{ "inf": "Skyfort_Fortress_Windows11.inf", "tier": "Fortress", "os": "Windows 11", "version": "2.0.0-20260925", "items": [ { "id": "C001", "title": "MinimumPasswordAge = 1", "section": "System Access", "entries": [ { "key": "MinimumPasswordAge", "expected": "1" } ] }, { "id": "C002", "title": "MaximumPasswordAge = 365", "section": "System Access", "entries": [ { "key": "MaximumPasswordAge", "expected": "365" } ] }, { "id": "C003", "title": "MinimumPasswordLength = 14", "section": "System Access", "entries": [ { "key": "MinimumPasswordLength", "expected": "14" } ] }, { "id": "C004", "title": "PasswordComplexity = 1", "section": "System Access", "entries": [ { "key": "PasswordComplexity", "expected": "1" } ] }, { "id": "C005", "title": "PasswordHistorySize = 24", "section": "System Access", "entries": [ { "key": "PasswordHistorySize", "expected": "24" } ] }, { "id": "C006", "title": "LockoutBadCount = 5", "section": "System Access", "entries": [ { "key": "LockoutBadCount", "expected": "5" } ] }, { "id": "C007", "title": "ResetLockoutCount = 15", "section": "System Access", "entries": [ { "key": "ResetLockoutCount", "expected": "15" } ] }, { "id": "C008", "title": "LockoutDuration = 15", "section": "System Access", "entries": [ { "key": "LockoutDuration", "expected": "15" } ] }, { "id": "C009", "title": "AllowAdministratorLockout = 1", "section": "System Access", "entries": [ { "key": "AllowAdministratorLockout", "expected": "1" } ] }, { "id": "C010", "title": "ForceLogoffWhenHourExpire = 1", "section": "System Access", "entries": [ { "key": "ForceLogoffWhenHourExpire", "expected": "1" } ] }, { "id": "C011", "title": "NewAdministratorName = \"CISADMIN\"", "section": "System Access", "entries": [ { "key": "NewAdministratorName", "expected": "\"CISADMIN\"" } ], "customizable": true }, { "id": "C012", "title": "NewGuestName = \"CISGUEST\"", "section": "System Access", "entries": [ { "key": "NewGuestName", "expected": "\"CISGUEST\"" } ], "customizable": true }, { "id": "C013", "title": "ClearTextPassword = 0", "section": "System Access", "entries": [ { "key": "ClearTextPassword", "expected": "0" } ] }, { "id": "C014", "title": "LSAAnonymousNameLookup = 0", "section": "System Access", "entries": [ { "key": "LSAAnonymousNameLookup", "expected": "0" } ] }, { "id": "C015", "title": "EnableGuestAccount = 0", "section": "System Access", "entries": [ { "key": "EnableGuestAccount", "expected": "0" } ] }, { "id": "C016", "title": "Version", "section": "Registry Values", "entries": [ { "key": "machine\\software\\pss\\version", "expected": "1,\"v1\"" } ] }, { "id": "C017", "title": "BASELINE", "section": "Registry Values", "entries": [ { "key": "machine\\software\\pss\\baseline", "expected": "1,\"Skyfort Padrao v2.0.0 - Windows 11 CIS L1\"" } ] }, { "id": "C018", "title": "AuditReceivingNTLMTraffic", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\msv1_0\\auditreceivingntlmtraffic", "expected": "4,2" } ] }, { "id": "C019", "title": "RestrictSendingNTLMTraffic", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\msv1_0\\restrictsendingntlmtraffic", "expected": "4,1" } ] }, { "id": "C020", "title": "RelaxMinimumPasswordLengthLimits", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\sam\\relaxminimumpasswordlengthlimits", "expected": "4,1" } ] }, { "id": "C021", "title": "SignSecureChannel", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\signsecurechannel", "expected": "4,1" } ] }, { "id": "C022", "title": "SealSecureChannel", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\sealsecurechannel", "expected": "4,1" } ] }, { "id": "C023", "title": "RequireStrongKey", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\requirestrongkey", "expected": "4,1" } ] }, { "id": "C024", "title": "RequireSignOrSeal", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\requiresignorseal", "expected": "4,1" } ] }, { "id": "C025", "title": "MaximumPasswordAge", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\maximumpasswordage", "expected": "4,30" } ] }, { "id": "C026", "title": "DisablePasswordChange", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netlogon\\parameters\\disablepasswordchange", "expected": "4,0" } ] }, { "id": "C027", "title": "LDAPClientIntegrity", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\ldap\\ldapclientintegrity", "expected": "4,1" } ] }, { "id": "C028", "title": "RequireSecuritySignature", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanworkstation\\parameters\\requiresecuritysignature", "expected": "4,1" } ] }, { "id": "C029", "title": "EnableSecuritySignature", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanworkstation\\parameters\\enablesecuritysignature", "expected": "4,1" } ] }, { "id": "C030", "title": "EnablePlainTextPassword", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanworkstation\\parameters\\enableplaintextpassword", "expected": "4,0" } ] }, { "id": "C031", "title": "SmbServerNameHardeningLevel", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\smbservernamehardeninglevel", "expected": "4,1" } ] }, { "id": "C032", "title": "RestrictNullSessAccess", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\restrictnullsessaccess", "expected": "4,1" } ] }, { "id": "C033", "title": "RequireSecuritySignature", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\requiresecuritysignature", "expected": "4,1" } ] }, { "id": "C034", "title": "NullSessionShares", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\nullsessionshares", "expected": "7," } ] }, { "id": "C035", "title": "NullSessionPipes", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\nullsessionpipes", "expected": "7," } ] }, { "id": "C036", "title": "EnableSecuritySignature", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\enablesecuritysignature", "expected": "4,1" } ] }, { "id": "C037", "title": "EnableForcedLogOff", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\enableforcedlogoff", "expected": "4,1" } ] }, { "id": "C038", "title": "AutoDisconnect", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\autodisconnect", "expected": "4,15" } ] }, { "id": "C039", "title": "ProtectionMode", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\session manager\\protectionmode", "expected": "4,1" } ] }, { "id": "C040", "title": "ObCaseInsensitive", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\session manager\\kernel\\obcaseinsensitive", "expected": "4,1" } ] }, { "id": "C041", "title": "Machine", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\securepipeservers\\winreg\\allowedpaths\\machine", "expected": "7,Software\\Microsoft\\Windows NT\\CurrentVersion\\Print,Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows,System\\CurrentControlSet\\Control\\Print\\Printers,System\\CurrentControlSet\\Services\\Eventlog,Software\\Microsoft\\OLAP Server,System\\CurrentControlSet\\Control\\ContentIndex,System\\CurrentControlSet\\Control\\Terminal Server,System\\CurrentControlSet\\Control\\Terminal Server\\UserConfig,System\\CurrentControlSet\\Control\\Terminal Server\\DefaultUserConfiguration,Software\\Microsoft\\Windows NT\\CurrentVersion\\Perflib,System\\CurrentControlSet\\Services\\SysmonLog" } ] }, { "id": "C042", "title": "Machine", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\securepipeservers\\winreg\\allowedexactpaths\\machine", "expected": "7,System\\CurrentControlSet\\Control\\ProductOptions,System\\CurrentControlSet\\Control\\Server Applications,Software\\Microsoft\\Windows