UCF STIG Viewer Logo

Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide


Overview

Date Finding Count (325)
2019-06-18 CAT I (High): 39 CAT II (Med): 230 CAT III (Low): 56
STIG Description
The Windows Server 2008 R2 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements were developed from DoD consensus, as well as the Windows Server 2008 R2 Security Guide and security templates published by Microsoft Corporation. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Available Profiles



Findings (MAC III - Administrative Classified)

Finding ID Severity Title
V-1074 High The Windows 2008 R2 system must use an anti-virus program.
V-1073 High Systems must be at supported service pack (SP) or release levels.
V-34974 High The Windows Installer Always install with elevated privileges must be disabled.
V-39332 High The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
V-39333 High Domain created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
V-26479 High Unauthorized accounts must not have the Create a token object user right.
V-26070 High Standard user accounts must only have Read permissions to the Winlogon registry key.
V-3337 High Anonymous SID/Name translation must not be allowed.
V-27119 High The Active Directory SYSVOL directory must have the proper access control permissions.
V-1081 High Local volumes will be formatted using NTFS.
V-8316 High Active Directory data files must have proper access control permissions.
V-6834 High Anonymous access to Named Pipes and Shares will be restricted.
V-1152 High Anonymous access to the registry must be restricted.
V-1153 High The LanMan authentication level will be set to Send NTLMv2 response only\refuse LM & NTLM.
V-1093 High Anonymous enumeration of shares will be restricted.
V-1140 High Users with Administrative privilege will be documented and have separate accounts for administrative duties and normal operational tasks.
V-12780 High The Synchronize directory service data user right must be configured to include no accounts or groups (blank).
V-26683 High PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA).
V-33673 High Active Directory Group Policy objects must have proper access control permissions.
V-26283 High Anonymous enumeration of SAM accounts will not be allowed.
V-2908 High Unencrypted remote access will not be permitted to system services.
V-36451 High Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.
V-1127 High Only administrators responsible for the system must have Administrator rights on the system.
V-3339 High Unauthorized remotely accessible registry paths must not be configured.
V-7002 High Windows 2008 R2 accounts must be configured to require passwords.
V-22692 High The default autorun behavior will be configured to prevent autorun commands.
V-18010 High Unauthorized accounts must not have the Debug programs user right.
V-14798 High Directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access.
V-2374 High Autoplay will be disabled for all drives.
V-3343 High Solicited Remote Assistance will not be allowed.
V-3340 High Network shares that can be accessed anonymously will not be allowed.
V-3344 High The use of local accounts with blank passwords will be restricted to console logons only.
V-1121 High File Transfer Protocol (FTP) servers must be configured to prevent access to the system drive.
V-4443 High Unauthorized remotely accessible registry paths and sub-paths must not be configured.
V-3338 High Named pipes that can be accessed anonymously must be configured with limited values on domain controllers.
V-14820 High Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).
V-1102 High Unauthorized accounts must not have the Act as part of the operating system user right.
V-3379 High The system will be configured to prevent the storage of the LAN Manager hash of passwords.
V-32282 High Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
V-1077 Medium Permissions for event logs must conform to minimum requirements.
V-1072 Medium Shared user accounts must not be permitted on the system.
V-1070 Medium The Automated Information System (AIS) will be physically secured in an access controlled area.
V-26499 Medium Unauthorized accounts must not have the Perform volume maintenance tasks user right.
V-14259 Medium Printing over HTTP will be prevented.
V-26551 Medium The system will be configured to audit "System -> IPSec Driver" successes.
V-26576 Medium The IP-HTTPS IPv6 transition technology will be disabled.
V-26577 Medium The ISATAP IPv6 transition technology will be disabled.
V-26575 Medium The 6to4 IPv6 transition technology will be disabled.
V-3383 Medium The system will be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
V-3381 Medium The system will be configured to the required LDAP client signing level.
V-3380 Medium The system will be configured to force users to log off when their allowed logon hours expire.
V-39330 Medium The Active Directory RID Manager$ object must be configured with proper audit settings.
V-26478 Medium Unauthorized accounts must not have the Create a pagefile user right.
V-26600 Medium The Fax service will be disabled.
