Validation Scripts

Accounts: Block Microsoft accounts

Accounts: Limit local account use of blank passwords to console logon only

Accounts: Local Administrator account should be disabled

Accounts: Local Guest account should be disabled

Accounts: Rename Local Administrator and Guest Accounts

Attack Surface: Disable LLMNR

Attack Surface: Disable WinRM (Windows Remote Management)

Auditing: Policy subcategories should be enabled

Auditing: Removable Storage

Autoplay should be disabled for all drives

Autorun: Prevent AutoRun by default

Covid-19

Data Execution Prevention (DEP) must be configured to at least OptOut

Directory Size: WinSxs\Temp\PendingDeletes

Domain Controller: LDAP server signing requirements

Domain Controller: Permissions on the Active Directory data files must only allow System and Administrators access

Domain Controller: SYSVOL directory must have proper access control permissions

Domain Member: Digitally encrypt or sign secure channel data (always)

General: AntiVirus Status

General: Windows Activation Status

General: Windows firewall status

Internet Explorer: Check digital signature of executables

Internet Explorer: Software must be disallowed to run or install with invalid signatures

IPv6 Should be enabled

Local volumes must be formatted with NTFS

Logon: Enable Display Last Logon Info

Logon: Require CTRL+ALT+DEL for interactive logons

Microsoft Edge: SmartScreen filter must be enabled

Microsoft Edge: Users must not be allowed to ignore SmartScreen filter warnings for unverified files

Microsoft Office: Check Activation Status

Microsoft Office: Determine whether macros are enabled

Network Access: Disable SMBv1

Network Access: Do not allow anonymous enumeration of SAM accounts and shares

Network Access: Restrict anonymous access to Named Pipes and Shares

Passwords: Enforce history

Passwords: Maximum Age

Passwords: Minimum length

Passwords: Storing LAN Manager hash

PowerShell: Logging should be enabled

PowerShell: Mitigating risks with Constrained Language mode

PowerShell: v20 should not be installed / enabled

Prevent users from making changes to exploit protection

Printing: Prevent users from installing printer drivers

Secure Boot must be enabled

Services: List services containing a space in service path not enclosed in quotes

Solicited Remote Assistance must not be allowed

TEST-ing

TLS/SSL Insecure Ciphers (SCHANNEL)

VirtualBox Tools

VMWare Tools

Windows Build Version Check (OS Updated)

Windows Installer: Disable "Always install with elevated privileges" option