第1页 / 共816页
第2页 / 共816页
第3页 / 共816页
第4页 / 共816页
第5页 / 共816页
第6页 / 共816页
第7页 / 共816页
第8页 / 共816页
CIS_Microsoft_Windows_Server_2016_RTM_Release 1607_Benchmark_v1.0.0.pdf
CIS Microsoft Windows Server 2016 RTM (Release 1607)
Benchmark
v1.0.0 - 03-31-2017
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike
4.0 International Public License. The link to the license terms can be found at
https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode
To further clarify the Creative Commons license related to CIS Benchmark content, you are
authorized to copy and redistribute the content for use by you, within your organization
and outside your organization for non-commercial purposes only, provided that (i)
appropriate credit is given to CIS, (ii) a link to the license is provided. Additionally, if you
remix, transform or build upon the CIS Benchmark(s), you may only distribute the modified
materials if they are subject to the same license terms as the original Benchmark license
and your derivative will no longer be a CIS Benchmark. Commercial use of CIS Benchmarks
is subject to the prior approval of the Center for Internet Security.
1 | P a g e
Table of Contents
Overview ............................................................................................................................................................... 24
Intended Audience ........................................................................................................................................ 24
Consensus Guidance ..................................................................................................................................... 24
Typographical Conventions ...................................................................................................................... 25
Scoring Information ..................................................................................................................................... 25
Profile Definitions ......................................................................................................................................... 26
Acknowledgements ...................................................................................................................................... 28
Recommendations ............................................................................................................................................. 29
1 Account Policies ......................................................................................................................................... 29
1.1 Password Policy ................................................................................................................................. 29
1.1.1 (L1) Ensure 'Enforce password history' is set to '24 or more password(s)'
(Scored) ................................................................................................................................................... 29
1.1.2 (L1) Ensure 'Maximum password age' is set to '60 or fewer days, but not 0'
(Scored) ................................................................................................................................................... 32
1.1.3 (L1) Ensure 'Minimum password age' is set to '1 or more day(s)' (Scored) ..... 34
1.1.4 (L1) Ensure 'Minimum password length' is set to '14 or more character(s)'
(Scored) ................................................................................................................................................... 36
1.1.5 (L1) Ensure 'Password must meet complexity requirements' is set to 'Enabled'
(Scored) ................................................................................................................................................... 38
1.1.6 (L1) Ensure 'Store passwords using reversible encryption' is set to 'Disabled'
(Scored) ................................................................................................................................................... 41
1.2 Account Lockout Policy ................................................................................................................... 43
1.2.1 (L1) Ensure 'Account lockout duration' is set to '15 or more minute(s)'
(Scored) ................................................................................................................................................... 43
1.2.2 (L1) Ensure 'Account lockout threshold' is set to '10 or fewer invalid logon
attempt(s), but not 0' (Scored) ....................................................................................................... 45
1.2.3 (L1) Ensure 'Reset account lockout counter after' is set to '15 or more
minute(s)' (Scored) ............................................................................................................................. 47
2 Local Policies ............................................................................................................................................... 49
2.1 Audit Policy .......................................................................................................................................... 49
2 | P a g e
2.2 User Rights Assignment .................................................................................................................. 49
2.2.1 (L1) Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'
(Scored) ................................................................................................................................................... 49
2.2.2 (L1) Configure 'Access this computer from the network' (Scored) ...................... 51
2.2.3 (L1) Ensure 'Act as part of the operating system' is set to 'No One' (Scored) .. 53
2.2.4 (L1) Ensure 'Add workstations to domain' is set to 'Administrators' (DC only)
(Scored) ................................................................................................................................................... 55
