNS zones.
|
| V-205228 | Medium | The validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days an...
|
| V-205227 | Medium | The salt value for zones signed using NSEC3 RRs must be changed every time the zone is completely...
|
| V-205226 | Medium | The DNS server must implement NIST FIPS-validated cryptography for provisioning digital signature...
|
| V-205225 | Medium | The DNS implementation must generate audit records for the success and failure of all name server...
|
| V-205224 | Medium | The DNS implementation must generate audit records for the success and failure of start and stop ...
|
| V-205223 | Medium | The DNS server implementation must log the event and notify the system administrator when anomali...
|
| V-205222 | Medium | The DNS server implementation must perform verification of the correct operation of security func...
|
| V-205221 | Medium | The DNS server implementation must follow procedures to re-role a secondary name server as the ma...
|
| V-205220 | Medium | The DNS server implementation must behave in a predictable and documented manner that reflects or...
|
| V-205219 | Medium | The DNS server implementation must maintain the integrity of information during reception.
|
| V-205218 | Medium | The DNS server implementation must maintain the integrity of information during preparation for t...
|
| V-205217 | Medium | The DNS server implementation must implement cryptographic mechanisms to detect changes to inform...
|
| V-205213 | Medium | If the DNS server is using SIG(0), the DNS server implementation must only allow the use of DoD P...
|
| V-205212 | Medium | A DNS server implementation must perform data origin verification authentication on the name/addr...
|
| V-205211 | Medium | A DNS server implementation must perform data integrity verification on the name/address resoluti...
|
| V-205210 | Medium | A DNS server implementation must request data integrity verification on the name/address resoluti...
|
| V-205209 | Medium | A DNS server implementation must request data origin authentication verification on the name/addr...
|
| V-205208 | Medium | A DNS server implementation must provide additional integrity artifacts along with the authoritat...
|
| V-205207 | Medium | A DNS server implementation must provide data integrity protection artifacts for internal name/ad...
|
| V-205206 | Medium | A DNS server implementation must provide data origin artifacts for internal name/address resoluti...
|
| V-205205 | Medium | The DNS server implementation, for PKI-based authentication, must implement a local cache of revo...
|
| V-205204 | Medium | The DNS server implementation must authenticate another DNS server before establishing a remote a...
|
| V-205203 | Medium | The DNS server implementation must authenticate the other DNS server before responding to a serve...
|
| V-205201 | Medium | The DNS implementation must prohibit recursion on authoritative name servers.
|
| V-205199 | Medium | In the event of an error when validating the binding of another DNS servers identity to the DNS i...
|
| V-205198 | Medium | The DNS server implementation must validate the binding of the other DNS servers identity to the ...
|
| V-205197 | Medium | The DNS server implementation must provide the means for authorized individuals to determine the ...
|
| V-205196 | Medium | The DNS server implementation must strongly bind the identity of the DNS server with the DNS info...
|
| V-205193 | Medium | The DNS server implementation must be configured to generate audit records for failed security ve...
|
| V-205192 | Medium | The DNS server implementation must, when a component failure is detected, activate a notification...
|
| V-205191 | Medium | The DNS server implementation must check the validity of all data inputs except those specificall...
|
| V-205190 | Medium | The DNS server implementation must manage excess capacity, bandwidth, or other redundancy to limi...
|
| V-205189 | Medium | The DNS server implementation must restrict the ability of individuals to use the DNS server to l...
|
| V-205188 | Medium | The DNS server implementation must prevent unauthorized and unintended information transfer via s...
|
| V-205187 | Medium | The DNS server implementation must protect the confidentiality and integrity of secret/private cr...
|
| V-205186 | Medium | In the event of a system failure, the DNS server implementation must preserve any information nec...
|
| V-205185 | Medium | The DNS server implementation must fail to a secure state if system initialization fails, shutdow...
|
| V-205184 | Medium | The DNS implementation must protect the authenticity of communications sessions for queries.
|
| V-205183 | Medium | The DNS implementation must protect the authenticity of communications sessions for dynamic updates.
|
| V-205182 | Medium | The DNS implementation must protect the authenticity of communications sessions for zone transfers.
|
| V-205180 | Medium | A DNS server implementation must provide the means to enable verification of a chain of trust amo...
|
| V-205179 | Medium | The DNS server implementation must enforce approved authorizations for controlling the flow of in...
|
| V-205178 | Medium | The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no l...
|
| V-205177 | Medium | A DNS server implementation must provide the means to indicate the security status of child zones.
|
| V-205176 | Medium | A DNS server implementation must provide additional data origin artifacts along with the authorit...
|
| V-205175 | Medium | The DNS server implementation must employ strong authenticators in the establishment of nonlocal ...
