NIST Validation Scripts by EventSentry | EventSentry

PingSentry | Discord | System32 | GitHub | Free tools

EventSentry

Validation Scripts

Tag

nist

Scripts

238

Accounts: Administrator accounts must not be enumerated during elevation

Accounts: Automatic logons must be disabled

Accounts: Block Microsoft accounts

Accounts: Built-in Administrator account must be renamed

Accounts: Built-in Guest account must be renamed

Accounts: Deny log on locally user right must be configured to prevent access from highly privileged domain accounts

Accounts: Enable computer and user accounts delegation user right not be assigned to any groups or accounts

Accounts: Enable computer and user accounts to be trusted user right must only be assigned to the Admins group on DCs

Accounts: Local Admin accounts must have their privileged token filtered to prevent elevated privileges used over the network

Accounts: Local Administrator account should be disabled

Accounts: Local Guest account should be disabled

Accounts: Local accounts with blank passwords must be restricted to prevent access from the network

Accounts: Lockout duration must be configured to 15 minutes or greater

Accounts: Must be configured to enable Remote host allows delegation of non-exportable credentials

Accounts: Must disable automatically signing in the last interactive user after a system-initiated restart

Accounts: Must have the built-in Windows password complexity policy enabled

Accounts: Must have the period of time before the bad logon counter is reset configured to 15 minutes or greater

Accounts: Must only allow adminis responsible for the member srv, standalone, nondomain system to have Admin rights on system

Accounts: Must require passwords

Accounts: Passwords for the built-in Administrator account must be changed at least every 60 days

Accounts: Reversible password encryption must be disabled

Accounts: The computer account password must not be prevented from being reset

Accounts: The number of allowed bad logon attempts must be configured to three or less

Accounts: UIAccess applications must not be allowed to prompt for elevation without using the secure desktop

Accounts: User Account Control (UAC) must automatically deny standard user requests for elevation

Accounts: User Account Control (UAC) must be configured to detect application installations and prompt for elevation

Accounts: User Account Control (UAC) must run all administrators in Admin Approval Mode, enabling UAC

Accounts: User Account Control (UAC) must virtualize file and registry write failures to per-user locations

Accounts: User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop

Accounts: User Account Control must only elevate UIAccess applications that are installed in secure locations

Accounts: Users must be prompted to authenticate when the system wakes from sleep (on battery)

Accounts: Users must be prompted to authenticate when the system wakes from sleep (plugged in)

Accounts: Users must be required to enter a password to access private keys stored on the computer

Auditing: generate security audits user right must only be assigned to Local Service and Network Service

Auditing: Command line data must be included in process creation events

Auditing: Event Log / Viewer must be protected from unauthorized modification and deletion

Auditing: Event Log size for Application log must be at least 32768 KB

Auditing: Event Log size for Security log must be at least 196608 KB

Auditing: Event Log size for System log must be at least 32768 KB

Auditing: Manage auditing and security log user right must only be assigned to the Administrators group

Auditing: Must force audit policy subcategory settings to override audit policy category settings

Auditing: Permissions for the Security event log must prevent access by non-privileged accounts

Auditing: Permissions for the System event log must prevent access by non-privileged accounts

Auditing: System must be configured to audit Account Logon - Credential Validation failures

Auditing: System must be configured to audit Account Logon - Credential Validation successes

Auditing: System must be configured to audit Account Management - Computer Account Management successes

Auditing: System must be configured to audit Account Management - Other Account Management Events successes

Auditing: System must be configured to audit Account Management - Security Group Management successes

Auditing: System must be configured to audit Account Management - User Account Management failures

Auditing: System must be configured to audit Account Management - User Account Management successes

Auditing: System must be configured to audit DS Access - Directory Service Access failures

Auditing: System must be configured to audit DS Access - Directory Service Access successes

Auditing: System must be configured to audit DS Access - Directory Service Changes successes

Auditing: System must be configured to audit Detailed Tracking - Plug and Play Events successes

Auditing: System must be configured to audit Detailed Tracking - Process Creation successes

Auditing: System must be configured to audit Logon/Logoff - Group Membership successes

Auditing: System must be configured to audit Logon/Logoff - Special Logon successes

Auditing: System must be configured to audit Object Access - Other Object Access Events failures

Auditing: System must be configured to audit Object Access - Other Object Access Events successes

Auditing: System must be configured to audit Object Access - Removable Storage failures

Auditing: System must be configured to audit Object Access - Removable Storage successes

Auditing: System must be configured to audit Policy Change - Audit Policy Change failures

