windowsClient Windows Client CIS Vulnerability Reference

• 1.1 Password Policy — weak Enforce password history, Maximum/Minimum password age, Minimum password length (CIS: 14+), Password complexity, or Store passwords using reversible encryption enabled all directly hand an attacker (or the scoring engine) an easy account-cracking vulnerability. (L1)
• 1.1.6 Relax minimum password length limits should be Enabled — lets you set >14 char policy. (L1)
• 1.2 Account Lockout Policy — no lockout duration/threshold/reset counter means unlimited brute-force login attempts against local accounts. (L1)
• 1.2.3 Administrator account lockout not allowed — the built-in admin account is exempt from lockout by default, a classic overlooked hole. (L1)

• 2.2 User Rights Assignment — the most commonly-scored misconfiguration is granting Access this computer from the network, Allow log on locally, Allow log on through Remote Desktop Services, Debug programs, Act as part of the operating system, or Take ownership of files or other objects to a non-admin/unauthorized account or "Everyone." Cross-check every right against "who should actually have this" — don't just trust defaults blindly. (L1)
• 2.3.1 Accounts — Administrator account status, Guest account status, "Limit local account use of blank passwords to console logon only" (should be Enabled), and renaming the built-in Administrator/Guest accounts. (L1)
• 2.3.7 Interactive logon — Do not display last signed-in, Machine inactivity limit (auto-lock timeout), Number of previous logons to cache (should be low, e.g. 4 or fewer), Prompt user to change password before expiration. (L1, one item L2)
• 2.3.8/2.3.9 Microsoft network client/server — Digitally sign communications (always) should be Enabled for both — unsigned SMB traffic is vulnerable to relay/MITM attacks. (L1)
• 2.3.10 Network access — Do not allow anonymous enumeration of SAM accounts (and shares), Let Everyone permissions apply to anonymous users (should be Disabled), Shares that can be accessed anonymously (should be empty), Sharing and security model for local accounts (should be Classic). Anonymous SAM enumeration is a very common scored vulnerability. (L1)
• 2.3.11 Network security — LAN Manager authentication level (should require NTLMv2, refuse LM/NTLM), Do not store LAN Manager hash value on next password change (Enabled), Minimum session security for NTLM SSP clients/servers (require NTLMv2 + 128-bit encryption), Kerberos encryption types restricted to AES. (L1)
• 2.3.17 User Account Control — Admin Approval Mode enabled, Behavior of the elevation prompt for administrators/standard users, Detect application installations and prompt for elevation, Run all administrators in Admin Approval Mode (should be Enabled — disabling this fully turns UAC off). (L1)

• 3.x Event Log max size and retention for Application/Security/Setup/System logs too small — logs roll over and destroy evidence needed for forensics questions. (L1)
• 5.x System Services — any unnecessary/unauthorized service left in Automatic/Running state (Telnet, FTP, Remote Registry, etc. — matches what's already in the master checklist's services table). (L1)

• For all three profiles (Domain/Private/Public): firewall state On, default inbound action Block, default outbound action Allow, Display a notification behavior set intentionally, logging enabled with a real (non-trivial) log file size limit, both dropped and successful-connections logging enabled. Missing this on even one of the three profiles is a common scoring gap since people often only fix "Public." (L1)

Nine sub-categories, each independently switchable — a full Level 1 pass enables Success and/or Failure auditing across all of these (not just "turn on auditing" as one blanket toggle):

• 17.1 Account Logon — Credential Validation
• 17.2 Account Management — Application/Security/User Account Management
• 17.3 Detailed Tracking — PNP Activity, Process Creation
• 17.5 Logon/Logoff — Account Lockout, Group Membership, Logoff, Logon, Other Logon/Logoff Events, Special Logon
• 17.6 Object Access — Detailed File Share, File Share, Other Object Access Events, Removable Storage
• 17.7 Policy Change — Audit Policy Change, Authentication/Authorization Policy Change, MPSSVC Rule-Level Policy Change, Other Policy Change Events
• 17.8 Privilege Use — Sensitive Privilege Use
• 17.9 System — IPsec Driver, Other System Events, Security State Change, Security System Extension, System Integrity

(L1) — Windows' basic Audit Policy (auditpol /set /category:...) is a coarse version of this; the "Advanced" GPO tree lets you enable each subcategory precisely, which is what CIS actually recommends.

• 18.4 MS Security Guide — SMBv1 client/server disabled, WDigest Authentication Disabled (prevents plaintext credential caching in LSASS — a classic Mimikatz target), Enable Structured Exception Handling Overwrite Protection (SEHOP) Enabled. (L1)
• 18.5 MSS (Legacy) — AutoAdminLogon Disabled (no auto-login!), IP source routing protection Enabled (highest), ICMP redirects Disabled, SafeDllSearchMode Enabled, screen-saver grace period ≤5 sec. (mostly L1, a few L2)
• 18.6.4 DNS Client — multicast DNS (mDNS) and NetBIOS name resolution on public networks Disabled, multicast name resolution off. (L1)
• 18.6.7/18.6.8 Lanman Server/Workstation — insecure guest logons Disabled, SMB signing/encryption required, minimum SMB version set to 3.1.1. (L1)
• 18.6.11 Network Connections — Network Bridge prohibited, Internet Connection Sharing prohibited on domain networks. (L1)
• 18.6.14 Hardened UNC Paths configured (Require Mutual Authentication/Integrity/Privacy) for NETLOGON and SYSVOL shares — closes a known SMB relay path. (L1)
• 18.7 Printers — Allow Print Spooler to accept client connections Disabled (mitigates PrintNightmare-style attacks), point-and-print restrictions. (L1)
• 18.9/18.10 System / Windows Components (curated):
  • Credential User Interface — "Do not display the password reveal button," "Enumerate administrator accounts on elevation" Disabled, "Prevent use of security questions for local accounts." (L1)
  • Early Launch Antimalware — Boot-Start Driver Initialization Policy set to Good/Unknown/Bad-but-critical only. (L1)
  • Event Log Service — per-log max size + retention behavior for Application/Security/Setup/System. (L1)
  • Remote Desktop Services — Always prompt for password upon connection, Set client connection encryption level to High, idle/disconnected session time limits, Do not allow drive redirection. (mix of L1/L2)
  • Windows PowerShell — Script Block Logging and Transcription enabled — without this, malicious PowerShell activity leaves no forensic trail. (L2 — high value for forensics questions, low risk to enable)
  • AutoPlay Policies — AutoPlay disabled for all drives, "Turn off Autoplay" Enabled. Ties directly to the "Disable Autorun/Autoplay" item already in the master checklist. (L1)
  • Attachment Manager — notification/zone info preserved on file attachments. (L1)
  • Windows Update — updates not deferred indefinitely, no consumer-driver-search restrictions blocking security patches. (L1)

• 19.7.5 Attachment Manager, 19.7.6 AutoPlay Policies (user-scope duplicate of the computer-scope setting — check both), 19.7.29 Remote Desktop Services, 19.7.30 RSS Feeds (should not auto-download enclosures). (L1)

Cross-check each [ ] item above against Windows_Client_Master_Checklist.md. Anything unchecked after that comparison is a genuine coverage gap worth adding — see the cross-check summary delivered alongside this document.