Released 2024-05-02
| STIG ID | Title |
|---|---|
| WN16-00-000010 | Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. |
| WN16-00-000030 | Passwords for the built-in Administrator account must be changed at least every 60 days. |
| WN16-00-000040 | Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. |
| WN16-00-000050 | Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. |
| WN16-00-000060 | Manually managed application account passwords must be at least 14 characters in length. |
| WN16-00-000070 | Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. |
| WN16-00-000080 | Shared user accounts must not be permitted on the system. |
| WN16-00-000090 | Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. |
| WN16-00-000100 | Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. |
| WN16-00-000110 | Systems must be maintained at a supported servicing level. |
| WN16-00-000120 | The Windows Server 2016 system must use an anti-virus program. |
| WN16-00-000140 | Servers must have a host-based intrusion detection or prevention system. |
| WN16-00-000150 | Local volumes must use a format that supports NTFS attributes. |
| WN16-00-000160 | Permissions for the system drive root directory (usually C:\) must conform to minimum requirements. |
| WN16-00-000170 | Permissions for program file directories must conform to minimum requirements. |
| WN16-00-000180 | Permissions for the Windows installation directory must conform to minimum requirements. |
| WN16-00-000190 | Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained. |
| WN16-00-000200 | Non-administrative accounts or groups must only have print permissions on printer shares. |
| WN16-00-000210 | Outdated or unused accounts must be removed from the system or disabled. |
| WN16-00-000220 | Windows Server 2016 accounts must require passwords. |
| WN16-00-000230 | Passwords must be configured to expire. |
| WN16-00-000240 | System files must be monitored for unauthorized changes. |
| WN16-00-000250 | Non-system-created file shares on a system must limit access to groups that require it. |
| WN16-00-000270 | Software certificate installation files must be removed from Windows Server 2016. |
| WN16-00-000280 | Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. |
| WN16-00-000290 | Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. |
| WN16-00-000300 | The roles and features required by the system must be documented. |
| WN16-00-000310 | A host-based firewall must be installed and enabled on the system. |
| WN16-00-000320 | Windows Server 2016 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Endpoint Security Solution (ESS) is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). |
| WN16-00-000330 | Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours. |
| WN16-00-000340 | Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours. |
| WN16-00-000350 | The Fax Server role must not be installed. |
| WN16-00-000360 | The Microsoft FTP service must not be installed unless required. |
| WN16-00-000370 | The Peer Name Resolution Protocol must not be installed. |
| WN16-00-000380 | Simple TCP/IP Services must not be installed. |
| WN16-00-000390 | The Telnet Client must not be installed. |
| WN16-00-000400 | The TFTP Client must not be installed. |
| WN16-00-000410 | The Server Message Block (SMB) v1 protocol must be uninstalled. |
| WN16-00-000411 | The Server Message Block (SMB) v1 protocol must be disabled on the SMB server. |
| WN16-00-000412 | The Server Message Block (SMB) v1 protocol must be disabled on the SMB client. |
| WN16-00-000420 | Windows PowerShell 2.0 must not be installed. |
| WN16-00-000430 | FTP servers must be configured to prevent anonymous logons. |
| WN16-00-000440 | FTP servers must be configured to prevent access to the system drive. |
| WN16-00-000450 | The time service must synchronize with an appropriate DoD time source. |
| WN16-00-000460 | Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016. |
| WN16-00-000470 | Secure Boot must be enabled on Windows Server 2016 systems. |
| WN16-00-000480 | Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. |
| WN16-AC-000010 | Windows 2016 account lockout duration must be configured to 15 minutes or greater. |
| WN16-AC-000020 | Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less. |
| WN16-AC-000030 | Windows Server 2016 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater. |
| WN16-AC-000040 | Windows Server 2016 password history must be configured to 24 passwords remembered. |
| WN16-AC-000050 | Windows Server 2016 maximum password age must be configured to 60 days or less. |
| WN16-AC-000060 | Windows Server 2016 minimum password age must be configured to at least one day. |
| WN16-AC-000070 | Windows Server 2016 minimum password length must be configured to 14 characters. |
| WN16-AC-000080 | Windows Server 2016 must have the built-in Windows password complexity policy enabled. |
| WN16-AC-000090 | Windows Server 2016 reversible password encryption must be disabled. |
| WN16-AU-000010 | Audit records must be backed up to a different system or media than the system being audited. |