Auditing: System must be configured to audit Policy Change - Audit Policy Change successes

Auditing: System must be configured to audit Policy Change - Authentication Policy Change successes

Auditing: System must be configured to audit Policy Change - Authorization Policy Change successes

Auditing: System must be configured to audit Privilege Use - Sensitive Privilege Use failures

Auditing: System must be configured to audit Privilege Use - Sensitive Privilege Use successes

Auditing: System must be configured to audit System - Other System Events failures

Auditing: System must be configured to audit System - Other System Events successes

Auditing: System must be configured to audit System - Security State Change successes

Auditing: System must be configured to audit System - Security System Extension successes

Auditing: System must be configured to audit System - System Integrity failures

Auditing: System must be configured to audit System - System Integrity successes

Auditing: System must be configured to audit logoff successes

Auditing: System must be configured to audit logon failures

Auditing: System must be configured to audit logon successes

Auditing: Windows must be configured to audit Logon/Logoff - Account Lockout Failures

Auditing: Windows must be configured to audit System - IPsec Driver failures

Auditing: Windows must be configured to audit System - IPsec Driver successes

Autoplay: Should be disabled for all drives

Autorun: behavior must be configured to prevent Autorun commands

Compliance: BitLocker should use AES 256 encryption

Compliance: System must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing

Credentials: Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts

Credentials: WDigest Authentication must be disabled

Debug Programs: User right must only be assigned to the Administrators group

Domain Controller: Add workstations to domain user right must only be assigned to the Administrators group on domain controllers

Domain Controller: Allow log on through RD Services user right must only be assigned to the Adminis group

Domain Controller: Computer clock synchronization tolerance must be limited to five minutes or less

Domain Controller: Deny access to this computer from the network user right on DC must be configured to prevent unauth access

Domain Controller: Deny log on Remote Desktop Services user right on DCs must be configured to prevent unauthenticated access

Domain Controller: Deny log on as a batch job user right on DCs must be configured to prevent unauthenticated access

Domain Controller: Deny log on as a service user right must be configured to include no accounts or groups (blank)

Domain Controller: Directory data (outside root DSE) of a nonpublic directory must be configured to prevent anonymous access

Domain Controller: Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less

Domain Controller: Kerberos service ticket maximum lifetime must be limited to 600 minutes or less

Domain Controller: Kerberos user logon restrictions must be enforced

Domain Controller: Kerberos user ticket lifetime must be limited to 10 hours or less

Domain Controller: Must be configured to allow reset of machine account passwords

Domain Controller: Must require LDAP access signing

Domain Controller: Network access must be limited to Admins, Authenticated Users, and Enterprise Domain Controllers

Domain Controller: Permissions on the Active Directory data files must only allow System and Administrators access

Domain Controller: SYSVOL directory must have proper access control permissions

Domain Controller: System must be configured for certificate-based authentication for domain controllers

Domain Controller: System must be configured for name-based strong mappings for certificates

Domain Controller: The password for the krbtgt account on a domain must be reset at least every 180 days

Domain Controllers: Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access

Domain Member: Must be running Credential Guard on domain-joined members

Domain Member: Caching of logon credentials must be limited - Desktop

Domain Member: Digitally encrypt or sign secure channel data (always) must be set to Enabled

Domain Member: Digitally encrypt secure channel data (when possible) must be set to Enabled

Domain Member: Digitally sign secure channel data (when possible) must be set to Enabled

Domain Member: Domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use

Domain Member: Group policy objects must be reprocessed even if they have not changed

Domain Member: Local users on domain-joined member servers must not be enumerated

Domain Member: Maximum age for machine account passwords must be configured to 30 days or less

Domain Member: must be configured to at least negotiate signing for LDAP client signing

Domain Member: must limit the caching of logon credentials to four or less - Server

Exchange Server: Build Version Check (Exchange Updated)

Exploit Protection: Structured Exception Handling Overwrite Protection (SEHOP) must be enabled

Exploit Protection: system-level mitigation, Validate exception chains (SEHOP) must be on

FIPS 140: Security Requirements for Cryptographic Modules

File System: Local volumes must be formatted with NTFS

File System: Turning off File Explorer heap termination on corruption must be disabled

File System: Windows must prevent Indexing of encrypted files

General: AntiVirus/Antimalware Status

General: Downloading print driver packages over HTTP must be turned off

General: Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad

General: Internet Information System (IIS) or its subcomponents must not be installed on a workstation

