Cis Validation Scripts by EventSentry | EventSentry

PingSentry | Discord | System32 | GitHub | Free tools

EventSentry

Validation Scripts

Tag

cis

Scripts

42

Accounts: Administrator accounts must not be enumerated during elevation

Accounts: Block Microsoft accounts

Accounts: Enable computer and user accounts delegation user right not be assigned to any groups or accounts

Accounts: Enable computer and user accounts to be trusted user right must only be assigned to the Admins group on DCs

Accounts: Local Administrator account should be disabled

Accounts: Local accounts with blank passwords must be restricted to prevent access from the network

Accounts: Must disable automatically signing in the last interactive user after a system-initiated restart

Accounts: Must have the built-in Windows password complexity policy enabled

Accounts: Must require passwords

Accounts: UIAccess applications must not be allowed to prompt for elevation without using the secure desktop

Accounts: User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop

Accounts: User Account Control must only elevate UIAccess applications that are installed in secure locations

Auditing: Event Log / Viewer must be protected from unauthorized modification and deletion

Auditing: Permissions for the Security event log must prevent access by non-privileged accounts

Auditing: Permissions for the System event log must prevent access by non-privileged accounts

Autoplay: Must be turned off for non-volume devices

Autoplay: Should be disabled for all drives

Autorun: behavior must be configured to prevent Autorun commands

Domain Member: Group policy objects must be reprocessed even if they have not changed

File System: Windows must prevent Indexing of encrypted files

General: AntiVirus/Antimalware Status

General: Downloading print driver packages over HTTP must be turned off

General: Printing over HTTP must be turned off

General: The Microsoft Defender SmartScreen for Explorer must be enabled (Desktop)

General: Windows Defender SmartScreen must be enabled (Server)

Internet Browser: Attachments must be prevented from being downloaded from RSS feeds

Logon: Network selection UI must not be displayed

Network Access: Must Have the Server Message Block (SMB) v1 protocol disabled on the SMB client

Network Access: Must have the Server Message Block (SMB) v1 protocol disabled on the SMB server

Network Access: Windows must not have the Server Message Block (SMB) v1 protocol installed

Network: Internet Protocol version 6 (IPv6) source routing must use highest protection level to prevent IP source routing

Network: Simple TCP/IP Services must not be installed on the system

Network: Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing

Passwords: must, at a minimum, be 14 characters

Remote Desktop: Must be configured with the client connection encryption set to High Level

Remote Desktop: Must require secure Remote Procedure Call (RPC) communications

Remote Management: Windows Remote Management (WinRM) client must not use Digest authentication

Remote Management: Windows Remote Management (WinRM) service must not store RunAs credentials

Windows OS: Build Version Check (End Of Life)

Windows OS: Build Version Check (OS Updated)

Windows OS: Data Execution Prevention (DEP) must be configured to at least OptOut

Windows OS: Explorer Data Execution Prevention must be enabled

Full tag list

nist800-53-server (204) stig-medium-server (199) nist800-171-server (177) nist800-53-desktop (169) cmmc2-l2-server (162) stig-medium-desktop (147) pci-dss-v4-server (131) nist800-171-desktop (128) security-server (121) cmmc2-l2-desktop (119) hipaa-server (96) security-desktop (95) pci-dss-v4-desktop (89) hipaa-desktop (65) bestpractice-desktop (39) cis-csc-server (38) bestpractice-server (35) cis-csc-desktop (34) mitre-att-server (32) mitre-att-desktop (30) cmmc2-l1-server (24) stig-high-desktop (23) stig-high-server (22) cmmc2-l1-desktop (21) pci-dss-v3.2-server (20) bestpractice-domaincontroller (16) tisax (16) cmmc2-l3-server (16) pci-dss-v3.2-desktop (15) threat-intel-server (13) cmmc2-l3-desktop (12) threat-intel-desktop (12) sec-hardening-desktop (10) sec-hardening-server (10) nist-privacy-server (10) sig-server (9) stig-low-desktop (8) health (8) csa-cmm-server (7) nist-privacy-desktop (7) stig-low-server (6) privacy-server (6) privacy-desktop (6) owasptop-server (6) owasptop-desktop (5) desktop (4) cce-server (4) cce-desktop (4) stig-medium-ie (4) sig-desktop (3) niap-desktop (3) fips140-2 (3) niap-server (3) msoffice (2) vm-guest-host (2) compliance-desktop (2) info-desktop (1) csa-cmm-desktop (1) server (1) domaincontroller-health (1) bitlocker-security-desktop (1) iis-stig-high (1) hyper-v (1) exchange-security (1)

CMMC v2.0 Compliance STIG CIS NIST 800-171 Servers Desktops