Windows 11 System: 57 Checks

Checks whether the sudo.exe command line elevation tool is disabled.

This rule fails when sudoEnabled is not DISABLED.

Rationale: Disabling sudo removes a command line elevation path that could be abused for local privilege escalation.

Impact: Users cannot use the sudo command to run elevated commands from the command line.

Checks whether the command line used to start each new process is recorded in the process-creation (4688) audit events.

This rule fails when processCreationIncludeCmdLineEnabled is not true.

Rationale: Capturing the full command line lets investigators see exactly what was executed, which is essential for detecting and reconstructing malicious activity.

Impact: Command-line arguments, which may occasionally contain sensitive data such as passwords, are written to the security event log for every new process.

Checks the CredSSP encryption oracle remediation level that governs whether unpatched clients or servers may establish CredSSP (e.g. RDP) sessions.

This rule fails when allowEncryptionOracle is not FORCE.

Rationale: Forcing updated clients blocks connections to or from hosts missing the CVE-2018-0886 CredSSP fix, closing an encryption-oracle remote code execution vector.

Impact: CredSSP clients and services cannot fall back to the vulnerable protocol version, so all remote hosts must be patched through at least May 2018.

Checks whether Restricted Admin and Remote Credential Guard sessions may delegate only non-exportable credentials to the remote host.

This rule fails when allowProtectedCreds is not true.

Rationale: Delegating non-exportable credentials keeps reusable secrets off the remote host, reducing credential theft during Remote Desktop sessions.

Impact: Remote Desktop connections can use Restricted Admin or Remote Credential Guard mode.

Checks whether Windows Defender Credential Guard is enabled and locked into UEFI firmware.

This rule fails when lsaCfgFlags is not ENABLED_WITH_UEFI_LOCK.

Rationale: Credential Guard isolates LSA secrets inside VBS so credential-theft tools cannot read them; the UEFI lock stops an attacker from disabling it remotely.

Impact: Domain credentials are protected by VBS isolation, and Credential Guard cannot be turned off without physical access to clear the UEFI variable.

Checks whether the hardware-enforced kernel shadow stack is active and enforcing, blocking operations that violate call-stack integrity.

This rule fails when configureKernelShadowStacksLaunch is not ENABLED_ENFORCEMENT.

Rationale: Enforcement mode stops return-oriented programming (ROP) attacks against the kernel by rejecting corrupted return addresses rather than only logging them.

Impact: Requires compatible CPUs; incompatible kernel drivers may need updates before enforcement works cleanly.

Checks whether System Guard Secure Launch (Dynamic Root of Trust for Measurement) is enabled to establish a hardware-rooted, measured boot.

This rule fails when configureSystemGuardLaunch is not ENABLED.

Rationale: Secure Launch re-establishes trust in the boot environment using the CPU, protecting against firmware-level and early-boot tampering.

Impact: On supported hardware the system performs a measured Secure Launch during boot.

Checks whether Hypervisor-Protected Code Integrity (HVCI) is enabled and locked into UEFI firmware so it cannot be turned off remotely.

This rule fails when hypervisorEnforcedCodeIntegrity is not ENABLED_WITH_UEFI_LOCK.

Rationale: HVCI uses VBS to verify kernel-mode code integrity; the UEFI lock prevents an attacker from silently disabling it via policy.

Impact: Unsigned or improperly signed kernel drivers are blocked, and HVCI cannot be disabled without physical access to clear the UEFI variable.

Checks whether Virtualization Based Security (VBS), which uses the hypervisor to isolate critical OS components, is turned on.

This rule fails when enableVirtualizationBasedSecurity is not true.

Rationale: VBS is the foundation for Credential Guard, HVCI, and other protections that isolate secrets and kernel code from a compromised OS.

Impact: VBS is enabled on hardware that supports it; compatible virtualization and Secure Boot are required.

Checks that the VBS platform security level requires at least Secure Boot (optionally Secure Boot with DMA protection).

This rule fails when requirePlatformSecurityFeatures is neither SECURE_BOOT nor SECURE_BOOT_AND_DMA_PROTECTION.

