Accounts: User Account Control (UAC) approval mode for the built-in Administrator must be enabled
b505fc16-70d3-4275-bcc5-02fac2fdb3af
Accounts: User Account Control (UAC) must automatically deny standard user requests for elevation
2a28f305-e508-40e1-80e4-e7702143703b
Accounts: User Account Control (UAC) must be configured to detect application installations and prompt for elevation
ed5ca948-5cbf-431d-a5da-39d02bd64c48
Accounts: User Account Control (UAC) must run all administrators in Admin Approval Mode, enabling UAC
417239de-2859-45e4-9a8f-43c47f4daedb
Accounts: User Account Control (UAC) must virtualize file and registry write failures to per-user locations
938c99da-1577-427d-908d-8c5e31bd9546
Accounts: User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop
0b28a1d9-618b-45ce-8938-f73cc84fce81
Accounts: User Account Control must only elevate UIAccess applications that are installed in secure locations
b6f678d0-7ffc-48e8-b89c-ca6d301de838
Auditing: Event Log / Viewer must be protected from unauthorized modification and deletion
09651036-eca5-4f3a-83fb-0ff12719b201
Auditing: Permissions for the Security event log must prevent access by non-privileged accounts
f67457c3-6d39-425d-9831-b5e44eaf7d6f
Auditing: Permissions for the System event log must prevent access by non-privileged accounts
31096f12-75ea-425b-b416-f0c0b87dc6ff
General: Windows firewall status
1f229f09-4c15-4bfe-b9f7-ed63d03cd70e
Logon: Require CTRL+ALT+DEL for interactive logons
d2d523f6-4e7a-46e3-b553-ab395a7563e4
Remote Desktop Services: Idle session time limit
a06670b6-460f-45ae-93ef-02d41f52d45e
Remote Desktop Services: Must always prompt a client for passwords upon connection
8cbb9955-eb5c-4bcf-9352-3bbc31f7ed71
Remote Desktop Services: Must be configured with the client connection encryption set to High Level
0cf4a80a-705e-4831-9e1d-bc91c93e4625
Remote Desktop Services: Must not save passwords in the Remote Desktop Client
bfb98113-cc94-400b-a385-af36657755f6
Remote Desktop Services: Must require secure Remote Procedure Call (RPC) communications
20a8c861-e142-4e51-bf82-b0ef8bd1343c
Services: List services containing a space in service path not enclosed in quotes
ac341c51-3c29-4437-92a5-9b1e8506b2c8
Threat Intel: Attack Vector: Disable LLMNR
3724e477-bdea-4a74-96b7-7ac79e157087
Threat Intel: Attack Vector: Disable Windows Event Logging
f1bc38dc-fbda-45cd-9ec9-7f69dfd7b00e
Threat Intel: Attack Vector: Preventing Unauthorized Application Execution
28c9bd0b-46c9-4740-aa57-88705ff28fb1
Windows OS: Build Version Check (End Of Life)
07b6c273-cdb3-4a4d-889d-d1d54dc0eb5f