| WN16-AU-000020 | Windows Server 2016 must, at a minimum, offload audit records of interconnected systems in real time and offload standalone or nondomain-joined systems weekly. |
| WN16-AU-000030 | Permissions for the Application event log must prevent access by non-privileged accounts. |
| WN16-AU-000040 | Permissions for the Security event log must prevent access by non-privileged accounts. |
| WN16-AU-000050 | Permissions for the System event log must prevent access by non-privileged accounts. |
| WN16-AU-000060 | Event Viewer must be protected from unauthorized modification and deletion. |
| WN16-AU-000070 | Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes. |
| WN16-AU-000080 | Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures. |
| WN16-AU-000100 | Windows Server 2016 must be configured to audit Account Management - Other Account Management Events successes. |
| WN16-AU-000120 | Windows Server 2016 must be configured to audit Account Management - Security Group Management successes. |
| WN16-AU-000140 | Windows Server 2016 must be configured to audit Account Management - User Account Management successes. |
| WN16-AU-000150 | Windows Server 2016 must be configured to audit Account Management - User Account Management failures. |
| WN16-AU-000160 | Windows Server 2016 must be configured to audit Detailed Tracking - Plug and Play Events successes. |
| WN16-AU-000170 | Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes. |
| WN16-AU-000230 | Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures. |
| WN16-AU-000240 | Windows Server 2016 must be configured to audit Logon/Logoff - Group Membership successes. |
| WN16-AU-000250 | Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes. |
| WN16-AU-000260 | Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes. |
| WN16-AU-000270 | Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures. |
| WN16-AU-000280 | Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes. |
| WN16-AU-000285 | Windows 2016 must be configured to audit Object Access - Other Object Access Events successes. |
| WN16-AU-000286 | Windows 2016 must be configured to audit Object Access - Other Object Access Events failures. |
| WN16-AU-000290 | Windows Server 2016 must be configured to audit Object Access - Removable Storage successes. |
| WN16-AU-000300 | Windows Server 2016 must be configured to audit Object Access - Removable Storage failures. |
| WN16-AU-000310 | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes. |
| WN16-AU-000320 | Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures. |
| WN16-AU-000330 | Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change successes. |
| WN16-AU-000340 | Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change successes. |
| WN16-AU-000350 | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes. |
| WN16-AU-000360 | Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures. |
| WN16-AU-000370 | Windows Server 2016 must be configured to audit System - IPsec Driver successes. |
| WN16-AU-000380 | Windows Server 2016 must be configured to audit System - IPsec Driver failures. |
| WN16-AU-000390 | Windows Server 2016 must be configured to audit System - Other System Events successes. |
| WN16-AU-000400 | Windows Server 2016 must be configured to audit System - Other System Events failures. |
| WN16-AU-000410 | Windows Server 2016 must be configured to audit System - Security State Change successes. |
| WN16-AU-000420 | Windows Server 2016 must be configured to audit System - Security System Extension successes. |
| WN16-AU-000440 | Windows Server 2016 must be configured to audit System - System Integrity successes. |
| WN16-AU-000450 | Windows Server 2016 must be configured to audit System - System Integrity failures. |
| WN16-CC-000010 | The display of slide shows on the lock screen must be disabled. |
| WN16-CC-000030 | WDigest Authentication must be disabled on Windows Server 2016. |
| WN16-CC-000040 | Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. |
| WN16-CC-000050 | Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. |
| WN16-CC-000060 | Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. |
| WN16-CC-000070 | Windows Server 2016 must be configured to ignore NetBIOS name release requests except from WINS servers. |
| WN16-CC-000080 | Insecure logons to an SMB server must be disabled. |
| WN16-CC-000090 | Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. |
| WN16-CC-000100 | Command line data must be included in process creation events. |
| WN16-CC-000110 | Windows Server 2016 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. |
| WN16-CC-000140 | Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. |
| WN16-CC-000150 | Group Policy objects must be reprocessed even if they have not changed. |
| WN16-CC-000160 | Downloading print driver packages over HTTP must be prevented. |
| WN16-CC-000170 | Printing over HTTP must be prevented. |
| WN16-CC-000180 | The network selection user interface (UI) must not be displayed on the logon screen. |
| WN16-CC-000210 | Users must be prompted to authenticate when the system wakes from sleep (on battery). |