V-26476 Medium Unauthorized accounts must not have the Change the system time user right.
V-26602 Medium The Microsoft FTP service must not be installed unless required.
V-3469 Medium The system will be configured to enable the background refresh of Group Policy.
V-26473 Medium The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.
V-26472 Medium Unauthorized accounts must not have the Allow log on locally user right.
V-26606 Medium The Telnet service will be disabled.
V-26470 Medium Unauthorized accounts will not have the "Access this computer from the network" user right.
V-26489 Medium Unauthorized accounts must not have the Generate security audits user right.
V-15727 Medium Users will be prevented from sharing files in their profiles.
V-15823 Medium Software certificate installation files must be removed from Windows 2008 R2.
V-15722 Medium Windows Media Digital Rights Management will be prevented from accessing the Internet.
V-16000 Medium The system will be configured to ensure smart card devices can be redirected to the Remote Desktop Session. (Remote Desktop Services Role)
V-16008 Medium Windows will elevate all applications in User Account Control, not just signed ones.
V-26503 Medium Unauthorized accounts must not have the Replace a process level token user right.
V-2378 Medium The Kerberos user ticket lifetime must be limited to 10 hours or less.
V-26501 Medium Unauthorized accounts must not have the Profile system performance user right.
V-1089 Medium The required legal notice must be configured to display before console logon.
V-26483 Medium The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
V-1168 Medium Members of the Backup Operators group will have separate accounts for backup duties and normal operational tasks.
V-26504 Medium Unauthorized accounts must not have the Restore files and directories user right.
V-1164 Medium Outgoing secure channel traffic will be signed when possible.
V-1166 Medium The Windows SMB client will be enabled to perform SMB packet signing when possible.
V-3378 Medium The system will be configured to use the Classic security model.
V-1163 Medium Outgoing secure channel traffic will be encrypted when possible.
V-1162 Medium The Windows SMB server will perform SMB packet signing when possible.
V-3470 Medium The system will be configured to prevent unsolicited remote assistance offers.
V-26469 Medium Unauthorized accounts must not have the Access Credential Manager as a trusted caller user right.
V-3479 Medium The system will be configured to use Safe DLL Search Mode.
V-14243 Medium Administrator accounts must not be enumerated during elevation.
V-26547 Medium The system will be configured to audit "Policy Change -> Audit Policy Change" failures.
V-14242 Medium User Account Control will virtualize file and registry write failures to per-user locations.
V-26582 Medium The System event log must be configured to a minimum size requirement.
V-26581 Medium The Setup event log must be configured to a minimum size requirement.
V-26580 Medium The Security event log must be configured to a minimum size requirement.
V-30016 Medium Unauthorized accounts will not have the "Add workstations to domain” user right.
V-15682 Medium Attachments must be prevented from being downloaded from RSS feeds.
V-15697 Medium The Responder network protocol driver will be disabled.
V-15696 Medium The Mapper I/O network protocol driver will be disabled.
V-91777 Medium The password for the krbtgt account on a domain must be reset at least every 180 days.
V-73523 Medium The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
V-27109 Medium File Replication Service (FRS) directory data files must have proper access control permissions.
V-6832 Medium The Windows SMB client will be enabled to always perform SMB packet signing.
V-6833 Medium The Windows SMB server will be enabled to always perform SMB packet signing.
V-6831 Medium Outgoing secure channel traffic will be encrypted or signed.
V-8326 Medium The directory server supporting (directly or indirectly) system access or resource authorization must run on a machine dedicated to that function.
V-8327 Medium Windows services that are critical for directory server operation must be configured for automatic startup.
V-26541 Medium The system will be configured to audit "Logon/Logoff -> Logon" successes.
V-8322 Medium Time synchronization must be enabled on the domain controller.
V-14260 Medium Downloading print driver packages over HTTP will be prevented.
V-1150 Medium The built-in Windows password complexity policy must be enabled.
V-1154 Medium The Ctrl+Alt+Del security attention sequence for logons will be enabled.
V-3385 Medium The system must be configured to require case insensitivity for non-Windows subsystems.
V-14269 Medium Mechanisms for removing zone information from file attachments will be hidden.
V-3289 Medium Servers will have a host-based Intrusion Detection System.
