CIS Benchmark Hardening for Windows

CIS Benchmark Hardening for Windows

CIS Benchmarks are industry-recognized security baselines. Here’s how to apply them to Windows 10/11.

What is CIS?

Center for Internet Security (CIS) Benchmarks are:

• Vendor-agnostic
• Community-developed
• Prioritized controls
• Free to use

Getting the Benchmarks

1. Download from: https://www.cisecurity.org/cis-benchmarks/
2. Look for “CIS Microsoft Windows 10 Enterprise Benchmark”
3. Get the Excel or PDF version

Key Controls to Implement

Control 1: Account Policies

# Password Policy (via GPO or local)
# Computer Configuration → Windows Settings → Security Settings → Account Policies

# Recommended:
# - Minimum password length: 14
# - Password complexity: Enabled
# - Maximum password age: 60
# - Lockout threshold: 5

Control 2: Local Policies

# Audit Policy
# - Logon events: Success, Failure
# - Object access: Failure
# - Policy change: Success

# User Rights Assignment:
# - Deny log on through Remote Desktop Services: Guests
# - Allow log on locally: Users, Administrators

Control 3: Windows Firewall

# Enable Windows Firewall
# Domain/Private/Public: Enabled

# Default inbound: Block
# Default outbound: Allow

Control 4: Windows Defender

# Enable Defender settings:
# - Real-time protection: Enabled
# - Behavior monitoring: Enabled
# - Script scanning: Enabled
# - Cloud-delivered protection: Enabled

Control 5: Network Security

# Disable SMBv1
Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSMB1Protocol $false -Force

# Disable NetBIOS over TCP/IP
# In network adapter settings

Using CIS-CAT Pro

CIS provides a free scanner:

# Download CIS-CAT Pro
# Run assessment:
# .\CIS-CAT-Pro-Assessor-CLI.bat -assess -profile "CIS Windows 10 Enterprise Benchmark"

Intune Integration

# Import cis-cbl (CIS Configuration Baseline)
# Or use security baselines in Intune:
# Endpoint security → Security baselines → CIS Microsoft Windows

Quick Hardening Script

<#
.SYNOPSIS
    Quick CIS-style hardening
#>

# Start with a read-only inventory. Select controls from the exact CIS
# Benchmark version and Windows edition; validate them in a pilot ring.
Get-SmbServerConfiguration |
    Select-Object EnableSMB1Protocol, RequireSecuritySignature
Get-NetFirewallProfile |
    Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Get-MpComputerStatus |
    Select-Object RealTimeProtectionEnabled, AntivirusEnabled, BehaviorMonitorEnabled

Wrap-Up

CIS benchmarks give you a proven security baseline. Start with the basics and work through the controls methodically.

Do not apply a generic hardening script across all devices without testing. Benchmark version, Windows edition, server/client role, management policy, and documented exceptions matter. Preserve SMB signing requirements; Microsoft’s SMB signing guidance explains the protection and how to verify its state. Compare each control with the current CIS Benchmarks before deploying.

Questions? Drop them below!