Validation Scripts Search

Results

106 matches

Network Access: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites

NIST 800-53 IA-7 CAT II PCI DSS 3.2 8.2.1 PCI DSS 4.0 2.2.7 PCI DSS 4.0 3.6.1.1 PCI DSS 4.0 3.6.1.2 PCI DSS 4.0 3.7.3 CCI CCI-000803 Vuln-ID V-254473

Compliance: BitLocker should use AES 256 encryption

PCI DSS v3.2 2.3 PCI DSS v4.0 3.6.1.2 PCI DSS v4.0 3.7.3) CIS CSC v8 4.6 CIS CSC v8 12.3 NIST Privacy Framework PR.DS-P2 CMMC V2 SC.L2-3.13.11

File System: Windows must prevent Indexing of encrypted files

Nist 800-53 IA-5(1) Nist 800-53 SC-28 Nist 800-53 SC-28(1) Nist 800-171A 3.13.16 PCI DSS v3.2 3.4 PCI DSS v3.2 3.4.1 PCI DSS v4 1.5 PCI DSS v4 1.5.1 CMMC v2.1 SC.L2-3.13.16 CSCv7 14.8

Remote Management: Windows Remote Management (WinRM) client must not use Digest authentication

Nist 800-53 CM-1 Nist 800-53 CM-2 Nist 800-53 CM-6 Nist 800-53 CM-7 Nist 800-53 CM-7(1) Nist 800-53 CM-9 Nist 800-53 SA-3 Nist 800-53 SA-8 Nist 800-53 SA-10 Nist 800-171A 3.4.8[a] CSCv7 |6.5 Vul ID V-205712 PCI-DSS v3.2 1.1.5 PCI-DSS v4.0 2.1 PCI-DSS v4.0 8.5

Accounts: Lockout duration must be configured to 15 minutes or greater

Nist 800-53 AC-7 Nist 800-53 AC-19 Nist 800-171a 3.1.8[a] Nist 800-171a 3.1.8[b] Nist 800-171AR3 A.03.01.08 CMMC v2.1 AC.L2-3.1.8 PCI DSS v3.2 8.1.6 PCI DSS v3.2 8.1.7 PCI DSS v4.0 8.3.4 CSCv7 16.2 CSCv7 16.11

File System: Local volumes must be formatted with NTFS

Remote Management: Windows Remote Management (WinRM) service must not store RunAs credentials

NIST 800-53 rev4 SC-7(21) NIST 800-53 rev5 SC-7(21) PCI DSS 4.0.1 1.3.3 PCI DSS 4.0.1 SAQ A-EP 1.3.3 CSCv7 14.3 SRG SRG-OS-000373-GPOS-00156 SRG SRG-OS-000373-GPOS-00157

Domain Member: Maximum age for machine account passwords must be configured to 30 days or less

Security: Systems must have UEFI firmware and be configured to run in UEFI mode, not Legacy BIOS

NIST 800 CM-6b PCI DSS v4.0.1 10.7 PCI DSS v4.0.1 10.7.1 PCI DSS v4.0.1 10.7.2 PCI DSS v4.0.1 10.7.3 CMMC v2 L3 CM.L3-3.4.2E

Domain Member: must be configured to at least negotiate signing for LDAP client signing