2.2.5 (L1) Ensure 'Adjust memory quotas for a process' is set to 'Administrators,
LOCAL SERVICE, NETWORK SERVICE' (Scored) ..................................................................... 57
2.2.6 (L1) Configure 'Allow log on locally' (Scored) ............................................................... 59
2.2.7 (L1) Configure 'Allow log on through Remote Desktop Services' (Scored) ....... 61
2.2.8 (L1) Ensure 'Back up files and directories' is set to 'Administrators' (Scored) 63
2.2.9 (L1) Ensure 'Change the system time' is set to 'Administrators, LOCAL
SERVICE' (Scored) ............................................................................................................................... 65
2.2.10 (L1) Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE'
(Scored) ................................................................................................................................................... 68
2.2.11 (L1) Ensure 'Create a pagefile' is set to 'Administrators' (Scored) .................... 70
2.2.12 (L1) Ensure 'Create a token object' is set to 'No One' (Scored) ........................... 72
2.2.13 (L1) Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE,
NETWORK SERVICE, SERVICE' (Scored) .................................................................................... 74
2.2.14 (L1) Ensure 'Create permanent shared objects' is set to 'No One' (Scored) ... 76
2.2.15 (L1) Configure 'Create symbolic links' (Scored) ........................................................ 78
2.2.16 (L1) Ensure 'Debug programs' is set to 'Administrators' (Scored) .................... 80
2.2.17 (L1) Configure 'Deny access to this computer from the network' (Scored) ... 82
2.2.18 (L1) Ensure 'Deny log on as a batch job' to include 'Guests' (Scored) .............. 84
2.2.19 (L1) Ensure 'Deny log on as a service' to include 'Guests' (Scored) ................... 86
2.2.20 (L1) Ensure 'Deny log on locally' to include 'Guests' (Scored) ............................. 88
2.2.21 (L1) Ensure 'Deny log on through Remote Desktop Services' to include
'Guests, Local account' (Scored) .................................................................................................... 90
2.2.22 (L1) Configure 'Enable computer and user accounts to be trusted for
delegation' (Scored) ............................................................................................................................ 92
2.2.23 (L1) Ensure 'Force shutdown from a remote system' is set to 'Administrators'
(Scored) ................................................................................................................................................... 94
3 | P a g e
2.2.24 (L1) Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK
SERVICE' (Scored) ............................................................................................................................... 96
2.2.25 (L1) Configure 'Impersonate a client after authentication' (Scored) ................ 98
2.2.26 (L1) Ensure 'Increase scheduling priority' is set to 'Administrators' (Scored)
................................................................................................................................................................... 100
2.2.27 (L1) Ensure 'Load and unload device drivers' is set to 'Administrators'
(Scored) ................................................................................................................................................. 102
2.2.28 (L1) Ensure 'Lock pages in memory' is set to 'No One' (Scored) ...................... 104
2.2.29 (L2) Ensure 'Log on as a batch job' is set to 'Administrators' (DC Only)
(Scored) ................................................................................................................................................. 106
2.2.30 (L1) Configure 'Manage auditing and security log' (Scored) .............................. 108
2.2.31 (L1) Ensure 'Modify an object label' is set to 'No One' (Scored) ....................... 110
2.2.32 (L1) Ensure 'Modify firmware environment values' is set to 'Administrators'
(Scored) ................................................................................................................................................. 112
2.2.33 (L1) Ensure 'Perform volume maintenance tasks' is set to 'Administrators'
(Scored) ................................................................................................................................................. 114
2.2.34 (L1) Ensure 'Profile single process' is set to 'Administrators' (Scored) ......... 116
2.2.35 (L1) Ensure 'Profile system performance' is set to 'Administrators, NT
SERVICE\WdiServiceHost' (Scored) .......................................................................................... 118
2.2.36 (L1) Ensure 'Replace a process level token' is set to 'LOCAL SERVICE,
NETWORK SERVICE' (Scored) ...................................................................................................... 120
2.2.37 (L1) Ensure 'Restore files and directories' is set to 'Administrators' (Scored)
................................................................................................................................................................... 122
2.2.38 (L1) Ensure 'Shut down the system' is set to 'Administrators' (Scored) ....... 124
2.2.39 (L1) Ensure 'Synchronize directory service data' is set to 'No One' (DC only)
(Scored) ................................................................................................................................................. 126
2.2.40 (L1) Ensure 'Take ownership of files or other objects' is set to
'Administrators' (Scored) ............................................................................................................... 128