NT\\CurrentVersion" } ] }, { "id": "C043", "title": "UseMachineId", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\usemachineid", "expected": "4,1" } ] }, { "id": "C044", "title": "SCENoApplyLegacyAuditPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\scenoapplylegacyauditpolicy", "expected": "4,1" } ] }, { "id": "C045", "title": "RestrictRemoteSAM", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\restrictremotesam", "expected": "1,\"O:BAG:BAD:(A;;RC;;;BA)\"" } ] }, { "id": "C046", "title": "RestrictAnonymousSAM", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\restrictanonymoussam", "expected": "4,1" } ] }, { "id": "C047", "title": "RestrictAnonymous", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\restrictanonymous", "expected": "4,1" } ] }, { "id": "C048", "title": "AllowOnlineID", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\pku2u\\allowonlineid", "expected": "4,0" } ] }, { "id": "C049", "title": "NoLMHash", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\nolmhash", "expected": "4,1" } ] }, { "id": "C050", "title": "NTLMMinServerSec", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\msv1_0\\ntlmminserversec", "expected": "4,537395200" } ] }, { "id": "C051", "title": "NTLMMinClientSec", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\msv1_0\\ntlmminclientsec", "expected": "4,537395200" } ] }, { "id": "C052", "title": "allownullsessionfallback", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\msv1_0\\allownullsessionfallback", "expected": "4,0" } ] }, { "id": "C053", "title": "LmCompatibilityLevel", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\lmcompatibilitylevel", "expected": "4,5" } ] }, { "id": "C054", "title": "LimitBlankPasswordUse", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\limitblankpassworduse", "expected": "4,1" } ] }, { "id": "C055", "title": "ForceGuest", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\forceguest", "expected": "4,0" } ] }, { "id": "C056", "title": "EveryoneIncludesAnonymous", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\everyoneincludesanonymous", "expected": "4,0" } ] }, { "id": "C057", "title": "DisableDomainCreds", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\disabledomaincreds", "expected": "4,1" } ] }, { "id": "C058", "title": "CrashOnAuditFail", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\crashonauditfail", "expected": "4,0" } ] }, { "id": "C059", "title": "PromptOnSecureDesktop", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\promptonsecuredesktop", "expected": "4,1" } ] }, { "id": "C060", "title": "LegalNoticeText", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\legalnoticetext", "expected": "7,Acesso restrito apenas para usuários autorizados. Todas as atividades nesta estação estão sendo monitoradas." } ], "customizable": true }, { "id": "C061", "title": "LegalNoticeCaption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\legalnoticecaption", "expected": "1,\"Notificação de Segurança\"" } ], "customizable": true }, { "id": "C062", "title": "SupportedEncryptionTypes", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\kerberos\\parameters\\supportedencryptiontypes", "expected": "4,2147483640" } ] }, { "id": "C063", "title": "InactivityTimeoutSecs", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\inactivitytimeoutsecs", "expected": "4,900" } ] }, { "id": "C064", "title": "FilterAdministratorToken", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\filteradministratortoken", "expected": "4,1" } ] }, { "id": "C065", "title": "EnableVirtualization", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\enablevirtualization", "expected": "4,1" } ] }, { "id": "C066", "title": "EnableSecureUIAPaths", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\enablesecureuiapaths", "expected": "4,1" } ] }, { "id": "C067", "title": "EnableLUA", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\enablelua", "expected": "4,1" } ] }, { "id": "C068", "title": "EnableInstallerDetection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\enableinstallerdetection", "expected": "4,1" } ] }, { "id": "C069", "title": "DontDisplayLastUserName", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\dontdisplaylastusername", "expected": "4,1" } ] }, { "id": "C070", "title": "DisableCAD", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\disablecad", "expected": "4,0" } ] }, { "id": "C071", "title": "ConsentPromptBehaviorUser", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\consentpromptbehavioruser", "expected": "4,0" } ] }, { "id": "C072", "title": "ConsentPromptBehaviorAdmin", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\consentpromptbehavioradmin", "expected": "4,2" } ] }, { "id": "C073", "title": "ScRemoveOption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows nt\\currentversion\\winlogon\\scremoveoption", "expected": "1,\"1\"" } ] }, { "id": "C074", "title": "PasswordExpiryWarning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows nt\\currentversion\\winlogon\\passwordexpirywarning", "expected": "4,14" } ] }, { "id": "C075", "title": "LDAPClientConfidentiality", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\ldap\\ldapclientconfidentiality", "expected": "4,1" } ] }, { "id": "C076", "title": "ADPasswordEncryptionEnabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\adpasswordencryptionenabled", "expected": "4,1" } ] }, { "id": "C077", "title": "AuditApplicationGuard", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\auditapplicationguard", "expected": "4,1" } ] }, { "id": "C078", "title": "AllowCameraMicrophoneRedirection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\allowcameramicrophoneredirection", "expected": "4,0" } ] }, { "id": "C079", "title": "AllowPersistence", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\allowpersistence", "expected": "4,0" } ] }, { "id": "C080", "title": "SaveFilesToHost", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\savefilestohost", "expected": "4,0" } ] }, { "id": "C081", "title": "AppHVSIClipboardSettings", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\apphvsiclipboardsettings", "expected": "4,1" } ] }, { "id": "C082", "title": "AppHVSIClipboardFileType", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\apphvsiclipboardfiletype", "expected": "4,1" } ] }, { "id": "C083", "title": "AllowAppHVSI_ProviderSet", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\apphvsi\\allowapphvsi_providerset", "expected": "4,1" } ] }, { "id": "C084", "title": "EnableExperimentalFeatures", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appinstaller\\enableexperimentalfeatures", "expected": "4,0" } ] }, { "id": "C085", "title": "EnableHashOverride", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appinstaller\\enablehashoverride", "expected": "4,0" } ] }, { "id": "C086", "title": "EnableMSAppInstallerProtocol", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appinstaller\\enablemsappinstallerprotocol", "expected": "4,0" } ] }, { "id": "C087", "title": "EnableBypassCertificatePinningForMicrosoftStore", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appinstaller\\enablebypasscertificatepinningformicrosoftstore", "expected": "4,0" } ] }, { "id": "C088", "title": "EnableLocalArchiveMalwareScanOverride", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appinstaller\\enablelocalarchivemalwarescanoverride", "expected": "4,0" } ] }, { "id": "C089", "title": "LetAppsActivateWithVoiceAboveLock", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appprivacy\\letappsactivatewithvoiceabovelock", "expected": "4,2" } ] }, { "id": "C090", "title": "BlockNonAdminUserInstall", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appx\\blocknonadminuserinstall", "expected": "4,1" } ] }, { "id": "C091", "title": "DisablePerUserUnsignedPackagesByDefault", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\appx\\disableperuserunsignedpackagesbydefault", "expected": "4,1" } ] }, { "id": "C092", "title": "ProcessCreationIncludeCmdLine_Enabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\audit\\processcreationincludecmdline_enabled", "expected": "4,1" } ] }, { "id": "C093", "title": "BackupDirectory", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\backupdirectory", "expected": "4,2" } ] }, { "id": "C094", "title": "EnhancedAntiSpoofing", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\biometrics\\facialfeatures\\enhancedantispoofing", "expected": "4,1" } ] }, { "id": "C095", "title": "EnableMailslots", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\bowser\\enablemailslots", "expected": "4,0" } ] }, { "id": "C096", "title": "DisableWindowsConsumerFeatures", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\cloudcontent\\disablewindowsconsumerfeatures", "expected": "4,1" } ] }, { "id": "C097", "title": "DisableConsumerAccountStateContent", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\cloudcontent\\disableconsumeraccountstatecontent", "expected": "4,1" } ] }, { "id": "C098", "title": "RequirePinForPairing", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\connect\\requirepinforpairing", "expected": "4,2" } ] }, { "id": "C099", "title": "AllowProtectedCreds", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\credentialsdelegation\\allowprotectedcreds", "expected": "4,1" } ] }, { "id": "C100", "title": "AllowEncryptionOracle", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\credssp\\parameters\\allowencryptionoracle", "expected": "4,0" } ] }, { "id": "C101", "title": "DisablePasswordReveal", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\credui\\disablepasswordreveal", "expected": "4,1" } ] }, { "id": "C102", "title": "EnableCertPaddingCheck", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\cryptography\\wintrust\\config\\enablecertpaddingcheck", "expected": "4,1" } ] }, { "id": "C103", "title": "AllowTelemetry", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\allowtelemetry", "expected": "4,1" } ] }, { "id": "C104", "title": "DoNotShowFeedbackNotifications", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\donotshowfeedbacknotifications", "expected": "4,1" } ] }, { "id": "C105", "title": "DisableOneSettingsDownloads", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\disableonesettingsdownloads", "expected": "4,1" } ] }, { "id": "C106", "title": "EnableOneSettingsAuditing", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\enableonesettingsauditing", "expected": "4,1" } ] }, { "id": "C107", "title": "LimitDiagnosticLogCollection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\limitdiagnosticlogcollection", "expected": "4,1" } ] }, { "id": "C108", "title": "LimitDumpCollection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\datacollection\\limitdumpcollection", "expected": "4,1" } ] }, { "id": "C109", "title": "DODownloadMode", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deliveryoptimization\\dodownloadmode", "expected": "4,1" } ] }, { "id": "C110", "title": "PreventDeviceMetadataFromNetwork", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\device metadata\\preventdevicemetadatafromnetwork", "expected": "4,1" } ] }, { "id": "C111", "title": "EnableVirtualizationBasedSecurity", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\enablevirtualizationbasedsecurity", "expected": "4,1" } ] }, { "id": "C112", "title": "RequirePlatformSecurityFeatures", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\requireplatformsecurityfeatures", "expected": "4,1" } ] }, { "id": "C113", "title": "HypervisorEnforcedCodeIntegrity", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\hypervisorenforcedcodeintegrity", "expected": "4,1" } ] }, { "id": "C114", "title": "HVCIMATRequired", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\hvcimatrequired", "expected": "4,1" } ] }, { "id": "C115", "title": "LsaCfgFlags", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\lsacfgflags", "expected": "4,1" } ] }, { "id": "C116", "title": "ConfigureSystemGuardLaunch", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\configuresystemguardlaunch", "expected": "4,1" } ] }, { "id": "C117", "title": "ConfigureKernelShadowStacksLaunch", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\deviceguard\\configurekernelshadowstackslaunch", "expected": "4,1" } ] }, { "id": "C118", "title": "DisableAutomaticRestartSignOn", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\disableautomaticrestartsignon", "expected": "4,1" } ] }, { "id": "C119", "title": "AllowNewsAndInterests", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\dsh\\allownewsandinterests", "expected": "4,0" } ] }, { "id": "C120", "title": "EnableMPR", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\enablempr", "expected": "4,0" } ] }, { "id": "C121", "title": "EnumerateAdministrators", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\credui\\enumerateadministrators", "expected": "4,0" } ] }, { "id": "C122", "title": "MaxSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\application\\maxsize", "expected": "4,32768" } ] }, { "id": "C123", "title": "Retention", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\application\\retention", "expected": "1,\"0\"" } ] }, { "id": "C124", "title": "MaxSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\security\\maxsize", "expected": "4,196608" } ] }, { "id": "C125", "title": "Retention", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\security\\retention", "expected": "1,\"0\"" } ] }, { "id": "C126", "title": "MaxSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\setup\\maxsize", "expected": "4,32768" } ] }, { "id": "C127", "title": "Retention", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\setup\\retention", "expected": "1,\"0\"" } ] }, { "id": "C128", "title": "Retention", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\system\\retention", "expected": "1,\"0\"" } ] }, { "id": "C129", "title": "MaxSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\eventlog\\system\\maxsize", "expected": "4,32768" } ] }, { "id": "C130", "title": "NoAutoplayfornonVolume", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\explorer\\noautoplayfornonvolume", "expected": "4,1" } ] }, { "id": "C131", "title": "NoDataExecutionPrevention", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\explorer\\nodataexecutionprevention", "expected": "4,0" } ] }, { "id": "C132", "title": "NoHeapTerminationOnCorruption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\explorer\\noheapterminationoncorruption", "expected": "4,0" } ] }, { "id": "C133", "title": "DisableGraphRecentItems", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\explorer\\disablegraphrecentitems", "expected": "4,1" } ] }, { "id": "C134", "title": "DisableMotWOnInsecurePathCopy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\explorer\\disablemotwoninsecurepathcopy", "expected": "4,0" } ] }, { "id": "C135", "title": "AllowGameDVR", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\gamedvr\\allowgamedvr", "expected": "4,0" } ] }, { "id": "C136", "title": "NoBackgroundPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\group policy\\{35378eac-683f-11d2-a89a-00c04fbbcfa2}\\nobackgroundpolicy", "expected": "4,0" } ] }, { "id": "C137", "title": "NoGPOListChanges", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\group policy\\{35378eac-683f-11d2-a89a-00c04fbbcfa2}\\nogpolistchanges", "expected": "4,0" } ] }, { "id": "C138", "title": "NoBackgroundPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\group policy\\{827d319e-6eac-11d2-a4ea-00c04f79f83a}\\nobackgroundpolicy", "expected": "4,0" } ] }, { "id": "C139", "title": "NoGPOListChanges", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\group policy\\{827d319e-6eac-11d2-a4ea-00c04f79f83a}\\nogpolistchanges", "expected": "4,0" } ] }, { "id": "C140", "title": "DisableHomeGroup", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\homegroup\\disablehomegroup", "expected": "4,1" } ] }, { "id": "C141", "title": "AllowInputPersonalization", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\inputpersonalization\\allowinputpersonalization", "expected": "4,0" } ] }, { "id": "C142", "title": "AlwaysInstallElevated", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\installer\\alwaysinstallelevated", "expected": "4,0" } ] }, { "id": "C143", "title": "EnableUserControl", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\installer\\enableusercontrol", "expected": "4,0" } ] }, { "id": "C144", "title": "DisableEnclosureDownload", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\internet explorer\\feeds\\disableenclosuredownload", "expected": "4,1" } ] }, { "id": "C145", "title": "AllowBasicAuthInClear", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\internet