General: Machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver

General: Printing over HTTP must be turned off

General: Solicited Remote Assistance must not be allowed

General: The Microsoft Defender SmartScreen for Explorer must be enabled (Desktop)

General: Windows Defender SmartScreen must be enabled (Server)

General: Windows firewall status

General: Windows must prevent the display of slide shows on the lock screen

Internet Browser: Attachments must be prevented from being downloaded from RSS feeds

Internet Browser: Basic authentication for RSS feeds over HTTP must not be used

Logon: Allow log on locally user right must only be assigned to the Administrators group

Logon: Enable Display Last Logon Info

Logon: Network selection UI must not be displayed

Logon: Require CTRL+ALT+DEL for interactive logons

Logon: Required legal notice must be configured to display before console logon

Logon: Smart Card removal option must be configured to Force Logoff or Lock Workstation

Logon: Title for legal banner dialog box must be configured with the appropriate text

Microsoft Edge: The Windows Defender SmartScreen filter for Microsoft Edge must be enabled (Windows 10)

Microsoft Edge: Users must not be allowed to ignore SmartScreen filter warnings for unverified files (Windows 10)

Microsoft Edge: Users must not be allowed to ignore Windows Defender SmartScreen filter warnings (Windows 10)

Microsoft Edge: Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge (Windows 10)

Network Access: Do not allow anonymous enumeration of Security Account Manager (SAM) accounts

Network Access: Do not allow anonymous enumeration of shares

Network Access: Insecure logons to an SMB server must be disabled

Network Access: Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites

Network Access: LAN Manager authentication level must be configured to send NTLMv2 response only and refuse LM and NTLM

Network Access: Microsoft network Client: Digitally sign communications (always) must be configured to Enabled

Network Access: Microsoft network Client: Digitally sign communications (if server agrees) must be configured to Enabled

Network Access: Microsoft network Server: Digitally sign communications (always) must be configured to Enabled

Network Access: Microsoft network Server: Digitally sign communications (if client agrees) must be configured to Enabled

Network Access: Must Have the Server Message Block (SMB) v1 protocol disabled on the SMB client

Network Access: Must be configured to prevent anonymous users from having the same permissions as the Everyone group

Network Access: Must have the Server Message Block (SMB) v1 protocol disabled on the SMB server

Network Access: Must prevent NTLM from falling back to a Null session

Network Access: Restrict anonymous access to Named Pipes and Shares

Network Access: Restrict remote calls to the Security Account Manager [SAM] to Administrators

Network Access: Services using Local System when reverting to NTLM authentication must use computer identity

Network Access: Setting Microsoft network server: Digitally sign communications (if client agrees) must be Enabled

Network Access: System must be configured to require a strong session key

Network Access: System must not allow anonymous SID/Name translation

Network Access: System must prevent PKU2U authentication using online identities

Network Access: Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers

Network Access: Windows must not have the Server Message Block (SMB) v1 protocol installed

Network: Internet Protocol version 6 (IPv6) source routing must use highest protection level to prevent IP source routing

Network: Simple TCP/IP Services must not be installed on the system

Network: Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing

Network: System be configured to prevent ICMP redirects from overriding Open Shortest Path First (OSPF)-generated

Network: System must be configured to ignore NetBIOS name release requests except from WINS servers

Passwords: Maximum Password Age

Passwords: Minimum Password Age

Passwords: Windows must be configured to prevent the storage of the LAN Manager hash of passwords

Passwords: history must be configured to 24 passwords remembered

Passwords: must be configured to expire

Passwords: must, at a minimum, be 14 characters

PowerShell: Script block logging must be enabled

PowerShell: v2 should not be installed / enabled

Printing: Prevent users from installing printer drivers

Privacy: Windows Telemetry must not be set to Full

Remote Desktop: Access this computer from the network user right must only be assigned to the Admins and RD Users groups

Remote Desktop: Deny log RDP user on domain-joined servers be configured to prevent access highly privileged domain accountsn

Remote Desktop: Idle session time limit

Remote Desktop: Must always prompt a client for passwords upon connection

Remote Desktop: Must be configured with the client connection encryption set to High Level

Remote Desktop: Must not save passwords in the Remote Desktop Client

Remote Desktop: Must require secure Remote Procedure Call (RPC) communications

Remote Management: Unauthenticated RPC clients must be restricted from connecting to the RPC server

Remote Management: Windows Remote Management (WinRM) client must not allow unencrypted traffic

Remote Management: Windows Remote Management (WinRM) client must not use Basic authentication

Remote Management: Windows Remote Management (WinRM) client must not use Digest authentication

