Windows 11 Enterprise CIS 4.0 by dantecatalfamo · Pull Request #29191 · fleetdm/fleet

dantecatalfamo · 2025-05-15T20:47:29Z

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.
Manual QA for all new/changed functionality

Results

First Column:

+ = Added
D = Duplicate
X = Updated/Removed
? = Unclear/un-actionable

Tested Column:

Yes = Works as described
NF = Could not find GP setting, but registry key exists and editing it makes the policy pass
NA = Not available. Could not find GP setting, registry setting doesn't exist

	Tested	Type	Comment
+	NF	ADD	5 (L2) Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled'
+	Yes	ADD	18.10.58 (L1) Ensure 'Turn on Basic feed authentication over HTTP' is set to 'Disabled'
+	Yes	ADD	2.3.11 (L1) Ensure 'Network security: LDAP client encryption requirements' is set to 'Negotiate sealing' or higher
+	Yes	ADD	18.6.4 (L1) Ensure 'Configure multicast DNS (mDNS) protocol' is set to 'Disabled'
+	Yes	ADD	18.6.4 (L2) Ensure 'Turn off default IPv6 DNS Servers' is set to 'Enabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Audit client does not support encryption' is set to 'Enabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Audit client does not support signing' is set to 'Enabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Audit insecure guest logon' is set to 'Enabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Enable authentication rate limiter' is set to 'Enabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Enable remote mailslots' is set to 'Disabled'
+	Yes	ADD	18.6.7 (L1) Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1'
+	Yes	ADD	18.6.7 (L1) Ensure 'Set authentication rate limiter delay (milliseconds)' is set to 'Enabled: 2000' or more
+	Yes	ADD	18.6.8 (L1) Ensure 'Audit insecure guest logon' is set to 'Enabled'
+	Yes	ADD	18.6.8 (L1) Ensure 'Audit server does not support encryption' is set to 'Enabled'
+	Yes	ADD	18.6.8 (L1) Ensure 'Audit server does not support signing' is set to 'Enabled'
D	--	ADD	18.6.8 (L1) Ensure 'Enable remote mailslots' is set to 'Disabled'
D	--	ADD	18.6.8 (L1) Ensure 'Mandate the minimum version of SMB' is set to 'Enabled: 3.1.1'
+	Yes	ADD	18.7 (L2) Ensure 'Configure Windows protected print' is set to 'Enabled'
+	Yes	ADD	18.9 (L1) Ensure 'Configure the behavior of the sudo command' is set to 'Enabled: Disabled'
+	Yes	ADD	18.9.30.1 (L1) Ensure 'Block NetBIOS-based discovery for domain controller location' is set to 'Enabled'
+	Yes	ADD	18.9.39 (L1) Ensure 'Configure SAM change password RPC methods policy' is set to 'Enabled: Block all change password RPC methods'
+	Yes	ADD	18.10.3 (L2) Ensure 'Turn off API Sampling' is set to 'Enabled'
+	Yes	ADD	18.10.3 (L2) Ensure 'Turn off Application Footprint' is set to 'Enabled'
+	Yes	ADD	18.10.3 (L2) Ensure 'Turn off Install Tracing' is set to 'Enabled'
+	Yes	ADD	18.10.4 (L1) Ensure 'Not allow per-user unsigned packages to install by default (requires explicitly allow per install)' is set to 'Enabled'
+	Yes	ADD	18.10.18 (L1) Ensure 'Enable App Installer Local Archive Malware Scan Override' is set to 'Disabled'
+	Yes	ADD	18.10.18 (L1) Ensure 'Enable App Installer Microsoft Store Source Certificate Validation Bypass' is set to 'Disabled'
+	Yes	ADD	18.10.18 (L2) Ensure 'Enable Windows Package Manager command line interfaces' is set to 'Disabled'
+	Yes	ADD	18.10.29 (L1) Ensure 'Do not apply the Mark of the Web tag to files copied from insecure sources' is set to 'Disabled'
+	Yes	ADD	18.10.43 (L1) Ensure 'Control whether exclusions are visible to local users' is set to 'Enabled'
+	Yes	ADD	18.10.43.4 (L1) Ensure 'Enable EDR in block mode' is set to 'Enabled'
+	Yes	ADD	18.10.43.8 (L2) Ensure 'Convert warn verdict to block' is set to 'Enabled'
+	Yes	ADD	18.10.43.10 (L1) Ensure 'Configure real-time protection and Security Intelligence Updates during OOBE' is set to 'Enabled'
+	Yes	ADD	18.10.43.11.1.1 (L2) Ensure 'Configure Brute-Force Protection aggressiveness' is set to 'Enabled: Medium' or higher
+	Yes	ADD	18.10.43.11.1.1 (L1) Ensure 'Configure Remote Encryption Protection Mode' is set to 'Enabled: Audit' or higher