| WN16-CC-000220 | Users must be prompted to authenticate when the system wakes from sleep (plugged in). |
| WN16-CC-000240 | The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft. |
| WN16-CC-000250 | AutoPlay must be turned off for non-volume devices. |
| WN16-CC-000260 | The default AutoRun behavior must be configured to prevent AutoRun commands. |
| WN16-CC-000270 | AutoPlay must be disabled for all drives. |
| WN16-CC-000280 | Administrator accounts must not be enumerated during elevation. |
| WN16-CC-000290 | Windows Telemetry must be configured to Security or Basic. |
| WN16-CC-000300 | The Application event log size must be configured to 32768 KB or greater. |
| WN16-CC-000310 | The Security event log size must be configured to 196608 KB or greater. |
| WN16-CC-000320 | The System event log size must be configured to 32768 KB or greater. |
| WN16-CC-000330 | Windows Server 2016 Windows SmartScreen must be enabled. |
| WN16-CC-000340 | Explorer Data Execution Prevention must be enabled. |
| WN16-CC-000350 | Turning off File Explorer heap termination on corruption must be disabled. |
| WN16-CC-000360 | File Explorer shell protocol must run in protected mode. |
| WN16-CC-000370 | Passwords must not be saved in the Remote Desktop Client. |
| WN16-CC-000380 | Local drives must be prevented from sharing with Remote Desktop Session Hosts. |
| WN16-CC-000390 | Remote Desktop Services must always prompt a client for passwords upon connection. |
| WN16-CC-000400 | The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications. |
| WN16-CC-000410 | Remote Desktop Services must be configured with the client connection encryption set to High Level. |
| WN16-CC-000420 | Attachments must be prevented from being downloaded from RSS feeds. |
| WN16-CC-000421 | The Windows Explorer Preview pane must be disabled for Windows Server 2016. |
| WN16-CC-000430 | Basic authentication for RSS feeds over HTTP must not be used. |
| WN16-CC-000440 | Indexing of encrypted files must be turned off. |
| WN16-CC-000450 | Users must be prevented from changing installation options. |
| WN16-CC-000460 | The Windows Installer Always install with elevated privileges option must be disabled. |
| WN16-CC-000470 | Users must be notified if a web-based program attempts to install software. |
| WN16-CC-000480 | Automatically signing in the last interactive user after a system-initiated restart must be disabled. |
| WN16-CC-000490 | PowerShell script block logging must be enabled. |
| WN16-CC-000500 | The Windows Remote Management (WinRM) client must not use Basic authentication. |
| WN16-CC-000510 | The Windows Remote Management (WinRM) client must not allow unencrypted traffic. |
| WN16-CC-000520 | The Windows Remote Management (WinRM) client must not use Digest authentication. |
| WN16-CC-000530 | The Windows Remote Management (WinRM) service must not use Basic authentication. |
| WN16-CC-000540 | The Windows Remote Management (WinRM) service must not allow unencrypted traffic. |
| WN16-CC-000550 | The Windows Remote Management (WinRM) service must not store RunAs credentials. |
| WN16-CC-000555 | Windows Server 2016 must have PowerShell Transcription enabled. |
| WN16-DC-000010 | Only administrators responsible for the domain controller must have Administrator rights on the system. |
| WN16-DC-000020 | Kerberos user logon restrictions must be enforced. |
| WN16-DC-000030 | The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less. |
| WN16-DC-000040 | The Kerberos user ticket lifetime must be limited to 10 hours or less. |
| WN16-DC-000050 | The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less. |
| WN16-DC-000060 | The computer clock synchronization tolerance must be limited to 5 minutes or less. |
| WN16-DC-000070 | Permissions on the Active Directory data files must only allow System and Administrators access. |
| WN16-DC-000080 | The Active Directory SYSVOL directory must have the proper access control permissions. |
| WN16-DC-000090 | Active Directory Group Policy objects must have proper access control permissions. |
| WN16-DC-000100 | The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. |
| WN16-DC-000110 | Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. |
| WN16-DC-000120 | Data files owned by users must be on a different logical partition from the directory server data files. |
| WN16-DC-000130 | Domain controllers must run on a machine dedicated to that function. |
| WN16-DC-000140 | Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data. |
| WN16-DC-000150 | Directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access. |
| WN16-DC-000160 | The directory service must be configured to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity. |
| WN16-DC-000170 | Active Directory Group Policy objects must be configured with proper audit settings. |
| WN16-DC-000180 | The Active Directory Domain object must be configured with proper audit settings. |
| WN16-DC-000190 | The Active Directory Infrastructure object must be configured with proper audit settings. |
| WN16-DC-000200 | The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings. |