|
| V-205174 | Medium | Signature generation using the KSK must be done off-line, using the KSK-private stored off-line.
|
| V-205173 | Medium | Only the private key corresponding to the ZSK alone must be kept on the name server that does sup...
|
| V-205172 | Medium | Read/Write access to the key file must be restricted to the account that runs the name server sof...
|
| V-205171 | Medium | The key file must be owned by the account under which the name server software is run.
|
| V-205170 | Medium | The DNS server implementation, when using PKI-based authentication, must enforce authorized acces...
|
| V-205169 | Medium | The DNS server implementation must uniquely identify the other DNS server before responding to a ...
|
| V-205168 | Medium | The DNS server implementation must be configured to prohibit or restrict unapproved ports and pro...
|
| V-205167 | Medium | The DNS server implementations audit records must be backed up at least every seven days onto a d...
|
| V-205166 | Medium | The DNS server implementation must generate audit records containing information that establishes...
|
| V-205165 | Medium | The DNS server implementation must produce audit records that contain information to establish th...
|
| V-205164 | Medium | The DNS server implementation must produce audit records containing information to establish the ...
|
| V-205163 | Medium | The DNS server implementation must produce audit records containing information to establish wher...
|
| V-205162 | Medium | The DNS server implementation must produce audit records containing information to establish when...
|
| V-205161 | Medium | The DNS server implementation must produce audit records containing information to establish what...
|
| V-205160 | Medium | The DNS server implementation must be configured to provide audit record generation capability fo...
|
| V-205159 | Medium | The DNS server implementation must be configured to provide audit record generation capability fo...
|
| V-205158 | Medium | The DNS implementation must limit the number of concurrent sessions client connections to the num...
|
| V-205157 | Medium | The DNS implementation must limit the number of concurrent sessions for zone transfers to the num...
|
| V-253256 | Medium | Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configu...
|
| V-254283 | Medium | Windows Server 2022 systems must have Unified Extensible Firmware Interface (UEFI) firmware and b...
|
| V-220699 | Medium | Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configu...
|
| V-254325 | Medium | Windows Server 2022 must be configured to audit System - IPsec Driver successes
|
| V-205777 | Medium | Windows Server 2019 must be configured to audit System - IPsec Driver successes
|
| V-254326 | Medium | Windows Server 2022 must be configured to audit System - IPsec Driver failures
|
| V-205778 | Medium | Windows Server 2019 must be configured to audit System - IPsec Driver failures
|
| V-254303 | Medium | Windows Server 2022 must be configured to audit Account Management - Security Group Management su...
|
| V-205625 | Medium | Windows Server 2019 must be configured to audit Account Management - Security Group Management su...
|
| V-253308 | Medium | The system must be configured to audit Account Management - Security Group Management successes
|
| V-220750 | Medium | The system must be configured to audit Account Management - Security Group Management successes
|
| V-254304 | Medium | Windows Server 2022 must be configured to audit Account Management - User Account Management succ...
|
| V-205626 | Medium | Windows Server 2019 must be configured to audit Account Management - User Account Management succ...
|
| V-253310 | Medium | The system must be configured to audit Account Management - User Account Management successes
|
| V-220752 | Medium | The system must be configured to audit Account Management - User Account Management successes
|
| V-254305 | Medium | Windows Server 2022 must be configured to audit Account Management - User Account Management fail...
|
| V-205627 | Medium | Windows Server 2019 must be configured to audit Account Management - User Account Management fail...