V-1099 Medium Windows 2008 R2 account lockout duration must be configured to 15 minutes or greater.
V-1098 Medium The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2008 R2.
V-2373 Medium The Server Operators group must have the ability to schedule jobs by means of the AT command disabled.
V-2372 Medium Reversible password encryption will be disabled.
V-3449 Medium Remote Desktop Services will limit users to one remote session.
V-2377 Medium The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
V-2376 Medium Kerberos user logon restrictions must be enforced.
V-2379 Medium The Kerberos user ticket renewal maximum lifetime must be limited to 7 days or less.
V-26487 Medium Unauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right.
V-1097 Medium The system must lockout accounts after 3 invalid logon attempts within a specified time period.
V-3382 Medium The system will be configured to meet the minimum session security requirement for NTLM SSP based clients.
V-3372 Medium A system must be logged on to before removing from a docking station.
V-15991 Medium UIAccess applications will not be allowed to prompt for elevation without using the secure desktop.
V-3376 Medium The system will be configured to prevent the storage of passwords and credentials
V-15997 Medium The system will be configured to prevent users from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role)
V-3374 Medium The system will be configured to require a strong session key.
V-1119 Medium Booting into alternate non STIG compliant operating systems will not be permitted.
V-15998 Medium The system will be configured to prevent users from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role)
V-15999 Medium The system will be configured to prevent users from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role)
V-4444 Medium Users must be required to enter a password to access private keys stored on the computer.
V-15683 Medium Windows Explorer shell protocol will run in protected mode.
V-1145 Medium Automatic logons must be disabled.
V-1141 Medium Unencrypted passwords must not be sent to third-party SMB Servers.
V-15685 Medium Users will be prevented from changing installation options.
V-33666 Medium The system must be configured to audit DS Access - Directory Service Changes failures.
V-1171 Medium Ejection of removable NTFS media is not restricted to Administrators.
V-14230 Medium Audit policy using subcategories will be enabled.
V-14270 Medium The system will notify antivirus when file attachments are opened.
V-14271 Medium Application account passwords must meet DoD requirements for length, complexity and changes.
V-78061 Medium Windows Server 2008 R2 must be configured to audit System - Other System Events successes.
V-26482 Medium Unauthorized accounts must not have the Create symbolic links user right.
V-14239 Medium User Account Control will only elevate UIAccess applications that are installed in secure locations
V-3453 Medium Remote Desktop Services will always prompt a client for passwords upon connection.
V-3456 Medium Remote Desktop Services will delete temporary folders when a session is terminated.
V-3455 Medium Remote Desktop Services will be configured to use session-specific temporary folders.
V-3454 Medium Remote Desktop Services will be configured with the client connection encryption set to the required level.
V-21952 Medium NTLM will be prevented from falling back to a Null session.
V-4407 Medium Domain Controllers must require LDAP signing.
V-78063 Medium Windows Server 2008 R2 must be configured to audit System - Other System Events failures.
V-15666 Medium Windows Peer-to-Peer networking services will be turned off.
V-1130 Medium ACLs for system files and directories will conform to minimum requirements.
V-26474 Medium Unauthorized accounts must not have the Back up files and directories user right.
V-2907 Medium System files will be monitored for unauthorized changes.
V-3487 Medium Services will be documented and unnecessary services will not be installed or will be disabled.
V-26604 Medium The Peer Networking Identity Manager service will be disabled.
V-15674 Medium The Internet File Association service will be turned off.
V-26605 Medium The Simple TCP/IP Services service will be disabled.
V-14241 Medium User Account Control will switch to the secure desktop when prompting for elevation.
V-14240 Medium User Account Control will run all administrators in Admin Approval Mode, enabling UAC.
V-26538 Medium The system will be configured to audit "Account Management -> User Account Management" failures.
V-26539 Medium The system will be configured to audit "Detailed Tracking -> Process Creation" successes.
V-14247 Medium Passwords will not be saved in the Remote Desktop Client.
V-14249 Medium Local drives will be prevented from sharing with Remote Desktop Session Hosts (Remote Desktop Services Role).
V-26533 Medium The system will be configured to audit "Account Management -> Other Account Management Events" successes.
