The "Security Zones: Use Only Machine Settings" setting should be configured correctly. CCE-4017-0 CCE-3413-2 CCE-3971-9 Internet Explorer Processes (Restrict ActiveX Install) CCE-3924-8 The "Security Zones: Do Not Allow Users to Add/Delete Sites" setting should be configured correctly. CCE-3929-7 CCE-3039-5 CCE-4117-8 The "Disable Periodic Check For Internet Explorer Software Updates" setting should be configured correctly. CCE-3576-6 CCE-3810-9 CCE-3874-5 Internet Explorer Processes (Zone Elevation Protection) CCE-4043-6 CCE-4992-4 The "Internet Explorer Processes (Consistent MIME Handling)" setting should be configured correctly. CCE-4047-7 The "Allow Software to Run or Install Even if the Signature is Invalid" setting should be configured correctly. CCE-3941-2 The "Internet Explorer Processes (MK Protocol)" setting should be configured correctly. CCE-3338-1 The "Disable Software Update Shell Notifications on Program Launch" setting should be configured correctly. CCE-4118-6 CCE-3832-3 CCE-3517-0 The "Internet Explorer Processes (Restrict File Download)" setting should be configured correctly. CCE-4122-8 The "Disable Automatic Install of Internet Explorer Components" setting should be configured correctly. CCE-3518-8 CCE-3598-0 CCE-3962-8 The "Make Proxy Settings Per-Machine (Rather Then Per-User)" setting should be configured correctly. CCE-3201-1 CCE-3713-5 CCE-4125-1 The "Do Not Allow Users to enable or Disable Add-Ons" setting should be configured correctly. CCE-3744-0 The "Turn Off Crash Detection" setting should be configured correctly. CCE-3894-3 The "Internet Explorer Processes (Scripted Window Security Restrictions)" setting should be configured correctly. CCE-4162-4 The "Security Zones: Do Not Allow Users to Change Policies" setting should be configured correctly. CCE-3933-9 CCE-3480-1 CCE-4019-6 The "Internet Explorer Processes (MIME Sniffing)" setting should be configured correctly. CCE-4149-1 The "Check for Signature on Downloaded Programs" setting should be configured correctly. CCE-4026-1 The "Do Not Allow Resetting Internet Explorer Settings" setting should be configured correctly. CCE-4171-5 The "Allow cut, copy, or paste operations from the clipboard via script" setting should be configured correctly for the Internet Zone. CCE-4109-5 The "Turn Off First- Run Opt-In" setting should be configured correctly for the Internet Zone. CCE-3378-7 The "Web Browser Applications" setting should be configured correctly for the Internet Zone. CCE-4131-9 The "Allow cut, copy, or paste operations from the clipboard via script" setting should be configured correctly for the Restricted Sites Zone. CCE-4013-9 The "Turn Off First- Run Opt-In" setting should be configured correctly for the Restricted Sites Zone. CCE-4153-3 The "Web Browser Applications" setting should be configured correctly for the Restricted Sites Zone. CCE-4052-7 The "Intranet Sites: Include all network paths (UNCs)" setting should be configured correctly. CCE-4175-6 The "Disable the Advanced Page" setting should be configured correctly. CCE-3695-4 The "Disable the Privacy Page" setting should be configured correctly. CCE-3777-0 The "Disable the Security Page" setting should be configured correctly. CCE-3433-0 The "Prevent Ignoing Certificate Errors" setting should be configured correctly. CCE-4199-6 The "Turn Off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools" setting should be configured correctly. CCE-3204-5 The "Turn Off Configuring the Update Check Interval (In Days)" setting should be configured correctly. CCE-4098-0 The "Add-on List" setting should be configured correctly. CCE-3741-6 The "Deny all add-ons unless specifically allowed in the Add-on List" setting should be configured correctly. CCE-3997-4 The "Disable "Configuring History"" setting should be configured correctly. CCE-4001-4 The "Disable Changing Automatic Configuration Settings" setting should be configured correctly. CCE-4147-5 The "Disable Changing Connection Settings" setting should be configured correctly. CCE-4059-2 The "Disable Changing Proxy Settings" setting should be configured correctly. CCE-3935-4 The "Disable Showing the Splash Screen" setting should be configured correctly. CCE-3706-9 The "Prevent "Fix settings" Functionality" setting should be configured correctly. CCE-3975-0 The "Prevent participation in the Customer Experience Improvement Programs" setting should be configured correctly. CCE-3993-3 The "Prevent performance of First Run Customize settings" setting should be configured correctly. CCE-3207-8 The "Prevent the deletation of temporary internet files and cookies" setting should be configured correctly. CCE-4073-3 The "Turn off "Delete Browsing History" functionality" setting should be configured correctly. CCE-3615-2 The "Turn off Managing Phishing Filter" setting should be configured correctly. CCE-3866-1 The "Turn off the Security Settings Check feature" setting should be configured correctly. CCE-3875-2 The "Allow Active Content from CD's to Run on User Machine" setting should be configured correctly. CCE-4174-9 The "Enable third-party browser extensions" setting should be configured correctly. CCE-4192-1 The "Automatically Check for Internet Explorer Updates" setting should be configured correctly. CCE-3584-0 The "Check for Server Certificate Revocation" setting should be configured correctly. CCE-3976-8 The "Access data sources across domains" setting should be configured correctly for the Internet Zone. CCE-3853-9 The "Drag and drop or copy and paste files" setting should be configured correctly for the Internet Zone. CCE-3998-2 The "Font download" setting should be configured correctly for the Internet Zone. CCE-3888-5 The "Installation of desktop items" setting should be configured correctly for the Internet Zone. CCE-3906-5 The "Allow script-initiated windows without size or position constraints" setting should be configured correctly for the Internet Zone. CCE-4099-8 The "Allow Scriptlets" setting should be configured correctly for the Internet Zone. CCE-3601-2 The "Allow status bar updates via script" setting should be configured correctly for the Internet Zone. CCE-3249-0 The "Automatic prompting for file downloads" setting should be configured correctly for the Internet Zone. CCE-4139-2 The "Download signed ActiveX controls" setting should be configured correctly for the Internet Zone. CCE-3927-1 The "Download unsigned ActiveX controls" setting should be configured correctly for the Internet Zone. CCE-3945-3 The "Initialize and script ActiveX controls not marked as safe for scripting" setting should be configured correctly for the Internet Zone. CCE-4068-3 The "Java permissions" setting should be configured correctly for the Internet Zone. CCE-3963-6 The "Launching programs and files in an IFRAME" setting should be configured correctly for the Internet Zone. CCE-4104-6 The "Logon" setting should be configured correctly for the Internet Zone. CCE-3623-6 The "Loose XAML" setting should be configured correctly for the Internet Zone. CCE-3751-5 The "Navigate sub-frames across different domains" setting should be configured correctly for the Internet Zone. CCE-4143-4 The "Open files based on content, not file extension" setting should be configured correctly for the Internet Zone. CCE-4161-6 The "Software channel permissions" setting should be configured correctly for the Internet Zone. CCE-3553-5 The "Use Pop-up Blocker" setting should be configured correctly for the Internet Zone. CCE-3619-4 The "Userdata persistence" setting should be configured correctly for the Internet Zone. CCE-3914-9 The "Web sites in less privileged Web content zones can navigate into this zone" setting should be configured correctly for the Internet Zone. CCE-3570-9 The "XPS documents" setting should be configured correctly for the Internet Zone. CCE-3843-0 The "Display mixed content" setting should be configured correctly for the Internet Zone. CCE-3984-2 The "Display mixed content" setting should be configured correctly for the Intranet Zone. CCE-3989-1 The "Display mixed content" setting should be configured correctly for the Locked Down Intranet Zone. CCE-4121-0 The "Display mixed content" setting should be configured correctly for the Local Machine Zone. CCE-4138-4 