Hardening Windows Endpoint with CIS Benchmark

When to Use

Use this skill when:

• Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening
• Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles
• Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks
• Validating existing endpoint configurations against current CIS benchmark versions

Do not use this skill for Linux endpoints (use hardening-linux-endpoint-with-cis-benchmark) or for cloud-native workloads that require CIS cloud benchmarks.

Prerequisites

• Windows 10/11 Enterprise or Windows Server 2019/2022 target endpoints
• Active Directory Group Policy Management Console (GPMC) for enterprise deployment
• CIS-CAT Pro Assessor or CIS-CAT Lite for automated benchmark assessment
• Administrative access to target endpoints or domain controller
• Current CIS Benchmark PDF for the target Windows version (download from cisecurity.org)

Workflow

Step 1: Select CIS Benchmark Profile Level

CIS provides two profile levels for Windows endpoints:

Level 1 (L1) - Corporate/Enterprise Environment:

• Practical hardening settings that can be applied to most organizations
• Minimal impact on functionality and user experience
• Covers: password policy, audit policy, user rights, security options, Windows Firewall

Level 2 (L2) - High Security/Sensitive Data:

• Includes all L1 settings plus additional restrictions
• May impact usability (disabling autorun, restricting remote desktop, enhanced audit logging)
• Appropriate for systems handling PII, PHI, PCI data, or classified information

Select profile based on data classification and risk tolerance of the endpoint.

Step 2: Import CIS GPO Baselines

CIS provides pre-built GPO templates (Build Kits) for each benchmark version:

# Download CIS Build Kit from CIS WorkBench (requires CIS SecureSuite membership)
# Extract the GPO backup to a staging directory

# Import the CIS GPO into Active Directory
Import-GPO -BackupGpoName "CIS Microsoft Windows 11 Enterprise v3.0.0 L1" `
  -TargetName "CIS-Win11-L1-Baseline" `
  -Path "C:\CIS-GPO-Backups\Win11-Enterprise" `
  -CreateIfNeeded

# Link GPO to target OU
New-GPLink -Name "CIS-Win11-L1-Baseline" `
  -Target "OU=Workstations,DC=corp,DC=example,DC=com" `
  -LinkEnabled Yes

Step 3: Apply Key CIS Benchmark Categories

Account Policies (Section 1):

Password Policy:
  - Minimum password length: 14 characters (1.1.4)
  - Maximum password age: 365 days (1.1.3)
  - Password complexity: Enabled (1.1.5)
  - Store passwords using reversible encryption: Disabled (1.1.6)

Account Lockout Policy:
  - Account lockout threshold: 5 invalid logon attempts (1.2.1)
  - Account lockout duration: 15 minutes (1.2.2)
  - Reset account lockout counter after: 15 minutes (1.2.3)

Local Policies - Audit Policy (Section 17):

Audit Policy Configuration:
  - Audit Credential Validation: Success and Failure (17.1.1)
  - Audit Security Group Management: Success (17.2.5)
  - Audit Logon: Success and Failure (17.5.1)
  - Audit Process Creation: Success (17.6.1)
  - Audit Removable Storage: Success and Failure (17.6.4)

Security Options (Section 2.3):

  - Interactive logon: Do not display last user name: Enabled (2.3.7.1)
  - Interactive logon: Machine inactivity limit: 900 seconds (2.3.7.3)
  - Network access: Do not allow anonymous enumeration of SAM accounts: Enabled (2.3.10.2)
  - Network security: LAN Manager authentication level: Send NTLMv2 response only (2.3.11.7)
  - UAC: Run all administrators in Admin Approval Mode: Enabled (2.3.17.6)

Windows Firewall (Section 9):

  - Domain Profile: Firewall state: On (9.1.1)
  - Domain Profile: Inbound connections: Block (9.1.2)
  - Private Profile: Firewall state: On (9.2.1)
  - Public Profile: Firewall state: On (9.3.1)
  - Public Profile: Inbound connections: Block (9.3.2)

Step 4: Validate with CIS-CAT Assessment

# Run CIS-CAT Pro Assessor against target endpoint
# CIS-CAT produces an HTML/XML report with pass/fail per recommendation

.\Assessor-CLI.bat `
  -b "benchmarks\CIS_Microsoft_Windows_11_Enterprise_Benchmark_v3.0.0-xccdf.xml" `
  -p "Level 1 (L1) - Corporate/Enterprise Environment" `
  -rd "C:\CIS-Reports" `
  -nts

# Review report for failed controls
# Score target: 95%+ for L1, 90%+ for L2 (due to operational exceptions)

…