explorer\\feeds\\allowbasicauthinclear", "expected": "4,0" } ] }, { "id": "C146", "title": "InvalidAuthenticationDelayTimeInMs", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\invalidauthenticationdelaytimeinms", "expected": "4,2000" } ] }, { "id": "C147", "title": "MinSmb2Dialect", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\minsmb2dialect", "expected": "4,785" } ] }, { "id": "C148", "title": "EnableAuthRateLimiter", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\enableauthratelimiter", "expected": "4,1" } ] }, { "id": "C149", "title": "AuditInsecureGuestLogon", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\auditinsecureguestlogon", "expected": "4,1" } ] }, { "id": "C150", "title": "AuditClientDoesNotSupportSigning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\auditclientdoesnotsupportsigning", "expected": "4,1" } ] }, { "id": "C151", "title": "AuditClientDoesNotSupportEncryption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanserver\\auditclientdoesnotsupportencryption", "expected": "4,1" } ] }, { "id": "C152", "title": "AllowInsecureGuestAuth", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\allowinsecureguestauth", "expected": "4,0" } ] }, { "id": "C153", "title": "RequireEncryption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\requireencryption", "expected": "4,1" } ] }, { "id": "C154", "title": "MinSmb2Dialect", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\minsmb2dialect", "expected": "4,785" } ] }, { "id": "C155", "title": "AuditServerDoesNotSupportSigning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\auditserverdoesnotsupportsigning", "expected": "4,1" } ] }, { "id": "C156", "title": "AuditServerDoesNotSupportEncryption", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\auditserverdoesnotsupportencryption", "expected": "4,1" } ] }, { "id": "C157", "title": "AuditInsecureGuestLogon", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\lanmanworkstation\\auditinsecureguestlogon", "expected": "4,1" } ] }, { "id": "C158", "title": "LocalAccountTokenFilterPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\localaccounttokenfilterpolicy", "expected": "4,0" } ] }, { "id": "C159", "title": "DisableUserAuth", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\microsoftaccount\\disableuserauth", "expected": "4,1" } ] }, { "id": "C160", "title": "MSAOptional", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\msaoptional", "expected": "4,1" } ] }, { "id": "C161", "title": "BlockNetbiosDiscovery", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\netlogon\\parameters\\blocknetbiosdiscovery", "expected": "4,1" } ] }, { "id": "C162", "title": "NC_AllowNetBridge_NLA", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\network connections\\nc_allownetbridge_nla", "expected": "4,0" } ] }, { "id": "C163", "title": "NC_ShowSharedAccessUI", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\network connections\\nc_showsharedaccessui", "expected": "4,0" } ] }, { "id": "C164", "title": "NC_StdDomainUserSetLocation", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\network connections\\nc_stddomainusersetlocation", "expected": "4,1" } ] }, { "id": "C165", "title": "EnableMailslots", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\networkprovider\\enablemailslots", "expected": "4,0" } ] }, { "id": "C166", "title": "NoAutorun", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\noautorun", "expected": "4,1" } ] }, { "id": "C167", "title": "NoDriveTypeAutoRun", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\nodrivetypeautorun", "expected": "4,255" } ] }, { "id": "C168", "title": "NoWebServices", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\nowebservices", "expected": "4,1" } ] }, { "id": "C169", "title": "DisableFileSyncNGSC", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\onedrive\\disablefilesyncngsc", "expected": "4,0" } ] }, { "id": "C170", "title": "PasswordAgeDays", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\passwordagedays", "expected": "4,30" } ] }, { "id": "C171", "title": "PasswordComplexity", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\passwordcomplexity", "expected": "4,5" } ] }, { "id": "C172", "title": "PasswordExpirationProtectionEnabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\passwordexpirationprotectionenabled", "expected": "4,1" } ] }, { "id": "C173", "title": "PasswordLength", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\passwordlength", "expected": "4,15" } ] }, { "id": "C174", "title": "NoLockScreenCamera", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\personalization\\nolockscreencamera", "expected": "4,1" } ] }, { "id": "C175", "title": "NoLockScreenSlideshow", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\personalization\\nolockscreenslideshow", "expected": "4,1" } ] }, { "id": "C176", "title": "EnableESSwithSupportedPeripherals", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\policies\\passportforwork\\biometrics\\enableesswithsupportedperipherals", "expected": "4,1" } ] }, { "id": "C177", "title": "PostAuthenticationActions", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\postauthenticationactions", "expected": "4,3" } ] }, { "id": "C178", "title": "PostAuthenticationResetDelay", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\postauthenticationresetdelay", "expected": "4,8" } ] }, { "id": "C179", "title": "ACSettingIndex", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\power\\powersettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\acsettingindex", "expected": "4,1" } ] }, { "id": "C180", "title": "DCSettingIndex", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\power\\powersettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\dcsettingindex", "expected": "4,1" } ] }, { "id": "C181", "title": "ACSettingIndex", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\power\\powersettings\\f15576e8-98b7-4186-b944-eafa664402d9\\acsettingindex", "expected": "4,0" } ] }, { "id": "C182", "title": "DCSettingIndex", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\power\\powersettings\\f15576e8-98b7-4186-b944-eafa664402d9\\dcsettingindex", "expected": "4,0" } ] }, { "id": "C183", "title": "PreXPSP2ShellProtocolBehavior", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\prexpsp2shellprotocolbehavior", "expected": "4,0" } ] }, { "id": "C184", "title": "PwdExpirationProtectionEnabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\laps\\pwdexpirationprotectionenabled", "expected": "4,1" } ] }, { "id": "C185", "title": "SamrChangeUserPasswordApiPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows\\currentversion\\policies\\system\\sam\\samrchangeuserpasswordapipolicy", "expected": "4,1" } ] }, { "id": "C186", "title": "AllowClipboardRedirection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\sandbox\\allowclipboardredirection", "expected": "4,0" } ] }, { "id": "C187", "title": "AllowNetworking", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\sandbox\\allownetworking", "expected": "4,0" } ] }, { "id": "C188", "title": "Enabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\sudo\\enabled", "expected": "4,0" } ] }, { "id": "C189", "title": "EnableCdp", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\enablecdp", "expected": "4,0" } ] }, { "id": "C190", "title": "AllowDomainPINLogon", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\allowdomainpinlogon", "expected": "4,0" } ] }, { "id": "C191", "title": "BlockDomainPicturePassword", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\blockdomainpicturepassword", "expected": "4,1" } ] }, { "id": "C192", "title": "BlockUserFromShowingAccountDetailsOnSignin", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\blockuserfromshowingaccountdetailsonsignin", "expected": "4,1" } ] }, { "id": "C193", "title": "DisableLockScreenAppNotifications", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\disablelockscreenappnotifications", "expected": "4,1" } ] }, { "id": "C194", "title": "DontDisplayNetworkSelectionUI", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\dontdisplaynetworkselectionui", "expected": "4,1" } ] }, { "id": "C195", "title": "DontEnumerateConnectedUsers", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\dontenumerateconnectedusers", "expected": "4,1" } ] }, { "id": "C196", "title": "EnumerateLocalUsers", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\enumeratelocalusers", "expected": "4,0" } ] }, { "id": "C197", "title": "NoLocalPasswordResetQuestions", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\nolocalpasswordresetquestions", "expected": "4,1" } ] }, { "id": "C198", "title": "AllowCustomSSPsAPs", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\allowcustomsspsaps", "expected": "4,0" } ] }, { "id": "C199", "title": "EnableSmartScreen", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\enablesmartscreen", "expected": "4,1" } ] }, { "id": "C200", "title": "ShellSmartScreenLevel", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\shellsmartscreenlevel", "expected": "1,\"Block\"" } ] }, { "id": "C201", "title": "RunAsPPL", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\system\\runasppl", "expected": "4,1" } ] }, { "id": "C202", "title": "RunAsPPL", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\runasppl", "expected": "4,1" } ] }, { "id": "C203", "title": "RpcAuthnLevelPrivacyEnabled", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\print\\rpcauthnlevelprivacyenabled", "expected": "4,1" } ] }, { "id": "C204", "title": "UseLogonCredential", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\securityproviders\\wdigest\\uselogoncredential", "expected": "4,0" } ] }, { "id": "C205", "title": "SafeDllSearchMode", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\session