Home
Security Hardening
CIS Microsoft Windows Server 2016 STIG NG DC V1.1.0

CIS Microsoft Windows Server 2016 STIG NG DC V1.1.0

Ensure ‘Turn On Virtualization Based Security: Credential Guard Configuration’ is set to ‘Disabled’ (DC Only) – Disabled
Details This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials. The recommended state for...
Ensure ‘Turn On Virtualization Based Security’ is set to ‘Enabled’
Details This policy setting specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide...
Ensure ‘Turn On Virtualization Based Security: Require UEFI Memory Attributes Table’ is set to ‘True (checked)’
Details This option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the...
Ensure ‘Turn On Virtualization Based Security: Secure Launch Configuration’ is set to ‘Enabled’
Details Secure Launch protects the Virtualization Based Security environment from exploited vulnerabilities in device firmware. The recommended state for this...
Ensure ‘Turn On Virtualization Based Security: Select Platform Security Level’ is set to ‘Secure Boot and DMA Protection’
Details This policy setting specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide...
Ensure ‘Turn On Virtualization Based Security: Virtualization Based Protection of Code Integrity’ is set to ‘Enabled with UEFI lock’
Details This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections...

CIS Microsoft Windows Server 2016 STIG NG DC V1.1.0

Ensure ‘Turn On Virtualization Based Security: Credential Guard Configuration’ is set to ‘Disabled’ (DC Only) – Disabled

Ensure ‘Turn On Virtualization Based Security’ is set to ‘Enabled’

Ensure ‘Turn On Virtualization Based Security: Require UEFI Memory Attributes Table’ is set to ‘True (checked)’

Ensure ‘Turn On Virtualization Based Security: Secure Launch Configuration’ is set to ‘Enabled’

Ensure ‘Turn On Virtualization Based Security: Select Platform Security Level’ is set to ‘Secure Boot and DMA Protection’

Ensure ‘Turn On Virtualization Based Security: Virtualization Based Protection of Code Integrity’ is set to ‘Enabled with UEFI lock’