Hardening Windows Endpoint With Cis Benchmark

Hardening Windows Endpoint with CIS Benchmark

When to Use

Use this skill when:

• Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening
• Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles
• Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks
• Validating existing endpoint configurations against current CIS benchmark versions

Do not use this skill for Linux endpoints (use hardening-linux-endpoint-with-cis-benchmark) or for cloud-native workloads that require CIS cloud benchmarks.

Common Misconfigurations & Verification

• GPO linked but not applied: a linked CIS GPO means nothing until it reaches the host — confirm with gpresult /h report.html (or Get-GPResultantSetOfPolicy) that the baseline is under "Applied GPOs", not blocked by precedence, a WMI filter, or Block Inheritance on the OU.
• Audit settings ineffective without the override: CIS 17.x advanced audit subcategories are ignored unless "Force audit policy subcategory settings to override" (SCENoApplyLegacyAuditPolicy) is Enabled. Validate on the host with auditpol /get /category:*, not the GPMC.
• CIS-CAT score masks real gaps: a high Assessor-CLI score only covers Scored items and the profile you selected — running L1 hides missing L2 controls, and an outdated benchmark XML reports false passes. Match the benchmark version to the OS build.
• Drift after baseline: local admins, app installers, or feature updates re-open settings (SMBv1, RDP, a firewall profile set Off). Schedule recurring CIS-CAT scans and feed results to the SIEM for drift detection rather than trusting a one-time pass.
• Verify enforcement, not just policy: after applying, confirm a key control actually blocks — NTLMv2-only (2.3.11.7), Windows Firewall inbound Block per profile (9.x) — and run a 4688 / Atomic Red Team process-creation test to confirm Process Creation auditing (17.6.1) produces events that reach the SIEM.

Prerequisites

• Windows 10/11 Enterprise or Windows Server 2019/2022 target endpoints
• Active Directory Group Policy Management Console (GPMC) for enterprise deployment
• CIS-CAT Pro Assessor or CIS-CAT Lite for automated benchmark assessment
• Administrative access to target endpoints or domain controller
• Current CIS Benchmark PDF for the target Windows version (download from cisecurity.org)

Workflow

Step 1: Select CIS Benchmark Profile Level

CIS provides two profile levels for Windows endpoints:

Level 1 (L1) - Corporate/Enterprise Environment:

• Practical hardening settings that can be applied to most organizations
• Minimal impact on functionality and user experience
• Covers: password policy, audit policy, user rights, security options, Windows Firewall

Level 2 (L2) - High Security/Sensitive Data:

• Includes all L1 settings plus additional restrictions
• May impact usability (disabling autorun, restricting remote desktop, enhanced audit logging)
• Appropriate for systems handling PII, PHI, PCI data, or classified information

Select profile based on data classification and risk tolerance of the endpoint.

Step 2: Import CIS GPO Baselines

CIS provides pre-built GPO templates (Build Kits) for each benchmark version:

# Download CIS Build Kit from CIS WorkBench (requires CIS SecureSuite membership)
# Extract the GPO backup to a staging directory

# Import the CIS GPO into Active Directory
Import-GPO -BackupGpoName "CIS Microsoft Windows 11 Enterprise v3.0.0 L1" `
  -TargetName "CIS-Win11-L1-Baseline" `
  -Path "C:\CIS-GPO-Backups\Win11-Enterprise" `
  -CreateIfNeeded

# Link GPO to target OU
New-GPLink -Name "CIS-Win11-L1-Baseline" `
  -Target "OU=Workstations,DC=corp,DC=example,DC=com" `
  -LinkEnabled Yes

Step 3: Apply Key CIS Benchmark Categories

Account Policies (Section 1):

Password Policy:
  - Minimum password length: 14 characters (1.1.4)
  - Maximum password age: 365 days (1.1.3)
  - Password complexity: Enabled (1.1.5)
  - Store passwords using reversible encryption: Disabled (1.1.6)

Account Lockout Policy:
  - Account lockout threshold: 5 invalid logon attempts (1.2.1)
  - Account lockout duration: 15 minutes (1.2.2)
  - Reset account lockout counter after: 15 minutes (1.2.3)

Local Policies - Audit Policy (Section 17):