manager\\safedllsearchmode", "expected": "4,1" } ] }, { "id": "C206", "title": "DisableExceptionChainValidation", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\session manager\\kernel\\disableexceptionchainvalidation", "expected": "4,0" } ] }, { "id": "C207", "title": "DriverLoadPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\policies\\earlylaunch\\driverloadpolicy", "expected": "4,3" } ] }, { "id": "C208", "title": "WarningLevel", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\eventlog\\security\\warninglevel", "expected": "4,90" } ] }, { "id": "C209", "title": "SMB1", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\lanmanserver\\parameters\\smb1", "expected": "4,0" } ] }, { "id": "C210", "title": "Start", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\mrxsmb10\\start", "expected": "4,4" } ] }, { "id": "C211", "title": "NodeType", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netbt\\parameters\\nodetype", "expected": "4,2" } ] }, { "id": "C212", "title": "NoNameReleaseOnDemand", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\netbt\\parameters\\nonamereleaseondemand", "expected": "4,1" } ] }, { "id": "C213", "title": "DisableIPSourceRouting", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\tcpip\\parameters\\disableipsourcerouting", "expected": "4,2" } ] }, { "id": "C214", "title": "EnableICMPRedirect", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\tcpip\\parameters\\enableicmpredirect", "expected": "4,0" } ] }, { "id": "C215", "title": "DisableIPSourceRouting", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\services\\tcpip6\\parameters\\disableipsourcerouting", "expected": "4,2" } ] }, { "id": "C216", "title": "Enabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\w32time\\timeproviders\\ntpclient\\enabled", "expected": "4,1" } ] }, { "id": "C217", "title": "Enabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\w32time\\timeproviders\\ntpserver\\enabled", "expected": "4,0" } ] }, { "id": "C218", "title": "AutoConnectAllowedOEM", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\wcmsvc\\wifinetworkmanager\\config\\autoconnectallowedoem", "expected": "4,0" } ] }, { "id": "C219", "title": "fBlockNonDomain", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wcmsvc\\grouppolicy\\fblocknondomain", "expected": "4,1" } ] }, { "id": "C220", "title": "fMinimizeConnections", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wcmsvc\\grouppolicy\\fminimizeconnections", "expected": "4,3" } ] }, { "id": "C221", "title": "PUAProtection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\puaprotection", "expected": "4,1" } ] }, { "id": "C222", "title": "HideExclusionsFromLocalUsers", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\hideexclusionsfromlocalusers", "expected": "4,1" } ] }, { "id": "C223", "title": "PassiveRemediation", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\features\\passiveremediation", "expected": "4,1" } ] }, { "id": "C224", "title": "EnableFileHashComputation", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\mpengine\\enablefilehashcomputation", "expected": "4,1" } ] }, { "id": "C225", "title": "DisableBehaviorMonitoring", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\real-time protection\\disablebehaviormonitoring", "expected": "4,0" } ] }, { "id": "C226", "title": "DisableRealtimeMonitoring", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\real-time protection\\disablerealtimemonitoring", "expected": "4,0" } ] }, { "id": "C227", "title": "DisableIOAVProtection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\real-time protection\\disableioavprotection", "expected": "4,0" } ] }, { "id": "C228", "title": "DisableScriptScanning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\real-time protection\\disablescriptscanning", "expected": "4,0" } ] }, { "id": "C229", "title": "OobeEnableRtpAndSigUpdate", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\real-time protection\\oobeenablertpandsigupdate", "expected": "4,1" } ] }, { "id": "C230", "title": "BruteForceProtectionConfiguredState", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\remediation\\behavioral network blocks\\brute force protection\\bruteforceprotectionconfiguredstate", "expected": "4,2" } ] }, { "id": "C231", "title": "DisableEmailScanning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\scan\\disableemailscanning", "expected": "4,0" } ] }, { "id": "C232", "title": "DisableRemovableDriveScanning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\scan\\disableremovabledrivescanning", "expected": "4,0" } ] }, { "id": "C233", "title": "DisablePackedExeScanning", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\scan\\disablepackedexescanning", "expected": "4,0" } ] }, { "id": "C234", "title": "DaysUntilAggressiveCatchupQuickScan", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\scan\\daysuntilaggressivecatchupquickscan", "expected": "4,7" } ] }, { "id": "C235", "title": "QuickScanIncludeExclusions", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\scan\\quickscanincludeexclusions", "expected": "4,1" } ] }, { "id": "C236", "title": "LocalSettingOverrideSpynetReporting", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\spynet\\localsettingoverridespynetreporting", "expected": "4,0" } ] }, { "id": "C237", "title": "ExploitGuard_ASR_Rules", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\exploitguard_asr_rules", "expected": "4,1" } ] }, { "id": "C238", "title": "26190899-1602-49e8-8b27-eb1d0a1ce869", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\26190899-1602-49e8-8b27-eb1d0a1ce869", "expected": "1,\"1\"" } ] }, { "id": "C239", "title": "3b576869-a4ec-4529-8536-b80a7769e899", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\3b576869-a4ec-4529-8536-b80a7769e899", "expected": "1,\"1\"" } ] }, { "id": "C240", "title": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", "expected": "1,\"1\"" } ] }, { "id": "C241", "title": "5beb7efe-fd9a-4556-801d-275e5ffc04cc", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\5beb7efe-fd9a-4556-801d-275e5ffc04cc", "expected": "1,\"1\"" } ] }, { "id": "C242", "title": "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", "expected": "1,\"1\"" } ] }, { "id": "C243", "title": "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b", "expected": "1,\"1\"" } ] }, { "id": "C244", "title": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", "expected": "1,\"1\"" } ] }, { "id": "C245", "title": "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4", "expected": "1,\"1\"" } ] }, { "id": "C246", "title": "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\be9ba2d9-53ea-4cdc-84e5-9b1eeee46550", "expected": "1,\"1\"" } ] }, { "id": "C247", "title": "d3e037e1-3eb8-44c8-a917-57927947596d", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\d3e037e1-3eb8-44c8-a917-57927947596d", "expected": "1,\"1\"" } ] }, { "id": "C248", "title": "d4f940ab-401b-4efc-aadc-ad5f3c50688a", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\d4f940ab-401b-4efc-aadc-ad5f3c50688a", "expected": "1,\"1\"" } ] }, { "id": "C249", "title": "e6db77e5-3df2-4cf1-b95a-636979351e5b", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\e6db77e5-3df2-4cf1-b95a-636979351e5b", "expected": "1,\"1\"" } ] }, { "id": "C250", "title": "56a863a9-875e-4185-98a7-b882c64b5ce5", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\asr\\rules\\56a863a9-875e-4185-98a7-b882c64b5ce5", "expected": "1,\"1\"" } ] }, { "id": "C251", "title": "EnableNetworkProtection", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender\\windows