|
| V-253309 | Medium | The system must be configured to audit Account Management - User Account Management failures
|
| V-220751 | Medium | The system must be configured to audit Account Management - User Account Management failures
|
| V-254306 | Medium | Windows Server 2022 must be configured to audit Detailed Tracking - Plug and Play Events successes
|
| V-205839 | Medium | Windows Server 2019 must be configured to audit Detailed Tracking - Plug and Play Events successes
|
| V-254310 | Medium | Windows Server 2022 must be configured to audit Logon/Logoff - Group Membership successes
|
| V-205834 | Medium | Windows Server 2019 must be configured to audit Logon/Logoff - Group Membership successes
|
| V-253314 | Medium | The system must be configured to audit Logon/Logoff - Group Membership successes
|
| V-220756 | Medium | The system must be configured to audit Logon/Logoff - Group Membership successes
|
| V-254311 | Medium | Windows Server 2022 must be configured to audit logoff successes
|
| V-205838 | Medium | Windows Server 2019 must be configured to audit logoff successes
|
| V-253315 | Medium | The system must be configured to audit Logon/Logoff - Logoff successes
|
| V-220757 | Medium | The system must be configured to audit Logon/Logoff - Logoff successes
|
| V-254312 | Medium | Windows Server 2022 must be configured to audit logon successes
|
| V-205634 | Medium | Windows Server 2019 must be configured to audit logon successes
|
| V-253317 | Medium | The system must be configured to audit Logon/Logoff - Logon successes
|
| V-220759 | Medium | The system must be configured to audit Logon/Logoff - Logon successes
|
| V-254313 | Medium | Windows Server 2022 must be configured to audit logon failures
|
| V-205635 | Medium | Windows Server 2019 must be configured to audit logon failures
|
| V-253316 | Medium | The system must be configured to audit Logon/Logoff - Logon failures
|
| V-220758 | Medium | The system must be configured to audit Logon/Logoff - Logon failures
|
| V-254314 | Medium | Windows Server 2022 must be configured to audit Logon/Logoff - Special Logon successes
|
| V-205835 | Medium | Windows Server 2019 must be configured to audit Logon/Logoff - Special Logon successes
|
| V-253318 | Medium | The system must be configured to audit Logon/Logoff - Special Logon successes
|
| V-220760 | Medium | The system must be configured to audit Logon/Logoff - Special Logon successes
|
| V-254315 | Medium | Windows Server 2022 must be configured to audit Object Access - Other Object Access Events successes
|
| V-205836 | Medium | Windows Server 2019 must be configured to audit Object Access - Other Object Access Events successes
|
| V-253321 | Medium | Windows 11 must be configured to audit Object Access - Other Object Access Events successes
|
| V-220763 | Medium | Windows 10 must be configured to audit Object Access - Other Object Access Events successes
|
| V-254316 | Medium | Windows Server 2022 must be configured to audit Object Access - Other Object Access Events failures
|
| V-205837 | Medium | Windows Server 2019 must be configured to audit Object Access - Other Object Access Events failures
|
| V-253322 | Medium | Windows 11 must be configured to audit Object Access - Other Object Access Events failures
|
| V-220764 | Medium | Windows 10 must be configured to audit Object Access - Other Object Access Events failures
|
| V-254318 | Medium | Windows Server 2022 must be configured to audit Object Access - Removable Storage failures
|
| V-205841 | Medium | Windows Server 2019 must be configured to audit Object Access - Removable Storage failures
|
| V-253323 | Medium | The system must be configured to audit Object Access - Removable Storage failures
|
| V-220765 | Medium | The system must be configured to audit Object Access - Removable Storage failures
|
| V-254319 | Medium | Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change successes
|
| V-205771 | Medium | Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes
|
| V-253325 | Medium | The system must be configured to audit Policy Change - Audit Policy Change successes
|
| V-220767 | Medium | The system must be configured to audit Policy Change - Audit Policy Change successes
|
| V-254320 | Medium | Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change failures
|
| V-205772 | Medium | Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures
|
| V-254321 | Medium | Windows Server 2022 must be configured to audit Policy Change - Authentication Policy Change succ...
|
| V-205773 | Medium | Windows Server 2019 must be configured to audit Policy Change - Authentication Policy Change succ...
|
| V-253326 | Medium | The system must be configured to audit Policy Change - Authentication Policy Change successes
|
| V-220768 | Medium | The system must be configured to audit Policy Change - Authentication Policy Change successes
|
| V-254322 | Medium | Windows Server 2022 must be configured to audit Policy Change - Authorization Policy Change succe...
|
| V-205774 | Medium | Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change succe...
|
| V-253327 | Medium | The system must be configured to audit Policy Change - Authorization Policy Change successes
|
| V-220769 | Medium | The system must be configured to audit Policy Change - Authorization Policy Change successes
|
| V-254323 | Medium | Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-205775 | Medium | Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-253329 | Medium | The system must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-220771 | Medium | The system must be configured to audit Privilege Use - Sensitive Privilege Use successes
|
| V-254324 | Medium | Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-205776 | Medium | Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-253328 | Medium | The system must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-220770 | Medium | The system must be configured to audit Privilege Use - Sensitive Privilege Use failures
|
| V-254327 | Medium | Windows Server 2022 must be configured to audit System - Other System Events successes
|
| V-205779 | Medium | Windows Server 2019 must be configured to audit System - Other System Events successes
|
| V-253331 | Medium | The system must be configured to audit System - Other System Events successes
|
| V-220773 | Medium | The system must be configured to audit System - Other System Events successes
|
| V-254328 | Medium | Windows Server 2022 must be configured to audit System - Other System Events failures
|
| V-205780 | Medium | Windows Server 2019 must be configured to audit System - Other System Events failures
|
| V-253332 | Medium | The system must be configured to audit System - Other System Events failures
|
| V-220774 | Medium | The system must be configured to audit System - Other System Events failures
|
| V-254329 | Medium | Windows Server 2022 must be configured to audit System - Security State Change successes
|
| V-205781 | Medium | Windows Server 2019 must be configured to audit System - Security State Change successes
|
| V-253333 | Medium | The system must be configured to audit System - Security State Change successes
|
| V-220775 | Medium | The system must be configured to audit System - Security State Change successes
|
| V-254330 | Medium | Windows Server 2022 must be configured to audit System - Security System Extension successes
|
| V-205782 | Medium | Windows Server 2019 must be configured to audit System - Security System Extension successes
|
| V-253334 | Medium | The system must be configured to audit System - Security System Extension successes
|
| V-220776 | Medium | The system must be configured to audit System - Security System Extension successes
|
| V-254331 | Medium | Windows Server 2022 must be configured to audit System - System Integrity successes
|
| V-205783 | Medium | Windows Server 2019 must be configured to audit System - System Integrity successes
|
| V-253336 | Medium | The system must be configured to audit System - System Integrity successes
|
| V-220778 | Medium | The system must be configured to audit System - System Integrity successes
|
| V-254332 | Medium | Windows Server 2022 must be configured to audit System - System Integrity failures
|
| V-205784 | Medium | Windows Server 2019 must be configured to audit System - System Integrity failures
|
| V-253335 | Medium | The system must be configured to audit System - System Integrity failures
|
| V-220777 | Medium | The system must be configured to audit System - System Integrity failures
|
| V-254302 | Medium | Windows Server 2022 must be configured to audit Account Management - Other Account Management Eve...