Rationale: Requiring Secure Boot ensures VBS is anchored to a verified boot chain; adding DMA protection further blocks memory attacks from malicious peripherals.

Impact: VBS requires Secure Boot, and optionally hardware DMA protection, to be present.

Checks whether VBS requires firmware to provide a UEFI Memory Attributes Table (MAT).

This rule fails when hvcimatRequired is not true.

Rationale: Requiring the MAT ensures firmware memory is described correctly to the hypervisor, strengthening the memory-integrity guarantees VBS relies on.

Impact: VBS is only enabled on firmware that supplies a UEFI Memory Attributes Table.

Checks whether Windows is blocked from retrieving device metadata for installed devices from the internet.

This rule fails when preventDeviceMetadataFromNetwork is not true.

Rationale: Preventing automatic metadata downloads avoids unnecessary outbound connections and reduces data shared with external services.

Impact: Device metadata is not fetched from the internet; devices still function with locally available metadata.

Checks whether the device setup class installation restrictions also apply to matching devices that were installed before the policy took effect.

This rule fails when denyDeviceClassesRetroactive is not true.

Rationale: Applying the restriction retroactively removes access to already-installed devices in the blocked classes, closing a gap an attacker could otherwise use.

Impact: Matching devices already present on the system are also blocked, not just newly connected ones.

Checks that the four IEEE 1394 (FireWire) device setup class GUIDs are present in the list of device classes Windows is prevented from installing.

This rule fails when any of the four IEEE 1394 device setup class GUIDs is absent from denyDeviceClassesList.

Rationale: IEEE 1394 controllers can perform Direct Memory Access; blocking their drivers helps protect a BitLocker-protected host from DMA attacks that could recover encryption keys from memory.

Impact: IEEE 1394 (FireWire) drives and devices can no longer be installed on the host.

Checks whether Windows is prevented from installing drivers for the device setup classes listed in the deny list.

This rule fails when denyDeviceClasses is not true.

Rationale: Blocking driver installation for specified device classes reduces the attack surface from untrusted or DMA-capable hardware such as IEEE 1394 controllers.

Impact: Windows will not install or update drivers for devices whose setup class GUID is in the deny list.

Checks which boot-start drivers Early Launch Antimalware permits to initialize based on their classification.

This rule fails when driverLoadPolicy is not GOOD_PLUS_UNKNOWN_PLUS_BAD_CRITICAL.

Rationale: Allowing good, unknown, and only boot-critical bad drivers blocks known-malicious non-critical boot drivers while keeping the system bootable.

Impact: Non-critical drivers classified as bad by ELAM are prevented from loading at boot.

Checks whether the Common Log File System validates the authenticity of log files before processing them.

This rule fails when clfsAuthenticationChecking is not true.

Rationale: Authenticating CLFS logfiles blocks a class of parsing vulnerabilities in the CLFS driver that attackers have used for local privilege escalation.

Impact: CLFS rejects log files that fail authentication checks.

Checks whether the Connected Devices Platform, which lets Windows share activities across a user's devices, is turned off.

This rule fails when enableCdp is not false.

Rationale: Disabling cross-device continuation limits the sharing of user activity data between devices and cloud services.

Impact: Users can no longer resume activities from this device on another device.

Checks whether the 'Look for an app in the Store' option is disabled when a user opens a file with an unknown extension.

This rule fails when noUseStoreOpenWith is not true.

Rationale: Preventing Store lookups for unknown file types stops users from being steered to install arbitrary apps to open unrecognized files.

Impact: Users are not offered the Microsoft Store when opening files with unknown extensions.

Checks whether Windows is blocked from downloading print drivers over HTTP.

This rule fails when disableWebPnPDownload is not true.

Rationale: Blocking HTTP print-driver downloads prevents fetching and installing driver code from untrusted internet sources.

Impact: Print drivers must be obtained from local or managed sources rather than over HTTP.

Checks whether the automatic sharing of handwriting recognition personalization data with Microsoft is turned off.