defender exploit guard\\network protection\\enablenetworkprotection", "expected": "4,1" } ] }, { "id": "C252", "title": "DisallowExploitProtectionOverride", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows defender security center\\app and browser protection\\disallowexploitprotectionoverride", "expected": "4,1" } ] }, { "id": "C253", "title": "AutoAdminLogon", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows nt\\currentversion\\winlogon\\autoadminlogon", "expected": "1,\"0\"" } ] }, { "id": "C254", "title": "ScreenSaverGracePeriod", "section": "Registry Values", "entries": [ { "key": "machine\\software\\microsoft\\windows nt\\currentversion\\winlogon\\screensavergraceperiod", "expected": "1,\"5\"" } ] }, { "id": "C255", "title": "EnableMulticast", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\dnsclient\\enablemulticast", "expected": "4,0" } ] }, { "id": "C256", "title": "EnableNetbios", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\dnsclient\\enablenetbios", "expected": "4,2" } ] }, { "id": "C257", "title": "EnableMDNS", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\dnsclient\\enablemdns", "expected": "4,0" } ] }, { "id": "C258", "title": "DisableWebPnPDownload", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\disablewebpnpdownload", "expected": "4,1" } ] }, { "id": "C259", "title": "RegisterSpoolerRemoteRpcEndPoint", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\registerspoolerremoterpcendpoint", "expected": "4,2" } ] }, { "id": "C260", "title": "RedirectionGuardPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\redirectionguardpolicy", "expected": "4,1" } ] }, { "id": "C261", "title": "CopyFilesPolicy", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\copyfilespolicy", "expected": "4,1" } ] }, { "id": "C262", "title": "RestrictDriverInstallationToAdministrators", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\restrictdriverinstallationtoadministrators", "expected": "4,1" } ] }, { "id": "C263", "title": "Restricted", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\restricted", "expected": "4,1" } ] }, { "id": "C264", "title": "TrustedServers", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\trustedservers", "expected": "4,0" } ] }, { "id": "C265", "title": "ServerList", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\serverlist", "expected": "1,\"\"" } ] }, { "id": "C266", "title": "InForest", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\inforest", "expected": "4,0" } ] }, { "id": "C267", "title": "NoWarningNoElevationOnInstall", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\nowarningnoelevationoninstall", "expected": "4,0" } ] }, { "id": "C268", "title": "UpdatePromptSettings", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\pointandprint\\updatepromptsettings", "expected": "4,0" } ] }, { "id": "C269", "title": "RpcUseNamedPipeProtocol", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\rpc\\rpcusenamedpipeprotocol", "expected": "4,0" } ] }, { "id": "C270", "title": "RpcAuthentication", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\rpc\\rpcauthentication", "expected": "4,0" } ] }, { "id": "C271", "title": "RpcProtocols", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\rpc\\rpcprotocols", "expected": "4,5" } ] }, { "id": "C272", "title": "ForceKerberosForRpc", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\rpc\\forcekerberosforrpc", "expected": "4,0" } ] }, { "id": "C273", "title": "RpcTcpPort", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\printers\\rpc\\rpctcpport", "expected": "4,0" } ] }, { "id": "C274", "title": "EnableAuthEpResolution", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\rpc\\enableauthepresolution", "expected": "4,1" } ] }, { "id": "C275", "title": "RestrictRemoteClients", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\rpc\\restrictremoteclients", "expected": "4,1" } ] }, { "id": "C276", "title": "fAllowToGetHelp", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\fallowtogethelp", "expected": "4,0" } ] }, { "id": "C277", "title": "fAllowUnsolicited", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\fallowunsolicited", "expected": "4,0" } ] }, { "id": "C278", "title": "DisablePasswordSaving", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\disablepasswordsaving", "expected": "4,1" } ] }, { "id": "C279", "title": "fDisableCdm", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\fdisablecdm", "expected": "4,1" } ] }, { "id": "C280", "title": "MinEncryptionLevel", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\minencryptionlevel", "expected": "4,3" } ] }, { "id": "C281", "title": "fPromptForPassword", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\fpromptforpassword", "expected": "4,1" } ] }, { "id": "C282", "title": "fEncryptRPCTraffic", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\fencryptrpctraffic", "expected": "4,1" } ] }, { "id": "C283", "title": "UserAuthentication", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\userauthentication", "expected": "4,1" } ] }, { "id": "C284", "title": "DeleteTempDirsOnExit", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\deletetempdirsonexit", "expected": "4,1" } ] }, { "id": "C285", "title": "SecurityLayer", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\securitylayer", "expected": "4,2" } ] }, { "id": "C286", "title": "DisableCloudClipboardIntegration", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows nt\\terminal services\\client\\disablecloudclipboardintegration", "expected": "4,1" } ] }, { "id": "C287", "title": "AllowCortana", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windows search\\allowcortana", "expected": "4,0" } ] }, { "id": "C288", "title": "AllowCortanaAboveLock", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windows search\\allowcortanaabovelock", "expected": "4,0" } ] }, { "id": "C289", "title": "AllowIndexingEncryptedStoresOrItems", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windows search\\allowindexingencryptedstoresoritems", "expected": "4,0" } ] }, { "id": "C290", "title": "AllowSearchToUseLocation", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windows search\\allowsearchtouselocation", "expected": "4,0" } ] }, { "id": "C291", "title": "EnableDynamicContentInWSB", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windows search\\enabledynamiccontentinwsb", "expected": "4,0" } ] }, { "id": "C292", "title": "PolicyVersion", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\policyversion", "expected": "4,541" } ] }, { "id": "C293", "title": "DefaultOutboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\defaultoutboundaction", "expected": "4,0" } ] }, { "id": "C294", "title": "DefaultInboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\defaultinboundaction", "expected": "4,1" } ] }, { "id": "C295", "title": "EnableFirewall", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\enablefirewall", "expected": "4,1" } ] }, { "id": "C296", "title": "DisableNotifications", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\disablenotifications", "expected": "4,1" } ] }, { "id": "C297", "title": "LogFilePath", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\logging\\logfilepath", "expected": "1,\"%systemroot%\\system32\\logfiles\\firewall\\domainfw.log\"" } ] }, { "id": "C298", "title": "LogFileSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\logging\\logfilesize", "expected": "4,16384" } ] }, { "id": "C299", "title": "LogDroppedPackets", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\logging\\logdroppedpackets", "expected": "4,1" } ] }, { "id": "C300", "title": "LogSuccessfulConnections", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\domainprofile\\logging\\logsuccessfulconnections", "expected": "4,1" } ] }, { "id": "C301", "title": "EnableFirewall", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\enablefirewall", "expected": "4,1" } ] }, { "id": "C302", "title": "DefaultOutboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\defaultoutboundaction", "expected": "4,0" } ] }, { "id": "C303", "title": "DefaultInboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