|
| V-205769 | Medium | Windows Server 2019 must be configured to audit Account Management - Other Account Management Eve...
|
| V-254300 | Medium | Windows Server 2022 must be configured to audit Account Logon - Credential Validation successes
|
| V-205832 | Medium | Windows Server 2019 must be configured to audit Account Logon - Credential Validation successes
|
| V-253307 | Medium | The system must be configured to audit Account Logon - Credential Validation successes
|
| V-220749 | Medium | The system must be configured to audit Account Logon - Credential Validation successes
|
| V-254301 | Medium | Windows Server 2022 must be configured to audit Account Logon - Credential Validation failures
|
| V-205833 | Medium | Windows Server 2019 must be configured to audit Account Logon - Credential Validation failures
|
| V-253306 | Medium | The system must be configured to audit Account Logon - Credential Validation failures
|
| V-220748 | Medium | The system must be configured to audit Account Logon - Credential Validation failures
|
| V-254407 | Medium | Windows Server 2022 must be configured to audit Account Management - Computer Account Management ...
|
| V-205628 | Medium | Windows Server 2019 must be configured to audit Account Management - Computer Account Management ...
|
| V-254408 | Medium | Windows Server 2022 must be configured to audit DS Access - Directory Service Access successes
|
| V-205791 | Medium | Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes
|
| V-254410 | Medium | Windows Server 2022 must be configured to audit DS Access - Directory Service Changes successes
|
| V-205793 | Medium | Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes
|
| V-254307 | Medium | Windows Server 2022 must be configured to audit Detailed Tracking - Process Creation successes
|
| V-205770 | Medium | Windows Server 2019 must be configured to audit Detailed Tracking - Process Creation successes
|
| V-253312 | Medium | The system must be configured to audit Detailed Tracking - Process Creation successes
|
| V-220754 | Medium | The system must be configured to audit Detailed Tracking - Process Creation successes
|
| V-254309 | Medium | Windows Server 2022 must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-205730 | Medium | Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-253313 | Medium | The system must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-220755 | Medium | The system must be configured to audit Logon/Logoff - Account Lockout failures
|
| V-254356 | Medium | Windows Server 2022 Diagnostic Data must be configured to send "required diagnostic data" or "opt...
|
| V-257503 | Medium | Windows Server 2019 must have PowerShell Transcription enabled
|
| V-253415 | Medium | PowerShell Transcription must be enabled on Windows 11
|
| V-252896 | Medium | PowerShell Transcription must be enabled on Windows 10
|
| V-254384 | Medium | Windows Server 2022 must have PowerShell Transcription enabled
|
| V-218786 | Medium | Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled
|
| V-218788 | Medium | The IIS 10.0 web server must produce log records that contain sufficient information to establish...
|
| V-218789 | Medium | The IIS 10.0 web server must produce log records containing sufficient information to establish t...
|
| V-218790 | Medium | The log information from the IIS 10.0 web server must be protected from unauthorized modification...
|
| V-218791 | Medium | The log data and records from the IIS 10.0 web server must be backed up onto a different system o...
|
| V-218792 | Medium | The IIS 10.0 web server must not perform user management for hosted applications
|
| V-218793 | Medium | The IIS 10.0 web server must only contain functions necessary for operation
|
| V-218794 | Medium | The IIS 10.0 web server must not be both a website server and a proxy server
|