This rule fails when preventHandwritingDataSharing is not true.

Rationale: Stopping this upload keeps potentially sensitive handwriting samples from leaving the host.

Impact: Handwriting personalization data is no longer collected and sent to Microsoft.

Checks whether handwriting recognition error reports are prevented from being sent to Microsoft.

This rule fails when preventHandwritingErrorReports is not true.

Rationale: Suppressing these reports avoids transmitting recognized text and ink samples that may contain sensitive information.

Impact: Handwriting recognition error reports are not generated or uploaded.

Checks whether the Internet Connection Wizard is blocked from contacting Microsoft.com to download a list of ISPs.

This rule fails when exitOnMSICW is not true.

Rationale: Blocking this connection reduces unnecessary outbound traffic to external Microsoft services during connection setup.

Impact: The Internet Connection Wizard no longer downloads referral content from Microsoft.com.

Checks whether Windows is prevented from downloading a provider list for web publishing and online ordering wizards.

This rule fails when noWebServices is not true.

Rationale: Preventing these downloads limits outbound connections to third-party web-service providers.

Impact: Users cannot use the internet-based provider lists in the publishing and ordering wizards.

Checks whether the client's ability to print to printers over HTTP is turned off.

This rule fails when disableHTTPPrinting is not true.

Rationale: Disabling HTTP printing stops the host from sending print jobs to internet-hosted printers over an unencrypted channel.

Impact: The client can no longer print to HTTP-based printers on the internet.

Checks whether the Windows Registration Wizard is blocked from connecting to Microsoft.com.

This rule fails when noRegistration is not true.

Rationale: Blocking online registration avoids sending user and system details to external Microsoft registration services.

Impact: Users cannot register the product online through the wizard.

Checks whether the Search Companion is prevented from automatically downloading content file updates.

This rule fails when disableContentFileUpdates is not true.

Rationale: Preventing automatic content downloads reduces unsolicited outbound connections to Microsoft services.

Impact: Search Companion does not download updated content files over the internet.

Checks whether the 'Order Prints Online' task, which uploads pictures to online print providers, is removed.

This rule fails when noOnlinePrintsWizard is not true.

Rationale: Removing the online prints task prevents users from uploading local images to third-party internet services.

Impact: The 'Order Prints Online' option no longer appears in picture folders and tasks.

Checks whether the 'Publish to Web' task for files and folders is removed from File Explorer.

This rule fails when noPublishingWizard is not true.

Rationale: Removing this task prevents users from uploading local files and folders to internet hosting services.

Impact: The 'Publish to Web' option is no longer available for files and folders.

Checks whether Windows is prevented from participating in the Customer Experience Improvement Program.

This rule fails when ceipEnable is not false.

Rationale: Opting out stops Windows usage and configuration data from being collected and sent to Microsoft.

Impact: Windows no longer collects or transmits Customer Experience Improvement data.

Checks whether Windows Messenger is prevented from participating in the Customer Experience Improvement Program.

This rule fails when ceip is not false.

Rationale: Opting out stops usage data from being collected and sent to Microsoft by Windows Messenger.

Impact: Windows Messenger no longer collects or transmits Customer Experience Improvement data.

Checks whether Windows Error Reporting is disabled so crash and error reports are not sent to Microsoft.

This rule fails when windowsErrorReportingDisabled is not true.

Rationale: Error reports can contain memory snapshots and other sensitive data; disabling reporting keeps that information on the host.

Impact: Application and system error data is no longer transmitted to Microsoft.

Checks whether the device attempts Kerberos PKINIT certificate authentication, falling back to password authentication when a supporting domain controller is unavailable.

This rule fails when devicePKInitEnabled is not true or devicePKInitBehavior is not AUTOMATIC.

Rationale: Certificate-based device authentication is stronger than username and password; the automatic mode uses it whenever possible without breaking connectivity.

Impact: None; this matches the default behavior when the supporting infrastructure is present.

Checks the enumeration policy for external DMA-capable devices that are not compatible with Kernel DMA Protection.