+	Yes	ADD	18.10.43.11.1.2 (L2) Ensure 'Configure how aggressively Remote Encryption Protection blocks threats' is set to 'Enabled: Medium' or higher
+	Yes	ADD	18.10.43.13 (L1) Ensure 'Scan excluded files and directories during quick scans' is set to 'Enabled: 1'
+	Yes	ADD	18.10.43.13 (L1) Ensure 'Trigger a quick scan after X days without any scans' is set to 'Enabled: 7'
+	Yes	ADD	18.10.57.3.3 (L2) Ensure 'Restrict clipboard transfer from server to client' is set to 'Enabled: Disable clipboard transfers from server to client'
+	NA	ADD	19.7.40 (L1) Ensure 'Turn off Windows Copilot' is set to 'Enabled'
+	NF	ADD	5 (L2) Ensure 'GameInput Service (GameInputSvc)' is set to 'Disabled'
+	Yes	ADD	18.6.8 (L1) Ensure 'Require Encryption' is set to 'Enabled'
+	Yes	ADD	18.10.91 (L2) Ensure 'Allow mapping folders into Windows Sandbox' is set to 'Disabled'
X	Yes	MOVE	18.4.1 (L1) Ensure 'Configure RPC packet level privacy setting for incoming connections' is set to 'Enabled' TO 18.7
X	Yes	REMOVE	18.10.42 Ensure 'Turn off Microsoft Defender AntiVirus' is set to 'Disabled'
X	Yes	REMOVE	18.10.15 (L1) Ensure 'Toggle user control over Insider builds' is set to 'Disabled'
X	Yes	REMOVE	18.10.66 (L1) Ensure 'Only display the private store within the Microsoft Store' is set to 'Enabled'
X	Yes	REMOVE	2.3.1 (L1) Ensure 'Accounts: Block Microsoft accounts' is set to 'Users can't add or log on with Microsoft accounts'
X	Yes	REMOVE	18.9.7.1 (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Prevent installation of devices that match any of these device IDs' is set to 'PCI\CC_0C0A'
X	Yes	REMOVE	18.9.7 (BL) Ensure 'Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed.' is set to 'True' (checked)
X	Yes	REMOVE	18.9.7 (BL) Ensure 'Prevent installation of devices that match any of these device IDs' is set to 'Enabled'
X	Yes	REMOVE	5 (L2) Ensure 'Peer Name Resolution Protocol (PNRPsvc)' is set to 'Disabled'
X	Yes	REMOVE	5 (L2) Ensure 'Peer Networking Grouping (p2psvc)' is set to 'Disabled'
X	Yes	REMOVE	5 (L2) Ensure 'Peer Networking Identity Manager (p2pimsvc)' is set to 'Disabled'
X	Yes	REMOVE	5 (L2) Ensure 'PNRP Machine Name Publication Service (PNRPAutoReg)' is set to 'Disabled'
X	Yes	REMOVE	18.6.4 (L1) Ensure ‘Configure DNS over HTTPS (DoH) name resolution' is set to 'Enabled: Allow DoH' or higher
X	Yes	RENAME	2.2 (L1) Configure 'Create symbolic links' TO (L1) Ensure 'Create symbolic links' is set to 'Administrators'23528
X	Yes	RENAME	2.2 (L2) Configure 'Log on as a service' TO (L2) Ensure 'Log on as a service' is configured
+	Yes	RENAME	18.10.82.1 (L1) Ensure 'Enable MPR notifications for the system' TO 'Configure the transmission of the user's password in the content of MPR notifications sent by winlogon.'
X	Yes	UPDATE	18.10.17 (L1 -> L2) Ensure 'Enable App Installer' is set to 'Disabled'
X	Yes	UPDATE	18.4 (L1) Ensure 'Enable Certificate Padding' TO Allow REG_DWORD or REG_SZ
X	NA	UPDATE	18.9.26 Ensure 'Configures LSASS to run as a protected process' is set to 'Enabled: Enabled with UEFI Lock'
?	Unknown	UPDATE	Section 17 Auditpol commands to use Policy GUIDs
?	Unknown	UPDATE	18.4 (L1) Ensure 'Enable Certificate Padding' is set to 'Enabled'
?	Unknown	UPDATE	Section changes from Windows 11 Release 23H2 v2.0 Administrative Templates
?	Unknown	UPDATE	Section changes from Windows 11 Release 24H2 Administrative Templates
?	Unknown	UPDATE	User Overview (Section 19)
?	Unknown	UPDATE	Profile Names
?	Unknown	UPDATE	General Overview and Intended Audience Section
?	Unknown	UPDATE	BitLocker Operating System Drive Section
?	Unknown	UPDATE	18.10.93.4 (L1) Ensure 'Enable optional updates' is set to 'Disabled'

sgress454

I know this is still in draft but to get ahead of it I tried using fleetctl apply and it complained that there were two CIS - Ensure 'Turn off Windows Copilot' is set to 'Enabled' policies. Once I removed one of them apply worked!

sgress454 · 2025-05-22T15:19:38Z

Outstanding -- I think it'd be worth briefly documenting (in this ticket or elsewhere) how you went about this work, so whoever gets the next ticket like this can benefit from your experience.