| WN16-DC-000210 | The Active Directory AdminSDHolder object must be configured with proper audit settings. |
| WN16-DC-000220 | The Active Directory RID Manager$ object must be configured with proper audit settings. |
| WN16-DC-000230 | Windows Server 2016 must be configured to audit Account Management - Computer Account Management successes. |
| WN16-DC-000240 | Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes. |
| WN16-DC-000250 | Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures. |
| WN16-DC-000260 | Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes. |
| WN16-DC-000280 | Domain controllers must have a PKI server certificate. |
| WN16-DC-000290 | Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). |
| WN16-DC-000300 | PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA). |
| WN16-DC-000310 | Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication. |
| WN16-DC-000320 | Domain controllers must require LDAP access signing. |
| WN16-DC-000330 | Domain controllers must be configured to allow reset of machine account passwords. |
| WN16-DC-000340 | The Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers. |
| WN16-DC-000350 | The Add workstations to domain user right must only be assigned to the Administrators group. |
| WN16-DC-000360 | The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group. |
| WN16-DC-000370 | The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access. |
| WN16-DC-000380 | The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access. |
| WN16-DC-000390 | The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers. |
| WN16-DC-000400 | The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access. |
| WN16-DC-000410 | The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access. |
| WN16-DC-000420 | The Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers. |
| WN16-DC-000430 | The password for the krbtgt account on a domain must be reset at least every 180 days. |
| WN16-MS-000010 | Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. |
| WN16-MS-000020 | Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems. |
| WN16-MS-000030 | Local users on domain-joined computers must not be enumerated. |
| WN16-MS-000040 | Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server. |
| WN16-MS-000050 | Caching of logon credentials must be limited. |
| WN16-MS-000120 | Windows Server 2016 must be running Credential Guard on domain-joined member servers. |
| WN16-MS-000310 | Remote calls to the Security Account Manager (SAM) must be restricted to Administrators. |
| WN16-MS-000340 | The "Access this computer from the network" user right must only be assigned to the Administrators and Authenticated Users groups on member servers. |
| WN16-MS-000370 | The "Deny access to this computer from the network" user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and from unauthenticated access on all systems. |
| WN16-MS-000380 | The "Deny log on as a batch job" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems. |
| WN16-MS-000390 | The "Deny log on as a service" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right. |
| WN16-MS-000400 | The "Deny log on locally" user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems. |
| WN16-MS-000410 | The "Deny log on through Remote Desktop Services" user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems. |
| WN16-MS-000420 | The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on member servers. |
| WN16-PK-000010 | The DoD Root CA certificates must be installed in the Trusted Root Store. |
| WN16-PK-000020 | The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems. |
| WN16-PK-000030 | The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems. |
| WN16-SO-000010 | Windows Server 2016 built-in guest account must be disabled. |
| WN16-SO-000020 | Local accounts with blank passwords must be restricted to prevent access from the network. |
| WN16-SO-000030 | Windows Server 2016 built-in administrator account must be renamed. |
| WN16-SO-000040 | Windows Server 2016 built-in guest account must be renamed. |
| WN16-SO-000050 | Audit policy using subcategories must be enabled. |
| WN16-SO-000080 | The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled. |
| WN16-SO-000090 | The setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled. |
| WN16-SO-000100 | The setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled. |
| WN16-SO-000110 | The computer account password must not be prevented from being reset. |
| WN16-SO-000120 | The maximum age for machine account passwords must be configured to 30 days or less. |
| WN16-SO-000130 | Windows Server 2016 must be configured to require a strong session key. |
| WN16-SO-000140 | The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver. |
| WN16-SO-000150 | The required legal notice must be configured to display before console logon. |
| WN16-SO-000160 | The Windows dialog box title for the legal banner must be configured with the appropriate text. |
| WN16-SO-000180 | The Smart Card removal option must be configured to Force Logoff or Lock Workstation. |
| WN16-SO-000190 | The setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled. |
