Windows 11 MSS (Legacy): 12 Checks

Checks whether automatic logon at startup is disabled.

This rule fails when autoAdminLogon is not false.

Rationale: Automatic logon lets anyone with physical access reach everything on the host and connected networks, and it stores the password in the registry in plaintext where it is remotely readable by Authenticated Users.

Impact: None; this is the default behavior.

Checks whether the host ignores NetBIOS name-release requests except those from WINS servers.

This rule fails when noNameReleaseOnDemand is not true.

Rationale: The unauthenticated NetBT protocol is easily spoofed; an attacker can send a name-conflict datagram to make a host relinquish its name, causing connectivity or logon failures.

Impact: None; this is the default behavior.

Checks whether ICMP redirects are prevented from overriding OSPF-generated routes.

This rule fails when enableICMPRedirect is not false.

Rationale: ICMP-redirect-plumbed host routes temporarily override proper routing; ignoring such redirects limits exposure to attacks that disrupt the host's network participation.

Impact: Windows will not plumb host routes from received ICMP redirects.

Checks whether IPv4 source routing is completely disabled so all incoming source-routed packets are dropped.

This rule fails when disableIpSourceRouting is not ENABLED_HIGHEST_SOURCE_ROUTING_COMPLETELY_DISABLED.

Rationale: Source routing lets a sender dictate a packet's path, which an attacker can use to obscure their identity and location; completely disabling it drops such packets.

Impact: All incoming source-routed packets are dropped.

Checks whether IPv4 TCP aborts a connection after three retransmissions of an unacknowledged data segment.

This rule fails when tcpMaxDataRetransmissionsIpv4 is not 3.

Rationale: Limiting retransmissions reduces the resources an attacker can tie up by never acknowledging data the host has sent.

Impact: An unacknowledged segment is retransmitted at most three times before the connection is aborted.

Checks whether IPv6 source routing is completely disabled so all incoming source-routed packets are dropped.

This rule fails when disableAutoSourceRouting is not ENABLED_HIGHEST_SOURCE_ROUTING_COMPLETELY_DISABLED.

Rationale: Source routing lets a sender dictate a packet's path, which an attacker can use to obscure their identity and location; completely disabling it drops such packets.

Impact: All incoming source-routed packets are dropped.

Checks whether IPv6 TCP aborts a connection after three retransmissions of an unacknowledged data segment.

This rule fails when tcpMaxDataRetransmissionsIpv6 is not 3.

Rationale: Limiting retransmissions reduces the resources an attacker can tie up by never acknowledging data the host has sent.

Impact: An unacknowledged segment is retransmitted at most three times before the connection is aborted.

Checks whether the Internet Router Discovery Protocol (IRDP) is disabled.

This rule fails when performRouterDiscovery is not false.

Rationale: An attacker on the same segment could impersonate a router via IRDP so that other hosts route traffic through the compromised machine.

Impact: Windows will not automatically detect and configure default gateway addresses.

Checks whether the DLL search order searches system paths before the current working directory.

This rule fails when safeDllSearchMode is not true.

Rationale: If the current directory is searched first, hostile code packaged with modified system DLLs can be loaded in place of the genuine libraries.

Impact: None; this is the default behavior.

Checks whether caching of dial-up and VPN connection passwords is prevented.

This rule fails when disableSavePassword is not true.

Rationale: A stolen device with a saved dial-up or VPN password could automatically connect to the organization's network.

Impact: Users cannot automatically store logon credentials for dial-up and VPN connections.

Checks whether a warning audit is generated when the Security event log reaches a threshold of 90 percent or less of its capacity.

This rule fails when eventLogWarningLevel is 0 (the non-compliant default, no warning) or greater than 90.

Rationale: Without a warning threshold, a full Security log can silently stop recording recent events, letting an attacker's activity go unlogged.

Impact: An audit event is generated when the Security log reaches the configured percentage full.

Checks whether TCP verifies idle connections every 300,000 milliseconds (5 minutes) instead of the two-hour default.

This rule fails when keepAliveTime is not 300000000000 ns (300,000 ms / 5 minutes).

Rationale: A shorter keep-alive interval disconnects idle sessions more quickly, reducing the window in which an attacker could hold many connections open to cause a denial of service.

Impact: Applications that request TCP keep-alives will have idle sessions verified every five minutes.