Windows OS: Windows Activation Status

NIST 800-53 SA-22 NIST 800-53 CM-8 NIST 800-171 3.4.7 NIST 800-171 3.11.2 PCI DSS 4.0 2.2 PCI DSS 4.0 6.1

Accounts: Administrator accounts must not be enumerated during elevation

Nist 800-53 CM-1 Nist 800-53 CM-2 Nist 800-53 CM-6 Nist 800-53 CM-7 Nist 800-53 CM-7(1) Nist 800-53 CM-9 Nist 800-53 SA-3 Nist 800-53 SA-8 Nist 800-53 SA-10 Nist 800-171 3.1.12.a Nist 800-171 3.1.16.a Nist 800-171 3.1.18.a Nist 800-171 3.1.18.c Nist 800-171 3.4.1.a Nist 800-171 3.4.2.a Nist 800-171 3.4.6.a Nist 800-171 3.4.6.b Nist 800-171 3.4.6.d Nist 800-171 3.5.7.e Nist 800-171 3.5.7.f Nist 800-171 3.5.12.d CSCv7 5.1 PCI-DSS v3.2 1.1 PCI-DSS v3.2 1.1.1 PCI-DSS v3.2 2.2 PCI-DSS v3.2 2.2.1 PCI-DSS v3.2 2.2.2 PCI-DSS v3.2 2.2.3 PCI-DSS v3.2 2.2.4 PCI-DSS v4 1.1 PCI-DSS v4 1.2.1 PCI-DSS v4 1.2.6 PCI-DSS v4 2.2.1 PCI-DSS v4 8.3.2 PCI-DSS v4 8.5 PCI-DSS v4 10.2 PCI-DSS v4 10.2.1 PCI-DSS v4 10.2.1.1 PCI-DSS v4 10.2.1.2 PCI-DSS v4 10.2.1.3 PCI-DSS v4 10.2.1.4 PCI-DSS v4 10.2.1.5 PCI-DSS v4 10.2.1.6 PCI-DSS v4 10.2.1.7 PCI-DSS v4 10.2.2 PCI-DSS v4 10.6 PCI-DSS v4 10.6.1 PCI-DSS v4 10.6.2 PCI-DSS v4 10.6.3 PCI-DSS v4 11.2 CMMC v2.1 CM.L2-3.4.1 CMMC v2.1 CM.L2-3.4.2 CMMC v2.1 CM.L3-3.4.1e CMMC v2.1 CM.L3-3.4.2e CMMC v2.1 SI.L3-3.14.3e HIPAA Security Rule / NIST SP 800-66 R2 164.312(a)(1)

General: Windows firewall status

Accounts: The computer account password must not be prevented from being reset

NIST 800-53 CM-6b. CAT III CCI CCI-000366 PCI-DSS v4 10.7 PCI-DSS v4 10.7.1 PCI-DSS v4 10.7.2 PCI-DSS v4 10.7.3 MITRE Att&ck T1098

Accounts: Must only allow adminis responsible for the member srv, standalone, nondomain system to have Admin rights on system

NIST 800-53 AC-2 NIST 800-53 AC-6 NIST 800-53 CM-6 NIST 800-171 3.1.1 NIST 800-171 3.1.5 NIST 800-171 3.1.6 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.5 CMMC v2.0 L2 AC.L2-3.1.6 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1 PCI-DSS v4.0 7.2.5

Auditing: generate security audits user right must only be assigned to Local Service and Network Service

NIST 800-53 AU-9 NIST 800-53 AC-6 NIST 800-53 CM-6 NIST 800-171 3.3.8 NIST 800-171 3.1.1 NIST 800-171 3.4.6 CMMC v2.0 L2 AU.L2-3.3.8 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1 PCI-DSS v4.0 10.3.4

Auditing: Manage auditing and security log user right must only be assigned to the Administrators group

NIST 800-53 AU-9 NIST 800-53 AU-12 NIST 800-53 AC-3 NIST 800-53 AC-6 NIST 800-53 CM-6 NIST 800-171 3.3.8 NIST 800-171 3.3.9 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AU.L2-3.3.8 CMMC v2.0 L2 AU.L2-3.3.9 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1 PCI-DSS v4.0 10.3.4

Auditing: System must be configured to audit Account Management - Computer Account Management successes

NIST 800-53 AU-2 NIST 800-53 AU-3 NIST 800-53 AU-12 NIST 800-53 AC-2 NIST 800-53 CM-8 NIST 800-171 3.3.1 NIST 800-171 3.3.2 NIST 800-171 3.1.1 CMMC v2.0 L2 AU.L2-3.3.1 CMMC v2.0 L2 AU.L2-3.3.2 CMMC v2.0 L2 AC.L2-3.1.1 PCI-DSS v4.0 10.2.1 PCI-DSS v4.0 10.2.1.2 PCI-DSS v4.0 10.2.1.5

Auditing: System must be configured to audit Detailed Tracking - Process Creation successes