2.3 Security Options .............................................................................................................................. 130
2.3.1.1 (L1) Ensure 'Accounts: Administrator account status' is set to 'Disabled'
(Scored) ................................................................................................................................................. 130
2.3.1.2 (L1) Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or
log on with Microsoft accounts' (Scored) ................................................................................. 132
2.3.1.3 (L1) Ensure 'Accounts: Guest account status' is set to 'Disabled' (Scored) .. 134
4 | P a g e
2.3.1.4 (L1) Ensure 'Accounts: Limit local account use of blank passwords to console
logon only' is set to 'Enabled' (Scored) ..................................................................................... 136
2.3.1.5 (L1) Configure 'Accounts: Rename administrator account' (Scored) ............. 138
2.3.1.6 (L1) Configure 'Accounts: Rename guest account' (Scored) .............................. 140
2.3.2.1 (L1) Ensure 'Audit: Force audit policy subcategory settings (Windows Vista
or later) to override audit policy category settings' is set to 'Enabled' (Scored) ..... 142
2.3.2.2 (L1) Ensure 'Audit: Shut down system immediately if unable to log security
audits' is set to 'Disabled' (Scored) ............................................................................................. 144
2.3.4.1 (L1) Ensure 'Devices: Allowed to format and eject removable media' is set to
'Administrators' (Scored) ............................................................................................................... 146
2.3.4.2 (L1) Ensure 'Devices: Prevent users from installing printer drivers' is set to
'Enabled' (Scored) ............................................................................................................................. 148
2.3.5.1 (L1) Ensure 'Domain controller: Allow server operators to schedule tasks' is
set to 'Disabled' (DC only) (Scored) ........................................................................................... 150
2.3.5.2 (L1) Ensure 'Domain controller: LDAP server signing requirements' is set to
'Require signing' (DC only) (Scored) ......................................................................................... 152
2.3.5.3 (L1) Ensure 'Domain controller: Refuse machine account password changes'
is set to 'Disabled' (DC only) (Scored) ....................................................................................... 154
2.3.6.1 (L1) Ensure 'Domain member: Digitally encrypt or sign secure channel data
(always)' is set to 'Enabled' (Scored) ......................................................................................... 156
2.3.6.2 (L1) Ensure 'Domain member: Digitally encrypt secure channel data (when
possible)' is set to 'Enabled' (Scored) ........................................................................................ 158
2.3.6.3 (L1) Ensure 'Domain member: Digitally sign secure channel data (when
possible)' is set to 'Enabled' (Scored) ........................................................................................ 160
2.3.6.4 (L1) Ensure 'Domain member: Disable machine account password changes'
is set to 'Disabled' (Scored) ........................................................................................................... 162
2.3.6.5 (L1) Ensure 'Domain member: Maximum machine account password age' is
set to '30 or fewer days, but not 0' (Scored) ........................................................................... 164
2.3.6.6 (L1) Ensure 'Domain member: Require strong (Windows 2000 or later)
session key' is set to 'Enabled' (Scored) ................................................................................... 166
2.3.7.1 (L1) Ensure 'Interactive logon: Do not display last user name' is set to
'Enabled' (Scored) ............................................................................................................................. 168
2.3.7.2 (L1) Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to
'Disabled' (Scored) ............................................................................................................................ 170
5 | P a g e
2.3.7.3 (L1) Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or
fewer second(s), but not 0' (Scored) .......................................................................................... 172
2.3.7.4 (L1) Configure 'Interactive logon: Message text for users attempting to log
on' (Scored) .......................................................................................................................................... 174
2.3.7.5 (L1) Configure 'Interactive logon: Message title for users attempting to log
on' (Scored) .......................................................................................................................................... 176
2.3.7.6 (L2) Ensure 'Interactive logon: Number of previous logons to cache (in case
domain controller is not available)' is set to '4 or fewer logon(s)' (MS only) (Scored)
................................................................................................................................................................... 178
2.3.7.7 (L1) Ensure 'Interactive logon: Prompt user to change password before
expiration' is set to 'between 5 and 14 days' (Scored) ....................................................... 180
2.3.7.8 (L1) Ensure 'Interactive logon: Require Domain Controller Authentication to
unlock workstation' is set to 'Enabled' (MS only) (Scored) .............................................. 182
2.3.7.9 (L1) Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock
Workstation' or higher (Scored) .................................................................................................. 184
2.3.8.1 (L1) Ensure 'Microsoft network client: Digitally sign communications