Remote Management: Windows Remote Management (WinRM) service must not allow unencrypted traffic

Remote Management: Windows Remote Management (WinRM) service must not store RunAs credentials

Remote Management: Windows Remote Management (WinRM) service must not use Basic authentication

Security: Access this computer from the network must be limited to Admins and Authenticated Users

Security: Act as part of the operating system user right must not be assigned to any groups or accounts

Security: Create a pagefile user right must only be assigned to the Administrators group

Security: Create a token object user right must not be assigned to any groups or accounts

Security: Create permanent shared objects user right must not be assigned to any groups or accounts

Security: Create symbolic links user right must only be assigned to the Administrators group

Security: Deny access to this computer from the network must include required accounts

Security: Deny log on as a batch job user right on Domain Joined members must be configured to prevent unauthenticated access

Security: Deny log on service user right on domain-join srv be configured to prevent access highly privileged domain accounts

Security: Impersonate client after authentication user right only be assigned to Adminis,Service,Local Service,Network Service

Security: Increase scheduling priority: user right must only be assigned to the Administrators group

Security: Kernel (Direct Memory Access) DMA Protection must be enabled

Security: Load and unload device drivers user right must only be assigned to the Administrators group

Security: Modify firmware environment values user right must only be assigned to the Administrators group

Security: Perform volume maintenance tasks user right must only be assigned to the Administrators group

Security: Profile single process user right must only be assigned to the Administrators group

Security: Restore files and directories user right must only be assigned to the Administrators group

Security: System default permissions of global system objects must be strengthened

Security: System must have orphaned security identifiers (SIDs) removed from user rights

Security: System must preserve zone information when saving attachments

Security: Systems must have UEFI firmware and be configured to run in UEFI mode, not Legacy BIOS

Security: TLS/SSL Insecure Ciphers (SCHANNEL)

Security: Take ownership of files or other objects user right must only be assigned to the Administrators group

Security: The Force shutdown from a remote system user right must only be assigned to the Administrators group

Security: create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service

Threat Intel: Attack Vector: Vulnerable Fan Driver (WinRing0x64 sys)

Windows Installer: Disable -Always install with elevated privileges- option

Windows Installer: Must prevent users from changing installation options

Windows OS: Build Version Check (End Of Life)

Windows OS: Build Version Check (OS Updated)

Windows OS: Data Execution Prevention (DEP) must be configured to at least OptOut

Windows OS: Explorer Data Execution Prevention must be enabled

Windows OS: Must not have the Fax Server role installed

Windows OS: Must not have the Microsoft FTP service installed

Windows OS: Must not have the Peer Name Resolution Protocol installed

Windows OS: Must not have the TFTP Client Installed

Windows OS: Must not have the Telnet Client Installed

Windows OS: Windows Activation Status

Full tag list

nist800-53-server (204) stig-medium-server (199) nist800-171-server (177) nist800-53-desktop (169) cmmc2-l2-server (162) stig-medium-desktop (147) pci-dss-v4-server (131) nist800-171-desktop (128) security-server (121) cmmc2-l2-desktop (119) hipaa-server (96) security-desktop (95) pci-dss-v4-desktop (89) hipaa-desktop (65) bestpractice-desktop (39) cis-csc-server (38) bestpractice-server (35) cis-csc-desktop (34) mitre-att-server (32) mitre-att-desktop (30) cmmc2-l1-server (24) stig-high-desktop (23) stig-high-server (22) cmmc2-l1-desktop (21) pci-dss-v3.2-server (20) bestpractice-domaincontroller (16) tisax (16) cmmc2-l3-server (16) pci-dss-v3.2-desktop (15) threat-intel-server (13) cmmc2-l3-desktop (12) threat-intel-desktop (12) sec-hardening-desktop (10) sec-hardening-server (10) nist-privacy-server (10) sig-server (9) stig-low-desktop (8) health (8) csa-cmm-server (7) nist-privacy-desktop (7) stig-low-server (6) privacy-server (6) privacy-desktop (6) owasptop-server (6) owasptop-desktop (5) desktop (4) cce-server (4) cce-desktop (4) stig-medium-ie (4) sig-desktop (3) niap-desktop (3) fips140-2 (3) niap-server (3) msoffice (2) vm-guest-host (2) compliance-desktop (2) info-desktop (1) csa-cmm-desktop (1) server (1) domaincontroller-health (1) bitlocker-security-desktop (1) iis-stig-high (1) hyper-v (1) exchange-security (1)

CMMC v2.0 Compliance STIG CIS NIST 800-171 Servers Desktops