NIST 800-53 AU-2 NIST 800-53 AU-3 NIST 800-53 AU-12 NIST 800-53 SI-4 NIST 800-171 3.3.1 NIST 800-171 3.3.2 NIST 800-171 3.14.6 CMMC v2.0 L2 AU.L2-3.3.1 CMMC v2.0 L2 AU.L2-3.3.2 CMMC v2.0 L2 SI.L2-3.14.6 PCI-DSS v4.0 10.2.1 PCI-DSS v4.0 10.2.1.1 PCI-DSS v4.0 10.2.1.5

Auditing: System must be configured to audit DS Access - Directory Service Access failures

NIST 800-53 AU-2 NIST 800-53 AU-3 NIST 800-53 AU-12 NIST 800-53 AC-2 NIST 800-53 AC-3 NIST 800-53 SI-7 NIST 800-171 3.3.1 NIST 800-171 3.3.2 NIST 800-171 3.1.1 NIST 800-171 3.1.2 CMMC v2.0 L2 AU.L2-3.3.1 CMMC v2.0 L2 AU.L2-3.3.2 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 PCI-DSS v4.0 10.2.1 PCI-DSS v4.0 10.2.1.2 PCI-DSS v4.0 10.2.1.5

Auditing: System must be configured to audit DS Access - Directory Service Access successes

Auditing: System must be configured to audit DS Access - Directory Service Changes successes

Auditing: Windows must be configured to audit Logon/Logoff - Account Lockout Failures

NIST 800-53 AU-2 NIST 800-53 AU-3 NIST 800-53 AU-12 NIST 800-53 AC-7 NIST 800-53 SI-4 NIST 800-171 3.3.1 NIST 800-171 3.3.2 NIST 800-171 3.1.8 CMMC v2.0 L2 AU.L2-3.3.1 CMMC v2.0 L2 AU.L2-3.3.2 CMMC v2.0 L2 AC.L2-3.1.8 PCI-DSS v4.0 10.2.1 PCI-DSS v4.0 10.2.1.3

Credentials: Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts

NIST 800-53 AC-6 NIST 800-53 IA-5 NIST 800-53 CM-6 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.5.10 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 IA.L2-3.5.10 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Add workstations to domain user right must only be assigned to the Administrators group on domain controllers

NIST 800-53 AC-3 NIST 800-53 AC-6 NIST 800-53 CM-5 NIST 800-53 CM-6 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.4.5 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.5 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1

Domain Controller: Allow log on through RD Services user right must only be assigned to the Adminis group

NIST 800-53 AC-3 NIST 800-53 AC-6 NIST 800-53 CM-6 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1

Domain Controller: Computer clock synchronization tolerance must be limited to five minutes or less

NIST 800-53 AC-12 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Deny access to this computer from the network user right on DC must be configured to prevent unauth access

Domain Controller: Deny log on as a batch job user right on DCs must be configured to prevent unauthenticated access

Domain Controller: Deny log on as a service user right must be configured to include no accounts or groups (blank)

Domain Controller: Deny log on Remote Desktop Services user right on DCs must be configured to prevent unauthenticated access

Domain Controller: Directory data (outside root DSE) of a nonpublic directory must be configured to prevent anonymous access

NIST 800-53 AC-3 NIST 800-53 AC-6 NIST 800-53 CM-6 NIST 800-53 SC-7 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.4.6 NIST 800-171 3.13.1 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 SC.L2-3.13.1 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 7.2.1

Domain Controller: Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less

NIST 800-53 AC-12 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Kerberos service ticket maximum lifetime must be limited to 600 minutes or less

NIST 800-53 AC-12 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Kerberos user logon restrictions must be enforced

NIST 800-53 AC-3 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.1 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Kerberos user ticket lifetime must be limited to 10 hours or less

NIST 800-53 AC-12 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.2 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Controller: Must be configured to allow reset of machine account passwords

NIST 800-53 CM-6 NIST 800-53 IA-5 NIST 800-53 AC-2 NIST 800-171 3.4.6 NIST 800-171 3.5.2 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 IA.L2-3.5.2 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.3.6