The "Display mixed content" setting should be configured correctly for the Locked Down Local Machine Zone. CCE-4028-7 The "Access data sources across domains" setting should be configured correctly for the Restricted Sites Zone. CCE-3905-7 The "Active scripting" setting should be configured correctly for the Restricted Sites Zone. CCE-4050-1 The "Binary and script behaviors" setting should be configured correctly for the Restricted Sites Zone. CCE-4196-2 The "Drag and drop or copy and paste files" setting should be configured correctly for the Restricted Sites Zone. CCE-3337-3 The "File download" setting should be configured correctly for the Restricted Sites Zone. CCE-4150-9 The "Font download" setting should be configured correctly for the Restricted Sites Zone. CCE-4062-6 The "Installation of desktop items" setting should be configured correctly for the Restricted Sites Zone. CCE-4079-0 The "Allow META REFRESH" setting should be configured correctly for the Restricted Sites Zone. CCE-4084-0 The "Allow script-initiated windows without size or position constraints" setting should be configured correctly for the Restricted Sites Zone. CCE-4119-4 The "Allow Scriptlets" setting should be configured correctly for the Restricted Sites Zone. CCE-3639-2 The "Allow status bar updates via script" setting should be configured correctly for the Restricted Sites Zone. CCE-4031-1 The "Automatic prompting for file downloads" setting should be configured correctly for the Restricted Sites Zone. CCE-4053-5 The "Download signed ActiveX controls" setting should be configured correctly for the Restricted Sites Zone. CCE-4057-6 The "Download unsigned ActiveX controls" setting should be configured correctly for the Restricted Sites Zone. CCE-3564-2 The "Initialize and script ActiveX controls not marked as safe for scripting" setting should be configured correctly for the Restricted Sites Zone. CCE-4101-2 The "Java permissions" setting should be configured correctly for the Restricted Sites Zone. CCE-3996-6 The "Launching programs and files in an IFRAME" setting should be configured correctly for the Restricted Sites Zone. CCE-4066-7 The "Logon" setting should be configured correctly for the Restricted Sites Zone. CCE-3696-2 The "Loose XAML" setting should be configured correctly for the Restricted Sites Zone. CCE-3590-7 The "Navigate sub-frames across different domains" setting should be configured correctly for the Restricted Sites Zone. CCE-4110-3 The "Open files based on content, not file extension" setting should be configured correctly for the Restricted Sites Zone. CCE-4132-7 The "Run components not signed with Authenticode" setting should be configured correctly for the Restricted Sites Zone. CCE-3400-9 The "Run components signed with Authenticode" setting should be configured correctly for the Restricted Sites Zone. CCE-4158-2 The "Run ActiveX controls and plugins" setting should be configured correctly for the Restricted Sites Zone. CCE-4163-2 The "Script ActiveX controls marked safe for scripting" setting should be configured correctly for the Restricted Sites Zone. CCE-4202-8 The "Scripting of Java applets" setting should be configured correctly for the Restricted Sites Zone. CCE-3216-9 The "Software channel permissions" setting should be configured correctly for the Restricted Sites Zone. CCE-3855-4 The "Use Pop-up Blocker" setting should be configured correctly for the Restricted Sites Zone. CCE-4018-8 The "Userdata persistence" setting should be configured correctly for the Restricted Sites Zone. CCE-4040-2 The "Web sites in less privileged Web content zones can navigate into this zone" setting should be configured correctly for the Restricted Sites Zone. CCE-4215-0 The "XPS documents" setting should be configured correctly for the Restricted Sites Zone. CCE-3991-7 The "Display mixed content" setting should be configured correctly for the Restricted Sites Zone. CCE-3264-9 The "Display mixed content" setting should be configured correctly for the Trusted Sites Zone. CCE-4087-3 The "Display mixed content" setting should be configured correctly for the Locked Down Trusted