V-26530 Medium The system will be configured to audit "Account Logon -> Credential Validation" failures.
V-26531 Medium Windows Server 2008 R2 domain controllers must be configured to audit Account Management - Computer Account Management successes.
V-26537 Medium The system will be configured to audit "Account Management -> User Account Management" successes.
V-26535 Medium The system will be configured to audit "Account Management -> Security Group Management" successes.
V-33664 Medium The system must be configured to audit DS Access - Directory Service Access failures.
V-33665 Medium The system must be configured to audit DS Access - Directory Service Changes successes.
V-57633 Medium Windows Server 2008 R2 must be configured to audit Policy Change - Authorization Policy Change successes.
V-57637 Medium The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
V-33663 Medium The system must be configured to audit DS Access - Directory Service Access successes.
V-3480 Medium Media Player must be configured to prevent automatic checking for updates.
V-6836 Medium For systems utilizing a logon ID as the individual identifier, passwords will, at a minimum, be 14 characters.
V-6840 Medium Windows 2008 R2 passwords must be configured to expire.
V-1115 Medium The built-in administrator account will be renamed.
V-1114 Medium The built-in guest account will be renamed.
V-1155 Medium The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
V-1120 Medium File Transfer Protocol (FTP) servers must be configured to prevent anonymous logons.
V-26484 Medium The Deny log on as a service user right must be configured to include no accounts or groups (blank).
V-1122 Medium The system will be configured with a password-protected screen saver.
V-15667 Medium Network Bridges will be prohibited in Windows.
V-21975 Medium The system will be prevented from joining a homegroup.
V-21973 Medium Autoplay will be turned off for non-volume devices.
V-3491 Medium Audit logs will be reviewed on a daily basis.
V-14256 Medium Web publishing and online ordering wizards will be prevented from downloading a list of providers.
V-26486 Medium The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.
V-1113 Medium The built-in guest account must be disabled.
V-72753 Medium WDigest Authentication must be disabled.
V-3828 Medium Security-related Software Patches will be applied.
V-39325 Medium Active Directory Group Policy objects must be configured with proper audit settings.
V-26549 Medium The system will be configured to audit "Privilege Use -> Sensitive Privilege Use" successes.
V-26548 Medium The system will be configured to audit "Policy Change -> Authentication Policy Change" successes.
V-32274 Medium The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
V-26546 Medium The system will be configured to audit "Policy Change -> Audit Policy Change" successes.
V-26543 Medium The system will be configured to audit "Logon/Logoff -> Special Logon" successes.
V-26542 Medium The system will be configured to audit "Logon/Logoff -> Logon" failures.
V-32272 Medium The DoD Root CA certificates must be installed in the Trusted Root Store.
V-26540 Medium The system will be configured to audit "Logon/Logoff -> Logoff" successes.
V-15684 Medium Users will be notified if a web-based program attempts to install software.
V-14228 Medium Auditing Access of Global System Objects must be turned off.
V-21980 Medium Explorer Data Execution Prevention will be enabled.
V-1157 Medium The Smart Card removal option will be configured to Force Logoff or Lock Workstation.
V-26488 Medium Unauthorized accounts must not have the Force shutdown from a remote system user right.
V-14261 Medium Windows will be prevented from using Windows Update to search for drivers.
V-2380 Medium The computer clock synchronization tolerance must be limited to 5 minutes or less.
V-39328 Medium The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
V-4448 Medium Group Policy objects will be reprocessed even if they have not changed.
V-3481 Medium Media Player will be configured to prevent automatic Codec downloads.
V-4447 Medium The Remote Desktop Session Host will require secure RPC communications.
V-14229 Medium Audit of Backup and Restore Privileges will be turned off.
V-78059 Medium Windows Server 2008 R2 must be configured to audit Logon/Logoff - Account Lockout failures.
V-26529 Medium The system will be configured to audit "Account Logon -> Credential Validation" successes.
V-78057 Medium Windows Server 2008 R2 must be configured to audit Logon/Logoff - Account Lockout successes.
V-14226 Medium Audit data must be retained for at least one year.
V-14225 Medium The Windows 2008 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.
V-26494 Medium Unauthorized accounts must not have the Lock pages in memory user right.