This rule fails when deviceEnumerationPolicy is not BLOCK_ALL.

Rationale: Blocking incompatible external DMA devices prevents malicious peripherals from reading system memory, which could expose credentials or encryption keys.

Impact: External Thunderbolt/PCIe devices lacking DMA-remapping support are not enumerated, even while a user is signed in.

Checks whether custom Security Support Providers and Authentication Packages are blocked from being loaded into the LSASS process.

This rule fails when allowCustomSSPsAPs is not false.

Rationale: Blocking custom SSPs/APs prevents attackers from injecting credential-harvesting modules into LSASS.

Impact: Third-party authentication modules that rely on loading into LSASS will not load.

Checks whether LSASS runs as a Protected Process Light with the configuration locked into UEFI firmware.

This rule fails when runAsPPL is not ENABLED_WITH_UEFI_LOCK.

Rationale: Running LSASS as a protected process blocks non-protected code (such as Mimikatz) from reading its memory; the UEFI lock prevents remote disabling.

Impact: Unsigned or non-protected plug-ins cannot load into LSASS, and the protection cannot be removed without physical access to clear the UEFI variable.

Checks whether user-configured input methods are prevented from being copied to the system account used at the sign-in screen.

This rule fails when blockUserInputMethodsForSignIn is not true.

Rationale: Blocking this copy keeps user-specific input method configurations from influencing the system account context at sign-in.

Impact: The system account uses only the system default input methods at the sign-in screen.

Checks whether application notifications are prevented from appearing on the lock screen.

This rule fails when disableLockScreenAppNotifications is not true.

Rationale: Suppressing lock-screen notifications keeps potentially sensitive content from being shown on an unattended device.

Impact: Apps can no longer display notifications on the lock screen.

Checks whether domain users are prevented from signing in with a convenience PIN.

This rule fails when allowDomainPINLogon is not false.

Rationale: A convenience PIN is drawn from a small character set and is generally weaker than a password, so disabling it preserves stronger authentication.

Impact: Domain users must sign in with their password rather than a convenience PIN.

Checks whether the network selection UI is hidden from users on the lock/logon screen.

This rule fails when dontDisplayNetworkSelectionUI is not true.

Rationale: Hiding network selection prevents an unauthenticated person from changing network connectivity from the lock screen.

Impact: Users cannot change the device's network connection from the sign-in screen.

Checks whether users are prevented from displaying account details, such as email address, on the sign-in screen.

This rule fails when blockUserFromShowingAccountDetailsOnSignin is not true.

Rationale: Hiding account details reduces the information an onlooker can gather from an unattended lock screen.

Impact: Account details are not shown on the sign-in screen.

Checks whether clipboard contents are prevented from being synchronized across a user's devices through the cloud.

This rule fails when allowCrossDeviceClipboard is not false.

Rationale: Disabling cross-device clipboard keeps potentially sensitive copied data from being uploaded to and shared through cloud services.

Impact: Clipboard contents are not shared between this device and the user's other devices.

Checks whether the Activity Feed is prevented from uploading published user activities to the cloud.

This rule fails when uploadUserActivities is not false.

Rationale: Blocking activity uploads limits the user-behavior data shared with Microsoft cloud services.

Impact: User activities are not uploaded, so cross-device timeline continuation is unavailable.

Checks whether the user is prompted for a password when the device wakes from sleep on battery.

This rule fails when requirePasswordOnWakeOnBattery is not true.

Rationale: Requiring a password on wake prevents someone with physical access from using an unattended device without authenticating.

Impact: Users must re-enter their password when the device wakes from sleep on battery.

Checks whether the user is prompted for a password when the device wakes from sleep while plugged in.

This rule fails when requirePasswordOnWakeWhenPluggedIn is not true.

Rationale: Requiring a password on wake prevents someone with physical access from using an unattended device without authenticating.

Impact: Users must re-enter their password when the device wakes from sleep while plugged in.

Checks whether network connectivity is prevented while the device is in connected standby running on battery.