Domain Controller: Must require LDAP access signing

NIST 800-53 AU-2 NIST 800-53 AU-3 NIST 800-53 AU-12 NIST 800-53 SC-8 NIST 800-53 SC-28 NIST 800-53 CM-6 NIST 800-171 3.13.8 NIST 800-171 3.4.6 CMMC v2.0 L2 SC.L2-3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

Domain Controller: System must be configured for name-based strong mappings for certificates

NIST 800-53 IA-5 NIST 800-53 IA-8 NIST 800-53 SC-17 NIST 800-53 CM-6 NIST 800-171 3.5.2 NIST 800-171 3.4.6 CMMC v2.0 L2 IA.L2-3.5.2 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Domain Member: Digitally encrypt or sign secure channel data (always) must be set to Enabled

NIST 800-53 SC-8 NIST 800-53 SC-28 NIST 800-53 CM-6 NIST 800-53 IA-3 NIST 800-171 3.13.8 NIST 800-171 3.4.6 CMMC v2.0 L2 SC.L2-3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

Domain Member: Digitally encrypt secure channel data (when possible) must be set to Enabled

NIST 800-53 SC-8 NIST 800-53 SC-28 NIST 800-53 CM-6 NIST 800-53 IA-3 NIST 800-171 3.13.8 NIST 800-171 3.4.6 CMMC v2.0 L2 SC.L2-3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

Domain Member: Digitally sign secure channel data (when possible) must be set to Enabled

NIST 800-53 SC-8 NIST 800-53 SC-28 NIST 800-53 CM-6 NIST 800-53 IA-3 NIST 800-171 3.13.8 NIST 800-171 3.4.6 CMMC v2.0 L2 SC.L2-3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

File System: Turning off File Explorer heap termination on corruption must be disabled

NIST 800-53 CM-6 NIST 800-53 CM-7 NIST 800-53 SI-3 NIST 800-171 3.4.6 NIST 800-171 3.14.2 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 SI.L2-3.14.2 PCI-DSS v4.0 2.2.1

FIPS 140: Security Requirements for Cryptographic Modules

NIST 800-53 SC-13 NIST 800-53 SC-8 NIST 800-53 IA-7 NIST 800-53 CM-6 NIST 800-171 3.13.10 NIST 800-171 3.13.8 NIST 800-171 3.4.6 CMMC v2.0 L2 SC.L2-3.13.10 CMMC v2.0 L2 SC.L2-3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

Logon: Allow log on locally user right must only be assigned to the Administrators group

Logon: Smart Card removal option must be configured to Force Logoff or Lock Workstation

NIST 800-53 AC-11 NIST 800-53 AC-12 NIST 800-53 IA-2 NIST 800-53 CM-6 NIST 800-171 3.1.10 NIST 800-171 3.4.6 CMMC v2.0 L2 AC.L2-3.1.10 CMMC v2.0 L2 CM.L2-3.4.6 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.6.1

Logon: Title for legal banner dialog box must be configured with the appropriate text

NIST 800-53 AC-8 NIST 800-171 3.1.9 CMMC v2.0 L2 AC.L2-3.1.9 PCI-DSS v4.0 2.2.1

Network Access: System must be configured to require a strong session key

NIST 800-53 CM-6 NIST 800-53 SC-8 NIST 800-53 SC-28 NIST 800-53 IA-3 NIST 800-171 3.4.6 NIST 800-171 3.13.8 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 SC.L2-3.13.8 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 4.2.1

Network Access: System must not allow anonymous SID/Name translation

NIST 800-53 CM-6 NIST 800-53 AC-6 NIST 800-53 IA-8 NIST 800-171 3.4.6 NIST 800-171 3.1.1 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 AC.L2-3.1.1 PCI-DSS v4.0 2.2.1

Network Access: System must prevent PKU2U authentication using online identities

NIST 800-53 CM-6 NIST 800-53 CM-7 NIST 800-53 IA-3 NIST 800-53 IA-8 NIST 800-171 3.4.6 NIST 800-171 3.5.3 CMMC v2.0 L2 CM.L2-3.4.6 CMMC v2.0 L2 IA.L2-3.5.3 PCI-DSS v4.0 2.2.1 PCI-DSS v4.0 8.2.1

Validation Scripts

Results

Tags

Your Privacy Choices