V-26497 Medium Unauthorized accounts must not have the Modify an object label user right.
V-14783 Medium Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data-in-transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.
V-26558 Medium The system will be configured to audit "System -> System Integrity" failures.
V-26493 Medium Unauthorized accounts must not have the Load and unload device drivers user right.
V-26492 Medium Unauthorized accounts must not have the Increase scheduling priority user right.
V-15713 Medium Windows Defender SpyNet membership will be disabled.
V-26557 Medium The system will be configured to audit "System -> System Integrity" successes.
V-26550 Medium The system will be configured to audit "Privilege Use -> Sensitive Privilege Use" failures.
V-26498 Medium Unauthorized accounts must not have the Modify firmware environment values user right.
V-26552 Medium The system will be configured to audit "System -> IPSec Driver" failures.
V-26553 Medium The system will be configured to audit "System -> Security State Change" successes.
V-15700 Medium Remote access to the Plug and Play interface will be disabled for device installation.
V-15706 Medium The user will be prompted for a password on resume from sleep (Plugged In). (Applicable on Server 2008 R2 if the system is configured to sleep.)
V-15705 Medium Users will be prompted for a password on resume from sleep (on battery). (Applicable to Server 2008 R2 if the system is configured to sleep.)
V-26578 Medium The Teredo IPv6 transition technology will be disabled.
V-14268 Medium Zone information will be preserved when saving attachments.
V-16048 Medium Windows Help Ratings feedback will be turned off.
V-16021 Medium The Windows Help Experience Improvement Program will be disabled
V-16020 Medium The Windows Customer Experience Improvement Program will be disabled.
V-3245 Medium File share ACLs will be reconfigured to remove the Everyone group.
V-1107 Medium The password history must be configured to 24 passwords remembered.
V-1105 Medium The minimum password age must be configured to at least 1 day.
V-1104 Medium The maximum password age must be configured to 60 days or less.
V-21951 Medium Services using Local System that use negotiate when reverting to NTLM authentication will use the computer identity vs. authenticating anonymously.
V-21950 Medium The service principal name (SPN) target name validation level will be turned off.
V-21953 Medium PKU2U authentication using online identities will be prevented.
V-26496 Medium Unauthorized accounts must not have the Manage auditing and security log user right.
V-21954 Medium The use of DES encryption suites must not be allowed for Kerberos encryption.
V-26490 Medium Unauthorized accounts must not have the Impersonate a client after authentication user right.
V-26579 Medium The Application event log must be configured to a minimum size requirement.
V-39326 Medium The Active Directory Domain object must be configured with proper audit settings.
V-14234 Medium User Account Control approval mode for the built-in Administrator will be enabled.
V-14235 Medium User Account Control will, at a minimum, prompt administrators for consent.
V-14236 Medium User Account Control will automatically deny standard user requests for elevation.
V-14237 Medium User Account Control will be configured to detect application installations and prompt for elevation.
V-80473 Medium Windows PowerShell must be updated to a version that supports script block logging on Windows 2008 R2.
V-15698 Medium The configuration of wireless devices using Windows Connect Now will be disabled.
V-26480 Medium Unauthorized accounts must not have the Create global objects user right.
V-26481 Medium Unauthorized accounts must not have the Create permanent shared objects user right.
V-39327 Medium The Active Directory Infrastructure object must be configured with proper audit settings.
V-80475 Medium PowerShell script block logging must be enabled on Windows 2008 R2.
V-26485 Medium The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
V-15488 Medium Active directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), PIV-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.
V-75915 Medium Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2008 R2.
V-39329 Medium The Active Directory AdminSDHolder object must be configured with proper audit settings.
V-3666 Medium The system will be configured to meet the minimum session security requirement for NTLM SSP based servers.
V-15699 Medium The Windows Connect Now wizards will be disabled.
V-26500 Medium Unauthorized accounts must not have the Profile single process user right.
V-3377 Medium The system will be configured to prevent anonymous users from having the same rights as the Everyone group.
V-26555 Medium The system will be configured to audit "System -> Security System Extension" successes.
V-73519 Medium The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
V-40237 Medium The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
V-26506 Medium Unauthorized accounts must not have the Take ownership of files or other objects user right.
V-1076 Low System information backups will be created, updated, and protected.