This rule fails when allowNetworkConDuringStandbyOnBattery is not false.

Rationale: Disabling standby network connectivity reduces the window in which a sleeping, unattended device is reachable over the network.

Impact: The device does not maintain network connectivity during connected standby on battery.

Checks whether network connectivity is prevented while the device is in connected standby while plugged in.

This rule fails when allowNetworkConDuringStandbyPluggedIn is not false.

Rationale: Disabling standby network connectivity reduces the window in which a sleeping, unattended device is reachable over the network.

Impact: The device does not maintain network connectivity during connected standby when plugged in.

Checks whether S1-S3 standby sleep states are prevented while the device is on battery.

This rule fails when allowStandbyStatesWhenSleeping is not false.

Rationale: Blocking standby sleep states keeps encryption keys and other secrets out of easily attacked powered memory when the device is left unattended.

Impact: On battery the device uses hibernate or shutdown instead of S1-S3 standby.

Checks whether S1-S3 standby sleep states are prevented while the device is plugged in.

This rule fails when allowStandbyStatesWhenPluggedIn is not false.

Rationale: Blocking standby sleep states keeps encryption keys and other secrets out of easily attacked powered memory when the device is left unattended.

Impact: When plugged in the device uses hibernate or shutdown instead of S1-S3 standby.

Checks whether unsolicited (offered) Remote Assistance connections to this computer are prevented.

This rule fails when fAllowUnsolicited is not false.

Rationale: Disabling offered Remote Assistance stops helpers from initiating remote control sessions without an explicit user request, closing a remote-access avenue.

Impact: Support staff cannot offer Remote Assistance; users must solicit help through other means if solicited assistance is also disabled.

Checks whether users are prevented from requesting (soliciting) Remote Assistance from this computer.

This rule fails when fAllowToGetHelp is not false.

Rationale: Disabling solicited Remote Assistance removes a remote-control channel that an attacker could abuse to take over a session.

Impact: Users can no longer send Remote Assistance invitations from this computer.

Checks whether RPC clients authenticate to the Endpoint Mapper service when resolving RPC endpoints.

This rule fails when enableAuthEpResolution is not true.

Rationale: Requiring authentication to the Endpoint Mapper limits anonymous querying of RPC services available on the host.

Impact: RPC clients that cannot authenticate to the Endpoint Mapper may fail to resolve endpoints.

Checks whether the RPC runtime rejects unauthenticated remote RPC client connections.

This rule fails when restrictRemoteClients is not AUTHENTICATED.

Rationale: Restricting unauthenticated clients blocks anonymous access to RPC-exposed services, reducing the remote attack surface.

Impact: Remote RPC calls must be authenticated (except certain named-pipe calls), which may affect legacy applications that rely on anonymous RPC.

Checks whether the Microsoft Support Diagnostic Tool is prevented from communicating interactively with a remote support provider.

This rule fails when disableQueryRemoteServer is not false.

Rationale: Disabling MSDT interactive communication stops potentially sensitive diagnostic data from being collected and sent to a third-party support provider.

Impact: MSDT cannot run in support mode, so no diagnostic data is collected or sent to a support provider.

Checks whether the Windows Performance PerfTrack diagnostic scenario, which collects performance data, is disabled.

This rule fails when scenarioExecutionEnabled is not false.

Rationale: Disabling PerfTrack stops the collection and reporting of performance telemetry from the host.

Impact: Windows no longer collects PerfTrack performance data.

Checks whether the per-user advertising ID, which apps use to build cross-app usage profiles, is turned off.

This rule fails when disabledByGroupPolicy is not true.

Rationale: Disabling the advertising ID limits the tracking of user behavior across applications for targeted advertising.

Impact: Apps can no longer use the advertising ID to deliver personalized advertising.

Checks whether the Windows NTP client is enabled so the host synchronizes its clock with a time source.

This rule fails when ntpClientEnabled is not true.

Rationale: Accurate time is essential for Kerberos authentication, certificate validation, and reliable security log correlation across systems.

Impact: The host synchronizes its clock using the configured NTP time source.