Accounts: Administrator accounts must not be enumerated during elevation
f3afb7e7-d38a-42f2-8290-56da3b445913
Accounts: Deny log on locally user right must be configured to prevent access from highly privileged domain accounts
fd44a45e-ef9e-4c54-bebf-22bba68a185c
Accounts: Enable computer and user accounts delegation user right not be assigned to any groups or accounts
64f28abd-921c-4d04-b2c0-f047d20d673e
Accounts: Local Admin accounts must have their privileged token filtered to prevent elevated privileges used over the network
e4710a99-9bc1-4e34-80ad-5d2f84f57732
Accounts: Reversible password encryption must be disabled
71ebd815-0ca9-44c9-b7b8-c96e155e7afb
Domain Member Health: Check the domain join health
1dfd8950-7d31-4fd1-84ab-f3ecc3c95f00
Domain Member: Must be running Credential Guard on domain-joined members
52b8eaca-e97b-4b7b-bda8-2f67dd947dbc
Domain Member: Caching of logon credentials must be limited - Desktop
a256ebbf-e5b2-4b73-a375-6587c8d1b0ba
Domain Member: Digitally encrypt or sign secure channel data (always) must be set to Enabled
8d6589f4-20fe-4018-bc26-7891353eac40
Domain Member: Digitally encrypt secure channel data (when possible) must be set to Enabled
9a6ea78e-a170-4015-9193-666f003f74f4
Domain Member: Digitally sign secure channel data (when possible) must be set to Enabled
5ef4fc08-d231-41c5-95c2-1bb8abc26209
Domain Member: Domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use
b7074672-cbee-4409-a64a-9b03894fcf2f
Domain Member: Group policy objects must be reprocessed even if they have not changed
0652c1f1-ca23-46d0-a60f-7f62281b866e
Domain Member: Hardened UNC paths must require mutual authentication & integrity for at least \\*\SYSVOL and \\*\NETLOGON shares
7b2d6eab-fc7f-4759-8ad5-ff7e774c5b97
Domain Member: Local users on domain-joined member servers must not be enumerated
a115da09-58b1-40dd-85ca-6f6e4cac977d
Domain Member: Maximum age for machine account passwords must be configured to 30 days or less
ad52728e-be9b-4ab7-b329-5b11001e42de
Domain Member: must be configured to at least negotiate signing for LDAP client signing
5c9b1fb7-3d92-4d13-be5f-13d7894e50d0