Sites Zone. CCE-4232-5 The "Enable Native XMLHttp Support" setting should be configured correctly. CCE-4259-8 The "Turn on the auto-complete feature for user names and passwords on form" setting should be configured correctly. CCE-3647-5 The "Allow Install On Demand (Internet Explorer)" setting should be configured correctly. CCE-3677-2 The "Turn off page transitions" setting should be configured correctly. CCE-4056-8 The "Disable AutoComplete for forms" setting should be configured correctly. CCE-4246-5 The "Disable Save this program to disk option" setting should be configured correctly. CCE-4214-3 The "Disable changing certificate settings" setting should be configured correctly. CCE-3606-1 The "Disable external branding of Internet Explorer" setting should be configured correctly. CCE-4237-4 The "Configure Outlook Express" setting should be configured correctly CCE-3275-5 The "Turn on the Internet Connection Wizard Auto Detect" setting should be configured correctly. CCE-4036-0 The "Disable Internet Connection wizard" setting should be configured correctly. CCE-3825-7 The "Disable the Reset Web Settings feature" should be configured correctly. CCE-4226-7 The "Disable Downloading Of Site Subscription Content" setting should be configured correctly. CCE-4120-2 The "Disable Adding Schedules For Offline Pages" setting should be configured correctly. CCE-4248-1 The "Disable Adding Channels" setting should be configured correctly. CCE-3389-4 The "Disable Editing And Creating Of Schedule Groups" setting should be configured correctly. CCE-3645-9 The "Disable All Scheduled Offline Pages" setting should be configured correctly. CCE-3940-4 The "Disable Editing Schedules For Offline Pages" setting should be configured correctly. CCE-3821-6 The "Disable Channel User Interface Completely" setting should be configured correctly. CCE-3742-4 The "Disable Removing Channels" setting should be configured correctly. CCE-4261-4 The "Disable Removing Schedules For Offline Pages" setting should be configured correctly. CCE-4190-5 The "Disable Offline Page Hit Logging" setting should be configured correctly. CCE-4208-5 The "Java permissions" setting should be configured correctly for the Locked Down Intranet Zone. CCE-3754-9 The "Java permissions" setting should be configured correctly for the Local Machine Zone. CCE-3891-9 The "Java permissions" setting should be configured correctly for the Locked Down Local Machine Zone. CCE-4160-8 Computer-wide, rather than per-user, assignment of sites to zones for Internet Explorer should be enabled or disabled as appropriate. CCE-4763-9 The "Turn on Protected Mode" setting should be configured correctly for the Internet Zone. CCE-4643-3 The "Java permissions" setting should be configured correctly for the Intranet Zone. CCE-4652-4 The "Download signed ActiveX controls" setting should be configured correctly for the Locked-Down Internet Zone. CCE-4793-6 The "Java permissions" setting should be configured correctly for the Locked Down Internet Zone. CCE-4692-0 The "Java permissions" setting should be configured correctly for the Locked Down Restricted Sites Zone. CCE-3902-4 The "Allow status bar updates via script" setting should be configured correctly for the Locked-Down Trusted Sites Zone. CCE-4546-8 The "Java permissions" setting should be configured correctly for the Locked Down Trusted Sites Zone. CCE-4564-1 The "Turn on Protected Mode" setting should be configured correctly for the Restricted Sites Zone. CCE-3909-9 The "Java permissions" setting should be configured correctly for the Trusted Sites Zone. CCE-4845-4 The "Disable VBA for Office applications" setting should be configured correctly. CCE-116-4 The "ActiveX Control Initialization:" setting should be configured correctly. CCE-908-4 The "Enable Customer Experience Improvement Program" setting should be configured correctly. CCE-184-2 The "Enable Customer Experience Improvement Program" setting should be configured correctly. CCE-276-6 The "Online content options" setting should be configured correctly. CCE-967-0 The "VBA Macro Warning Settings" setting should be configured correctly