(always)' is set to 'Enabled' (Scored) ......................................................................................... 186
2.3.8.2 (L1) Ensure 'Microsoft network client: Digitally sign communications (if
server agrees)' is set to 'Enabled' (Scored) ............................................................................. 189
2.3.8.3 (L1) Ensure 'Microsoft network client: Send unencrypted password to third-
party SMB servers' is set to 'Disabled' (Scored) .................................................................... 192
2.3.9.1 (L1) Ensure 'Microsoft network server: Amount of idle time required before
suspending session' is set to '15 or fewer minute(s), but not 0' (Scored) .................. 194
2.3.9.2 (L1) Ensure 'Microsoft network server: Digitally sign communications
(always)' is set to 'Enabled' (Scored) ......................................................................................... 196
2.3.9.3 (L1) Ensure 'Microsoft network server: Digitally sign communications (if
client agrees)' is set to 'Enabled' (Scored) ............................................................................... 199
2.3.9.4 (L1) Ensure 'Microsoft network server: Disconnect clients when logon hours
expire' is set to 'Enabled' (Scored).............................................................................................. 202
2.3.9.5 (L1) Ensure 'Microsoft network server: Server SPN target name validation
level' is set to 'Accept if provided by client' or higher (MS only) (Scored) ................. 204
2.3.10.1 (L1) Ensure 'Network access: Allow anonymous SID/Name translation' is
set to 'Disabled' (Scored) ................................................................................................................ 206
2.3.10.2 (L1) Ensure 'Network access: Do not allow anonymous enumeration of SAM
accounts' is set to 'Enabled' (MS only) (Scored).................................................................... 208
6 | P a g e
2.3.10.3 (L1) Ensure 'Network access: Do not allow anonymous enumeration of SAM
accounts and shares' is set to 'Enabled' (MS only) (Scored) ............................................ 210
2.3.10.4 (L2) Ensure 'Network access: Do not allow storage of passwords and
credentials for network authentication' is set to 'Enabled' (Scored) ............................ 212
2.3.10.5 (L1) Ensure 'Network access: Let Everyone permissions apply to
anonymous users' is set to 'Disabled' (Scored) ..................................................................... 214
2.3.10.6 (L1) Configure 'Network access: Named Pipes that can be accessed
anonymously' (Scored).................................................................................................................... 216
2.3.10.7 (L1) Configure 'Network access: Remotely accessible registry paths'
(Scored) ................................................................................................................................................. 218
2.3.10.8 (L1) Configure 'Network access: Remotely accessible registry paths and
sub-paths' (Scored) ........................................................................................................................... 220
2.3.10.9 (L1) Ensure 'Network access: Restrict anonymous access to Named Pipes
and Shares' is set to 'Enabled' (Scored) .................................................................................... 223
2.3.10.10 (L1) Ensure 'Network access: Restrict clients allowed to make remote calls
to SAM' is set to 'Administrators: Remote Access: Allow' (MS only) (Scored) .......... 225
2.3.10.11 (L1) Ensure 'Network access: Shares that can be accessed anonymously' is
set to 'None' (Scored) ....................................................................................................................... 227
2.3.10.12 (L1) Ensure 'Network access: Sharing and security model for local
accounts' is set to 'Classic - local users authenticate as themselves' (Scored) .......... 229
2.3.11.1 (L1) Ensure 'Network security: Allow Local System to use computer
identity for NTLM' is set to 'Enabled' (Scored) ...................................................................... 231
2.3.11.2 (L1) Ensure 'Network security: Allow LocalSystem NULL session fallback' is
set to 'Disabled' (Scored) ................................................................................................................ 233
2.3.11.3 (L1) Ensure 'Network Security: Allow PKU2U authentication requests to
this computer to use online identities' is set to 'Disabled' (Scored) .............................. 235
2.3.11.4 (L1) Ensure 'Network security: Configure encryption types allowed for
Kerberos' is set to 'RC4_HMAC_MD5, AES128_HMAC_SHA1, AES256_HMAC_SHA1,
Future encryption types' (Scored) .............................................................................................. 237
2.3.11.5 (L1) Ensure 'Network security: Do not store LAN Manager hash value on
next password change' is set to 'Enabled' (Scored) ............................................................. 239
2.3.11.6 (L1) Ensure 'Network security: Force logoff when logon hours expire' is set
to 'Enabled' (Scored) ........................................................................................................................ 241
2.3.11.7 (L1) Ensure 'Network security: LAN Manager authentication level' is set to
'Send NTLMv2 response only. Refuse LM & NTLM' (Scored) ........................................... 243
7 | P a g e
相关推荐
2023年江西萍乡中考道德与法治真题及答案.doc
2012年重庆南川中考生物真题及答案.doc
2013年江西师范大学地理学综合及文艺理论基础考研真题.doc
2020年四川甘孜小升初语文真题及答案I卷.doc
2020年注册岩土工程师专业基础考试真题及答案.doc
2023-2024学年福建省厦门市九年级上学期数学月考试题及答案.doc
2021-2022学年辽宁省沈阳市大东区九年级上学期语文期末试题及答案.doc
2022-2023学年北京东城区初三第一学期物理期末试卷及答案.doc
2018上半年江西教师资格初中地理学科知识与教学能力真题及答案.doc
2012年河北国家公务员申论考试真题及答案-省级.doc
2020-2021学年江苏省扬州市江都区邵樊片九年级上学期数学第一次质量检测试题及答案.doc
2022下半年黑龙江教师资格证中学综合素质真题及答案.doc