I pointed my Windows 11 VM at these. Of the 555 policies here, 75 of them returned errors. A brief sampling found that the failures were due to missing mdm_bridge or cis_audit tables. Can you confirm that this is expected on a non-MDM-enabled Windows machine?

sgress454

+1 pending reply to my comment above re: some policies returning errors

dantecatalfamo · 2025-05-22T18:38:03Z

@sgress454 I only tested the policies that I added as part of this ticket, if there are bugs with some of the older policies I'm not sure

dantecatalfamo · 2025-05-22T18:48:43Z

@sgress454 I also tested on Windows 11 Enterprise, which gave has different policy options from wind 11 home

dantecatalfamo · 2025-05-22T19:55:33Z

I just copy/pasted the list of changes from the changelog at the end of the 4.0 document into a table and went through them one by one, there was no greater process unfortunately

dantecatalfamo added 3 commits May 15, 2025 14:21

Removals/renaming

e6128f2

Add entry as part of an "update"

3d90f1b

New policies

feb43b8

dantecatalfamo temporarily deployed to Docker Hub May 15, 2025 20:47 — with GitHub Actions Inactive

dantecatalfamo changed the title ~~Removals/renaming~~ Windows 11 Enterprise CIS 4. May 15, 2025

dantecatalfamo changed the title ~~Windows 11 Enterprise CIS 4.~~ Windows 11 Enterprise CIS 4.0 May 15, 2025

Add new CIS policies

b17c8e4

dantecatalfamo temporarily deployed to Docker Hub May 16, 2025 18:21 — with GitHub Actions Inactive

Added policies

22eb4f0

dantecatalfamo temporarily deployed to Docker Hub May 16, 2025 19:26 — with GitHub Actions Inactive

More policies

e827b1d

dantecatalfamo temporarily deployed to Docker Hub May 16, 2025 20:27 — with GitHub Actions Inactive

More policies added

1fb01ea

dantecatalfamo had a problem deploying to Docker Hub May 16, 2025 20:50 — with GitHub Actions Error

dantecatalfamo temporarily deployed to Docker Hub May 16, 2025 20:50 — with GitHub Actions Inactive

More policies

5757001

dantecatalfamo temporarily deployed to Docker Hub May 16, 2025 20:58 — with GitHub Actions Inactive

Add final remaining policies

72c702f

dantecatalfamo temporarily deployed to Docker Hub May 20, 2025 17:49 — with GitHub Actions Inactive

Remove unnecessary escapes from new policy YAML strings

e2579f2

dantecatalfamo temporarily deployed to Docker Hub May 20, 2025 20:32 — with GitHub Actions Inactive

Remove duplicate policy

329f6ea

dantecatalfamo temporarily deployed to Docker Hub May 20, 2025 21:01 — with GitHub Actions Inactive

dantecatalfamo temporarily deployed to Docker Hub May 21, 2025 15:30 — with GitHub Actions Inactive

Fix typos in registry paths

1290362

dantecatalfamo temporarily deployed to Docker Hub May 21, 2025 17:50 — with GitHub Actions Inactive

Fix registry query path

986da84

dantecatalfamo temporarily deployed to Docker Hub May 21, 2025 18:32 — with GitHub Actions Inactive

Fix updated query

8f72c91

dantecatalfamo had a problem deploying to Docker Hub May 21, 2025 18:53 — with GitHub Actions Error

Fix update

334796b

dantecatalfamo temporarily deployed to Docker Hub May 21, 2025 18:54 — with GitHub Actions Inactive

Added changes/

9bc35f1

dantecatalfamo temporarily deployed to Docker Hub May 21, 2025 20:44 — with GitHub Actions Inactive

dantecatalfamo assigned sgress454 May 21, 2025

sgress454 reviewed May 22, 2025

View reviewed changes

Remove duplicate policy

2d9f12a

dantecatalfamo temporarily deployed to Docker Hub May 22, 2025 14:52 — with GitHub Actions Inactive

dantecatalfamo marked this pull request as ready for review May 22, 2025 14:52

fleet-release requested a review from sharon-fdm May 22, 2025 14:52

sgress454 approved these changes May 22, 2025

View reviewed changes

dantecatalfamo merged commit 0b6ee93 into main May 22, 2025
5 checks passed

dantecatalfamo deleted the 27396-win-11-cis-4 branch May 22, 2025 19:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows 11 Enterprise CIS 4.0#29191

Windows 11 Enterprise CIS 4.0#29191
dantecatalfamo merged 19 commits intomainfrom
27396-win-11-cis-4

dantecatalfamo commented May 15, 2025 •

edited

Loading

Uh oh!

sgress454 left a comment

Uh oh!

sgress454 commented May 22, 2025

Uh oh!

sgress454 left a comment

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dantecatalfamo commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Results

Uh oh!

sgress454 left a comment

Choose a reason for hiding this comment

Uh oh!

sgress454 commented May 22, 2025

Uh oh!

sgress454 left a comment

Choose a reason for hiding this comment

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

dantecatalfamo commented May 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dantecatalfamo commented May 15, 2025 •

edited

Loading