windowsServer Windows Server CIS Vulnerability Reference

• 1.1/1.2 Password & Account Lockout Policy — same weak-length/no-lockout vulnerability as the client benchmark, but on a Domain Controller this is enforced via the Default Domain Policy GPO, not local secpol.msc. Editing secpol.msc directly on a DC is a no-op for domain accounts — a very common beginner mistake. (L1)
• 2.2 User Rights Assignment — DC profile differs from MS profile for several rights, e.g. Add workstations to domain, Allow log on locally, Allow log on through Remote Desktop Services, Back up files and directories, Enable computer and user accounts to be trusted for delegation should generally be No One on a DC unless specifically required, Deny access to this computer from the network should include Guests and local accounts on a DC. Check whether the checklist you're using distinguishes MS vs. DC — many generic Windows checklists don't and that's a real gap. (L1)
• 2.3.1 Accounts — Rename administrator account / Rename guest account, Guest disabled, blank-password restriction. (L1)
• 2.3.10 Network access — anonymous SAM/share enumeration disabled — especially important on a DC, since anonymous enumeration of AD accounts is a bigger blast radius than on a standalone client. (L1)

• 3.x Event Log size/retention — on a DC, undersized Security log rolling over destroys evidence of authentication attacks (failed Kerberos/NTLM auth) needed for both scoring and forensics questions. (L1)
• 5.x System Services — DC-specific services (ADWS, DNS, Kdc, Netlogon) should be Automatic; anything unrelated to the server's actual roles (per README) should not be. (L1)

• All the same subcategories as the client benchmark, plus DC-specific high-value ones: Account Logon > Kerberos Authentication Service and Kerberos Service Ticket Operations (Success and Failure), DS Access > Directory Service Access and Directory Service Changes (tracks who reads/modifies AD objects — this category is fully blank/not applicable on a member server but critical on a DC). (L1)

• 18.4 MS Security Guide — SMBv1 client/server disabled, WDigest Authentication disabled (credential-caching mitigation — even more valuable on a DC since it's a prime Mimikatz/LSASS-dump target). (L1)
• 18.6.7/18.6.8 Lanman Server/Workstation — SMB signing/encryption required, minimum SMB version 3.1.1 — a DC with SMB signing off is vulnerable to relay attacks against AD authentication traffic. (L1)
• 18.6.14 Hardened UNC Paths for NETLOGON and SYSVOL — this is the fix for the exact attack class that made the SYSVOL cpassword/Group Policy Preferences vulnerability so dangerous historically; make sure it's actually enforced, not just that old GPP passwords are removed. (L1)
• Remote Desktop Services — same as client: encryption level High, prompt for password, session time limits — but on a server this gates RDP access to the box that runs your directory/DNS/DHCP, so it's higher-stakes. (mix of L1/L2)
• Windows PowerShell — Script Block Logging + Transcription — extremely high value on a server since PowerShell is the most common lateral-movement/AD-enumeration tool once someone has any foothold. (L2)
• Windows Remote Management (WinRM) — client/service should not allow unencrypted traffic, and TrustedHosts should not be a wildcard * — a wildcard TrustedHosts list on a server means it will WinRM-connect to anything, defeating host authentication. (L1/L2)

These come from Microsoft/CIS-aligned AD hardening guidance rather than the numbered Windows Server benchmark itself (the benchmark covers OS hardening, not full AD architecture):

• krbtgt account — password should be rotated periodically in a real environment; in a competition, just confirm it's not disabled/tampered with and isn't a member of any privileged group beyond its default.
• Domain/Enterprise/Schema Admins group membership — audit for any unauthorized member; this is almost always scored.
• AdminSDHolder / protected groups — advanced, low priority for a first pass, but worth knowing exists.
• DNS zone transfer restriction — CIS doesn't number this in the OS benchmark (DNS Server has its own separate, rarely-used CIS benchmark), but it's a real, commonly-scored AD-adjacent vulnerability: zone transfers allowed to "Any server" leak your entire DNS namespace.
• LDAP signing/channel binding — Domain controller: LDAP server signing requirements should be "Require signing" (this one IS in the numbered benchmark, under 2.3.5 Domain controller settings) — unsigned LDAP binds are vulnerable to relay attacks (the AD equivalent of the SMB-signing issue above).

Cross-check each [ ] item above against Windows_Server_Master_Checklist.md, paying special attention to the DC vs. Member Server distinctions since those are the items generic Windows checklists most often get wrong or omit entirely.