Audit Policy Configuration:
  - Audit Credential Validation: Success and Failure (17.1.1)
  - Audit Security Group Management: Success (17.2.5)
  - Audit Logon: Success and Failure (17.5.1)
  - Audit Process Creation: Success (17.6.1)
  - Audit Removable Storage: Success and Failure (17.6.4)

Security Options (Section 2.3):

  - Interactive logon: Do not display last user name: Enabled (2.3.7.1)
  - Interactive logon: Machine inactivity limit: 900 seconds (2.3.7.3)
  - Network access: Do not allow anonymous enumeration of SAM accounts: Enabled (2.3.10.2)
  - Network security: LAN Manager authentication level: Send NTLMv2 response only (2.3.11.7)
  - UAC: Run all administrators in Admin Approval Mode: Enabled (2.3.17.6)

Windows Firewall (Section 9):

  - Domain Profile: Firewall state: On (9.1.1)
  - Domain Profile: Inbound connections: Block (9.1.2)
  - Private Profile: Firewall state: On (9.2.1)
  - Public Profile: Firewall state: On (9.3.1)
  - Public Profile: Inbound connections: Block (9.3.2)

Step 4: Validate with CIS-CAT Assessment

# Run CIS-CAT Pro Assessor against target endpoint
# CIS-CAT produces an HTML/XML report with pass/fail per recommendation

.\Assessor-CLI.bat `
  -b "benchmarks\CIS_Microsoft_Windows_11_Enterprise_Benchmark_v3.0.0-xccdf.xml" `
  -p "Level 1 (L1) - Corporate/Enterprise Environment" `
  -rd "C:\CIS-Reports" `
  -nts

# Review report for failed controls
# Score target: 95%+ for L1, 90%+ for L2 (due to operational exceptions)

Step 5: Document Exceptions and Compensating Controls

For each CIS recommendation that cannot be applied:

1. Document the specific recommendation ID and title
2. State the business justification for the exception
3. Define the compensating control that addresses the residual risk
4. Set a review date (quarterly) to reassess the exception
5. Obtain sign-off from the information security officer

Example exception:

Recommendation: 2.3.7.3 - Interactive logon: Machine inactivity limit: 900 seconds
Exception: Kiosk systems in manufacturing floor require 1800 seconds
Compensating Control: Physical badge-access to manufacturing area, CCTV monitoring
Review Date: 2026-06-01
Approved By: CISO

Step 6: Continuous Compliance Monitoring

Configure recurring CIS-CAT scans via scheduled tasks or SCCM:

# Create scheduled task for weekly CIS-CAT assessment
$action = New-ScheduledTaskAction -Execute "C:\CIS-CAT\Assessor-CLI.bat" `
  -Argument "-b benchmarks\CIS_Win11_v3.0.0-xccdf.xml -p Level1 -rd C:\CIS-Reports -nts"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
Register-ScheduledTask -TaskName "CIS-Benchmark-Scan" -Action $action `
  -Trigger $trigger -Principal $principal

Feed results into SIEM for drift detection and dashboard reporting.

Key Concepts

Tools & Systems

• CIS-CAT Pro Assessor: Automated benchmark compliance scanner (requires CIS SecureSuite license)
• Microsoft Security Compliance Toolkit (SCT): Microsoft's own GPO baselines (complementary to CIS)
• Group Policy Management Console (GPMC): Enterprise GPO deployment and management
• LGPO.exe: Microsoft tool for applying GPOs to standalone (non-domain) systems
• Nessus/Tenable: Vulnerability scanner with CIS benchmark audit files

Common Pitfalls

• Applying L2 to all endpoints: Level 2 restrictions (disabling Autoplay, restricting Remote Desktop) break workflows on standard workstations. Reserve L2 for endpoints handling sensitive data.
• Not testing GPOs in pilot OU: Deploy CIS GPOs to a test OU with representative hardware/software before organization-wide rollout to avoid breaking line-of-business applications.
• Ignoring CIS benchmark version updates: CIS benchmarks update with each Windows feature release. Running an outdated benchmark misses new security settings and generates false compliance reports.
• Forgetting local admin accounts: CIS benchmarks assume domain-joined endpoints. Standalone systems require LGPO.exe or Microsoft Intune for baseline enforcement.
• No exception process: Applying 100% of CIS recommendations is rarely feasible. Without a formal exception process, teams either ignore hardening or break applications.