V-1075 Low The shutdown option will not be available from the logon dialog box.
V-14831 Low The directory service must be configured to terminate LDAP-based network connections to the directory server after five (5) minutes of inactivity.
V-1174 Low The amount of idle time required before suspending a session must be properly set.
V-1173 Low The default permissions of Global system objects will be increased.
V-21963 Low Windows Update will be prevented from searching for point and print drivers.
V-15676 Low The Order Prints Online wizard will be turned off.
V-16001 Low The system will be configured to allow only the default client printer to be redirected in the Remote Desktop session. (Remote Desktop Services Role)
V-1165 Low The computer account password will not be prevented from being reset.
V-3472 Low The time service must synchronize with an appropriate DoD time source.
V-11806 Low The system will be configured to prevent the display of the last user name on the logon screen.
V-8324 Low The time synchronization tool must be configured to enable logging of time source switching.
V-1151 Low The print driver installation privilege will be restricted to administrators.
V-1090 Low Caching of logon credentials must be limited.
V-3373 Low The maximum age for machine account passwords will be set to requirements.
V-26359 Low The Windows dialog box title for the legal banner will be configured.
V-15686 Low Non-administrators will be prevented from applying vendor signed updates.
V-15687 Low Users will not be presented with Privacy and Installation options on first use of Windows Media Player.
V-21969 Low Access to Windows Online Troubleshooting Service (WOTS) will be prevented.
V-1112 Low Outdated or unused accounts must be removed from the system or disabled.
V-1136 Low Users will be forcibly disconnected when their logon hours expire.
V-1135 Low Non-administrative user accounts or groups will only have print permissions of Printer Shares.
V-1172 Low Users will be warned in advance that their passwords will expire.
V-15672 Low Event Viewer Events.asp links will be turned off.
V-4445 Low Optional Subsystems will not be permitted to operate on the system.
V-4438 Low The system must limit how many times unacknowledged TCP data is retransmitted.
V-4111 Low The system will be configured to prevent ICMP redirects from overriding OSPF generated routes.
V-4108 Low The system must generate an audit event when the audit log reaches a percentage of full threshold.
V-1128 Low Security configuration tools or equivalent processes will be used to configure platforms for security compliance.
V-21974 Low Downloading of game update information will be turned off.
V-21971 Low The Application Compatibility Program Inventory will be prevented from collecting data and sending the information to Microsoft.
V-21970 Low Responsiveness events will be prevented from being aggregated and sent to Microsoft.
V-21978 Low Windows Anytime Upgrade will be disabled.
V-14797 Low Anonymous access to the root DSE of a non-public directory must be disabled.
V-4113 Low The system will be configured to limit how often keep-alive packets are sent.
V-4112 Low The system will be configured to disable the Internet Router Discover Protocol (IRDP).
V-4110 Low The system will be configured to prevent IP source routing.
V-4116 Low The system must be configured to ignore NetBIOS name release requests except from WINS servers.
V-4442 Low The system will be configured to have password protection take effect within a limited time frame when the screen saver becomes active.
V-21964 Low Device metadata retrieval from the Internet must be prevented.
V-21965 Low Device driver searches using Windows Update will be prevented.
V-21967 Low Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft will be prevented.
V-21960 Low Domain users will be required to elevate when setting a network’s location.
V-21961 Low All Direct Access traffic will be routed through the internal network.
V-21956 Low IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.
V-15709 Low Game explorer information will not be downloaded from Windows Metadata Services.
V-28504 Low Windows will be prevented from sending an error report when a device driver requests additional software during installation.
V-15703 Low Users will not be prompted to search Windows Update for device drivers.
V-15702 Low An Error Report will not be sent when a generic device driver is installed.
V-15701 Low A system restore point will be created when a new device driver is installed.
V-15707 Low Remote Assistance log files will be generated.
V-15704 Low Errors in handwriting recognition on Tablet PCs will not be reported to Microsoft.
V-21955 Low IPv6 source routing will be configured to highest protection.
V-4408 Low The domain controller must be configured to allow reset of machine account passwords.
V-14232 Low IPSec Exemptions will be limited.
V-15718 Low Windows Explorer heap termination on corruption will be disabled.