\defaultinboundaction", "expected": "4,1" } ] }, { "id": "C304", "title": "DisableNotifications", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\disablenotifications", "expected": "4,1" } ] }, { "id": "C305", "title": "LogFilePath", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\logging\\logfilepath", "expected": "1,\"%systemroot%\\system32\\logfiles\\firewall\\privatefw.log\"" } ] }, { "id": "C306", "title": "LogFileSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\logging\\logfilesize", "expected": "4,16384" } ] }, { "id": "C307", "title": "LogDroppedPackets", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\logging\\logdroppedpackets", "expected": "4,1" } ] }, { "id": "C308", "title": "LogSuccessfulConnections", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\privateprofile\\logging\\logsuccessfulconnections", "expected": "4,1" } ] }, { "id": "C309", "title": "EnableFirewall", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\enablefirewall", "expected": "4,1" } ] }, { "id": "C310", "title": "DefaultOutboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\defaultoutboundaction", "expected": "4,0" } ] }, { "id": "C311", "title": "DefaultInboundAction", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\defaultinboundaction", "expected": "4,1" } ] }, { "id": "C312", "title": "DisableNotifications", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\disablenotifications", "expected": "4,1" } ] }, { "id": "C313", "title": "AllowLocalPolicyMerge", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\allowlocalpolicymerge", "expected": "4,0" } ] }, { "id": "C314", "title": "AllowLocalIPsecPolicyMerge", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\allowlocalipsecpolicymerge", "expected": "4,0" } ] }, { "id": "C315", "title": "LogFilePath", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\logging\\logfilepath", "expected": "1,\"%systemroot%\\system32\\logfiles\\firewall\\publicfw.log\"" } ] }, { "id": "C316", "title": "LogFileSize", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\logging\\logfilesize", "expected": "4,16384" } ] }, { "id": "C317", "title": "LogDroppedPackets", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\logging\\logdroppedpackets", "expected": "4,1" } ] }, { "id": "C318", "title": "LogSuccessfulConnections", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsfirewall\\publicprofile\\logging\\logsuccessfulconnections", "expected": "4,1" } ] }, { "id": "C319", "title": "AllowWindowsInkWorkspace", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsinkworkspace\\allowwindowsinkworkspace", "expected": "4,1" } ] }, { "id": "C320", "title": "AutoDownload", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsstore\\autodownload", "expected": "4,4" } ] }, { "id": "C321", "title": "DisableOSUpgrade", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windowsstore\\disableosupgrade", "expected": "4,1" } ] }, { "id": "C322", "title": "SetDisablePauseUXAccess", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\setdisablepauseuxaccess", "expected": "4,1" } ] }, { "id": "C323", "title": "DeferFeatureUpdates", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\deferfeatureupdates", "expected": "4,1" } ] }, { "id": "C324", "title": "DeferFeatureUpdatesPeriodInDays", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\deferfeatureupdatesperiodindays", "expected": "4,180" } ] }, { "id": "C325", "title": "PauseFeatureUpdatesStartTime", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\pausefeatureupdatesstarttime", "expected": "1,\"\"" } ] }, { "id": "C326", "title": "DeferQualityUpdates", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\deferqualityupdates", "expected": "4,1" } ] }, { "id": "C327", "title": "DeferQualityUpdatesPeriodInDays", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\deferqualityupdatesperiodindays", "expected": "4,0" } ] }, { "id": "C328", "title": "PauseQualityUpdatesStartTime", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\pausequalityupdatesstarttime", "expected": "1,\"\"" } ] }, { "id": "C329", "title": "ManagePreviewBuilds", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\managepreviewbuilds", "expected": "4,1" } ] }, { "id": "C330", "title": "ManagePreviewBuildsPolicyValue", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\managepreviewbuildspolicyvalue", "expected": "4,1" } ] }, { "id": "C331", "title": "AllowTemporaryEnterpriseFeatureControl", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\allowtemporaryenterprisefeaturecontrol", "expected": "4,0" } ] }, { "id": "C332", "title": "SetAllowOptionalContent", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\setallowoptionalcontent", "expected": "4,0" } ] }, { "id": "C333", "title": "NoAutoUpdate", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\noautoupdate", "expected": "4,0" } ] }, { "id": "C334", "title": "AUOptions", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\auoptions", "expected": "4,3" } ] }, { "id": "C335", "title": "ScheduledInstallDay", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\scheduledinstallday", "expected": "4,0" } ] }, { "id": "C336", "title": "ScheduledInstallTime", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\scheduledinstalltime", "expected": "4,1" } ] }, { "id": "C337", "title": "ScheduledInstallEveryWeek", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\scheduledinstalleveryweek", "expected": "4,1" } ] }, { "id": "C338", "title": "NoAutoRebootWithLoggedOnUsers", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\windowsupdate\\au\\noautorebootwithloggedonusers", "expected": "4,0" } ] }, { "id": "C339", "title": "AllowBasic", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\client\\allowbasic", "expected": "4,0" } ] }, { "id": "C340", "title": "AllowUnencryptedTraffic", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\client\\allowunencryptedtraffic", "expected": "4,0" } ] }, { "id": "C341", "title": "AllowDigest", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\client\\allowdigest", "expected": "4,0" } ] }, { "id": "C342", "title": "AllowBasic", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\service\\allowbasic", "expected": "4,0" } ] }, { "id": "C343", "title": "AllowUnencryptedTraffic", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\service\\allowunencryptedtraffic", "expected": "4,0" } ] }, { "id": "C344", "title": "DisableRunAs", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\winrm\\service\\disablerunas", "expected": "4,1" } ] }, { "id": "C345", "title": "EnableCertPaddingCheck", "section": "Registry Values", "entries": [ { "key": "machine\\software\\wow6432node\\microsoft\\cryptography\\wintrust\\config\\enablecertpaddingcheck", "expected": "4,1" } ] }, { "id": "C346", "title": "NotifyMalicious", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wtds\\components\\notifymalicious", "expected": "4,1" } ] }, { "id": "C347", "title": "NotifyPasswordReuse", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wtds\\components\\notifypasswordreuse", "expected": "4,1" } ] }, { "id": "C348", "title": "NotifyUnsafeApp", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wtds\\components\\notifyunsafeapp", "expected": "4,1" } ] }, { "id": "C349", "title": "ServiceEnabled", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wtds\\components\\serviceenabled", "expected": "4,1" } ] }, { "id": "C350", "title": "CaptureThreatWindow", "section": "Registry Values", "entries": [ { "key": "machine\\software\\policies\\microsoft\\windows\\wtds\\components\\capturethreatwindow", "expected": "4,1" } ] }, { "id": "C351", "title": "Audit {0cce923f-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce923f-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C352", "title": "Audit {0cce9239-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9239-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C353", "title": "Audit {0cce9237-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9237-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C354", "title": "Audit {0cce9235-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9235-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C355", "title": "Audit {0cce9248-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9248-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C356", "title": "Audit {0cce922b-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce922b-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C357", "title": "Audit {0cce9217-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9217-69ae-11d9-bed3-505054503030}", "expected": "4,2" } ] }, { "id": "C358", "title": "Audit {0cce9249-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9249-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C359", "title": "Audit {0cce9216-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9216-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C360", "title": "Audit {0cce9215-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9215-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C361", "title": "Audit {0cce921c-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce921c-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C362", "title": "Audit {0cce921b-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce921b-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C363", "title": "Audit {0cce9244-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9244-69ae-11d9-bed3-505054503030}", "expected": "4,2" } ] }, { "id": "C364", "title": "Audit {0cce9224-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9224-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C365", "title": "Audit {0cce9227-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9227-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C366", "title": "Audit {0cce9245-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9245-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C367", "title": "Audit {0cce922f-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce922f-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C368", "title": "Audit {0cce9230-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9230-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C369", "title": "Audit {0cce9231-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9231-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C370", "title": "Audit {0cce9232-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9232-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C371", "title": "Audit {0cce9234-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9234-69ae-11d9-bed3-505054503030}", "expected": "4,2" } ] }, { "id": "C372", "title": "Audit {0cce9228-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9228-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C373", "title": "Audit {0cce9213-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9213-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C374", "title": "Audit {0cce9214-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9214-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C375", "title": "Audit {0cce9210-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9210-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C376", "title": "Audit {0cce9211-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9211-69ae-11d9-bed3-505054503030}", "expected": "4,1" } ] }, { "id": "C377", "title": "Audit {0cce9212-69ae-11d9-bed3-505054503030}", "section": "Registry Values", "entries": [ { "key": "machine\\system\\currentcontrolset\\control\\lsa\\audit\\{0cce9212-69ae-11d9-bed3-505054503030}", "expected": "4,3" } ] }, { "id": "C378", "title": "SeRestorePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeRestorePrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C379", "title": "SeNetworkLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeNetworkLogonRight", "expected": "*S-1-5-32-555,*S-1-5-32-544" } ] }, { "id": "C380", "title": "SeIncreaseQuotaPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeIncreaseQuotaPrivilege", "expected": "*S-1-5-20,*S-1-5-19,*S-1-5-32-544" } ] }, { "id": "C381", "title": "SeInteractiveLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeInteractiveLogonRight", "expected": "*S-1-5-32-545,*S-1-5-32-544" } ] }, { "id": "C382", "title": "SeRemoteInteractiveLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeRemoteInteractiveLogonRight", "expected": "*S-1-5-32-555,*S-1-5-32-544" } ] }, { "id": "C383", "title": "SeBackupPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeBackupPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C384", "title": "SeSystemtimePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeSystemtimePrivilege", "expected": "*S-1-5-19,*S-1-5-32-544" } ] }, { "id": "C385", "title": "SeTimeZonePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeTimeZonePrivilege", "expected": "*S-1-5-32-545,*S-1-5-19,*S-1-5-32-544" } ] }, { "id": "C386", "title": "SeCreatePagefilePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeCreatePagefilePrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C387", "title": "SeCreateGlobalPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeCreateGlobalPrivilege", "expected": "*S-1-5-6,*S-1-5-20,*S-1-5-19,*S-1-5-32-544" } ] }, { "id": "C388", "title": "SeCreateSymbolicLinkPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeCreateSymbolicLinkPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C389", "title": "SeDebugPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeDebugPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C390", "title": "SeDenyNetworkLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeDenyNetworkLogonRight", "expected": "*S-1-5-113,*S-1-5-32-546" } ] }, { "id": "C391", "title": "SeDenyBatchLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeDenyBatchLogonRight", "expected": "*S-1-5-32-546" } ] }, { "id": "C392", "title": "SeDenyServiceLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeDenyServiceLogonRight", "expected": "*S-1-5-32-546" } ] }, { "id": "C393", "title": "SeDenyInteractiveLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeDenyInteractiveLogonRight", "expected": "*S-1-5-32-546" } ] }, { "id": "C394", "title": "SeDenyRemoteInteractiveLogonRight", "section": "Privilege Rights", "entries": [ { "key": "SeDenyRemoteInteractiveLogonRight", "expected": "*S-1-5-113,*S-1-5-32-546" } ] }, { "id": "C395", "title": "SeRemoteShutdownPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeRemoteShutdownPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C396", "title": "SeAuditPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeAuditPrivilege", "expected": "*S-1-5-20,*S-1-5-19" } ] }, { "id": "C397", "title": "SeImpersonatePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeImpersonatePrivilege", "expected": "*S-1-5-6,*S-1-5-20,*S-1-5-19,*S-1-5-32-544" } ] }, { "id": "C398", "title": "SeIncreaseBasePriorityPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeIncreaseBasePriorityPrivilege", "expected": "*S-1-5-90-0,*S-1-5-32-544" } ] }, { "id": "C399", "title": "SeLoadDriverPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeLoadDriverPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C400", "title": "SeSecurityPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeSecurityPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C401", "title": "SeSystemEnvironmentPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeSystemEnvironmentPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C402", "title": "SeManageVolumePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeManageVolumePrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C403", "title": "SeProfileSingleProcessPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeProfileSingleProcessPrivilege", "expected": "*S-1-5-32-544" } ] }, { "id": "C404", "title": "SeSystemProfilePrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeSystemProfilePrivilege", "expected": "*S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" } ] }, { "id": "C405", "title": "SeAssignPrimaryTokenPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeAssignPrimaryTokenPrivilege", "expected": "*S-1-5-19,*S-1-5-20" } ] }, { "id": "C406", "title": "SeShutdownPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeShutdownPrivilege", "expected": "*S-1-5-32-544,*S-1-5-32-545" } ] }, { "id": "C407", "title": "SeTakeOwnershipPrivilege", "section": "Privilege Rights", "entries": [ { "key": "SeTakeOwnershipPrivilege", "expected": "*S-1-5-32-544" } ] } ] }