| WN16-SO-000200 | The setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled. |
| WN16-SO-000210 | Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers. |
| WN16-SO-000230 | The setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled. |
| WN16-SO-000240 | The setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled. |
| WN16-SO-000250 | Anonymous SID/Name translation must not be allowed. |
| WN16-SO-000260 | Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed. |
| WN16-SO-000270 | Anonymous enumeration of shares must not be allowed. |
| WN16-SO-000290 | Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group. |
| WN16-SO-000300 | Anonymous access to Named Pipes and Shares must be restricted. |
| WN16-SO-000320 | Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. |
| WN16-SO-000330 | NTLM must be prevented from falling back to a Null session. |
| WN16-SO-000340 | PKU2U authentication using online identities must be prevented. |
| WN16-SO-000350 | Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites. |
| WN16-SO-000360 | Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords. |
| WN16-SO-000380 | The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM. |
| WN16-SO-000390 | Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing. |
| WN16-SO-000400 | Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. |
| WN16-SO-000410 | Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. |
| WN16-SO-000420 | Users must be required to enter a password to access private keys stored on the computer. |
| WN16-SO-000430 | Windows Server 2016 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing. |
| WN16-SO-000450 | The default permissions of global system objects must be strengthened. |
| WN16-SO-000460 | User Account Control approval mode for the built-in Administrator must be enabled. |
| WN16-SO-000470 | UIAccess applications must not be allowed to prompt for elevation without using the secure desktop. |
| WN16-SO-000480 | User Account Control must, at a minimum, prompt administrators for consent on the secure desktop. |
| WN16-SO-000490 | User Account Control must automatically deny standard user requests for elevation. |
| WN16-SO-000500 | User Account Control must be configured to detect application installations and prompt for elevation. |
| WN16-SO-000510 | User Account Control must only elevate UIAccess applications that are installed in secure locations. |
| WN16-SO-000520 | User Account Control must run all administrators in Admin Approval Mode, enabling UAC. |
| WN16-SO-000530 | User Account Control must virtualize file and registry write failures to per-user locations. |
| WN16-UC-000030 | Zone information must be preserved when saving attachments. |
| WN16-UR-000010 | The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts. |
| WN16-UR-000030 | The Act as part of the operating system user right must not be assigned to any groups or accounts. |
| WN16-UR-000050 | The Allow log on locally user right must only be assigned to the Administrators group. |
| WN16-UR-000070 | The Back up files and directories user right must only be assigned to the Administrators group. |
| WN16-UR-000080 | The Create a pagefile user right must only be assigned to the Administrators group. |
| WN16-UR-000090 | The Create a token object user right must not be assigned to any groups or accounts. |
| WN16-UR-000100 | The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service. |
| WN16-UR-000110 | The Create permanent shared objects user right must not be assigned to any groups or accounts. |
| WN16-UR-000120 | The Create symbolic links user right must only be assigned to the Administrators group. |
| WN16-UR-000130 | The Debug programs user right must only be assigned to the Administrators group. |
| WN16-UR-000200 | The Force shutdown from a remote system user right must only be assigned to the Administrators group. |
| WN16-UR-000210 | The Generate security audits user right must only be assigned to Local Service and Network Service. |
| WN16-UR-000220 | The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service. |
| WN16-UR-000230 | The Increase scheduling priority user right must only be assigned to the Administrators group. |
| WN16-UR-000240 | The Load and unload device drivers user right must only be assigned to the Administrators group. |
| WN16-UR-000250 | The Lock pages in memory user right must not be assigned to any groups or accounts. |
| WN16-UR-000260 | The Manage auditing and security log user right must only be assigned to the Administrators group. |
| WN16-UR-000270 | The Modify firmware environment values user right must only be assigned to the Administrators group. |
| WN16-UR-000280 | The Perform volume maintenance tasks user right must only be assigned to the Administrators group. |
| WN16-UR-000290 | The Profile single process user right must only be assigned to the Administrators group. |
| WN16-UR-000300 | The Restore files and directories user right must only be assigned to the Administrators group. |
| WN16-UR-000310 | The Take ownership of files or other objects user right must only be assigned to the Administrators group. |