for Access 2007. CCE-427-5 The "VBA Macro Warning Settings" setting should be configured correctly for Excel 2007. CCE-649-4 The "Trust access to Visual Basic Project" setting should be configured correctly for Excel 2007 and 2003. CCE-862-3 The "VBA Macro Warning Settings" setting should be configured correctly for PowerPoint 2007. CCE-567-8 The "Trust access to Visual Basic Project" setting should be configured correctly for PowerPoint 2007. CCE-68-7 The "Disable Remember Password" setting should be configured correctly. CCE-537-1 The "Configure Add-In Trust Level" setting should be configured correctly. CCE-786-4 The "Disable 'Remember password' for Internet e-mail accounts" setting should be configured correctly. CCE-937-3 The "Minimum encryption settings" setting should be configured correctly. CCE-13-3 The "Do not check e-mail address against address of certificates being using" setting should be configured correctly. CCE-316-0 The "Send all signed messages as clear signed messages" setting should be configured correctly. CCE-14-1 The "Request an S/MIME receipt for all S/MIME signed messages" setting should be configured correctly. CCE-153-7 The "Do not display 'Publish to GAL' button" setting should be configured correctly. CCE-345-9 The "Signature Warning" setting should be configured correctly. CCE-700-5 The "Enable Cryptography Icons" setting should be configured correctly. CCE-695-7 The "Retrieving CRLs (Certificate Revocation Lists)" setting should be configured correctly. CCE-395-4 The "VBA Macro Warning Settings" setting should be configured correctly for Word 2007. CCE-659-3 The "Trust access to Visual Basic Project" setting should be configured correctly for Word 2007 and 2003. CCE-703-9 The "Warn before printing, saving or sending a file that contains tracked changes or comments" setting should be configured correctly. CCE-173-5 The "Block updates from the Office Update Site from applying" setting should be configured correctly. CCE-784-9 The "Underline hyperlinks" setting should be configured correctly for Access 2007. CCE-1395-3 The "Number of documents in the Recent Documents list (0-9)" setting should be configured correctly for Access 2007. CCE-1137-9 The "Disable Trust Bar Notification for unsigned application add-ins" setting should be configured correctly for Access 2007. CCE-1423-3 The "Disable all application add-ins" setting should be configured correctly for Access 2007. CCE-1238-5 The "Require that application add-ins are signed by Trusted Publisher" setting should be configured correctly for Access 2007. CCE-1476-1 The "Disable all trusted locations" setting should be configured correctly for Access 2007. CCE-1520-6 The "Allow Trusted Locations not on the computer" setting should be configured correctly for Access 2007. CCE-780-7 The "Modal Trust Decision Only" setting should be configured correctly for Access 2007. CCE-1214-6 The "Disable commands" setting should be configured correctly for Access 2007. CCE-1370-6 The "Disable commands - Office Button | E-Mail" setting should be configured correctly for Access 2007. CCE-1268-2 The "Disable commands - Office Button | Access Options | Customize | All Commands | Insert Hyperlink" setting should be configured correctly for Access 2007. CCE-1400-1 The "Disable commands - Database Tools | Database Tools | Encrypt with Password" setting should be configured correctly for Access 2007. CCE-1440-7 The "Disable commands - Database Tools | Administer | Users and Permission | User and Group Permissions" setting should be configured correctly for Access 2007. CCE-581-9 The "Disable commands - Database Tools | Administer | Users and Permissions | User and Group Accounts" setting should be configured correctly for Access 2007. CCE-1480-3 The "Disable commands - Database Tools | Administer | Users and Permission | User-Level Security Wizard..." setting should be configured correctly for Access 2007. CCE-1489-4 The "Disable commands - Database Tools | Database Tools | Encode/Decode Database" setting should be configured correctly for Access 2007. CCE-1392-0 The "Disable commands - Database Tools | Macro | Visual Basic" setting should be configured correctly for Access 2007. CCE-1414-2 The "Disable commands - Database Tools | Macro | Run Macro" setting should be configured correctly for Access 2007. CCE-1418-3 The "Database Tools | Macro | Convert Macros to Visual Basic" setting should be configured correctly for Access 2007. CCE-1405-0 The "Database Tools | Macro | Create Shortcut Menu from Macro" setting should be configured correctly for Access 2007. CCE-1550-3 The "Disable shortcut keys" setting should be configured correctly for Access 2007. CCE-1075-1 The "Disable commands - Ctrl+K (Office Button | Access Options | Customize | All Commands | Insert Hyperlinks)" setting should be configured correctly for Access 2007. CCE-709-6 The "Disable commands - Alt+F11 (Database Tools | Macro | Visual Basic)" setting should be configured correctly for Access 2007. CCE-1502-4 The "Default file format (Access 2007 | Access 2002-2003)" setting should be configured correctly for Access 2007. CCE-1260-9 The "Do not prompt to convert older databases" setting should be configured correctly for Access 2007. CCE-1510-7 The "Internet and network paths as hyperlinks" setting should be configured correctly for Excel 2007. CCE-1532-1 The "Save Excel files as (Excel Workbook (*.xlsx) | Excel Macro-Enabled Workbook (*.xlsm) | Excel Binary Workbook (*.xlsb) | Web Page (*.htm; *.html) | Excel 97-2003 Workbook (*.xls) | Excel 5.0/95 Workbook (*.xls))" setting should be configured correctly for Excel 2007. CCE-1039-7 The "Disable AutoRepublish" setting should be configured correctly for Excel 2007. CCE-1295-5 The "AutoRepublish Warning Alert (Always show the alert before publishing | Never show the alert before publishing)" setting should be configured correctly for Excel 2007. CCE-1334-2 CCE-4195-4 CCE-4453-7 The "Determine whether to force encrypted macros to be scanned in Microsoft Excel Open XML workbooks" setting should be configured correctly CCE-1308-6 The "Force file extension to match file type (Allow different | Allow different, but warn | Always match file type)" setting should be configured correctly for Excel 2007. CCE-616-3 The "Store macro in Personal Macro Workbook by default" setting should be configured correctly CCE-1246-8 The "Disable all application add-ins" setting should be configured correctly for Excel 2007. CCE-1251-8 The "Require that application add-ins are signed by Trusted Publisher" setting should be configured correctly for Excel 2007. CCE-1524-8 The "Disable Trust Bar Notification for unsigned application add-ins" setting should be configured correctly for Excel 2007. CCE-1422-5 The "Allow Trusted Locations not on the computer" setting should be configured correctly for Excel 2007. CCE-1444-9 The "Disable all trusted locations" setting should be configured correctly for Excel 2007. CCE-1449-8 The "Ignore other applications " setting should be configured correctly for Excel 2007. CCE-1471-2 The "Ask to update automatic links" setting should be configured correctly for Excel 2007. CCE-1119-7 The "Number of documents in the Recent Documents list (0-17)" setting should be configured correctly for Excel 2007. CCE-1378-9 The "Save any additional data necessary to maintain formulas" setting should be configured correctly for Excel 2007. CCE-1277-3 The "Load pictures from Web pages not created in Excel" setting should be configured correctly for Excel 2007. CCE-1464-7 The "Do not show data extraction options when opening corrupt workbooks" setting should be configured correctly for Excel 2007. CCE-1094-2 The "Assume structured storage format of workbook is intact when recovering data" setting should be configured correctly for Excel 2007. CCE-1129-6 The "Corrupt formula conversion (Convert unrecoverable references to: values | #REF or #NAME)" setting should be configured correctly for Excel 2007. CCE-1389-6 The "Connection File Locations" setting should be configured correctly for Excel 2007. CCE-1433-2 The "Automatic Query Refresh (Prompt for all workbooks | Do not prompt; do not allow auto refresh | Do not prompt; allow auto refresh)" setting should be configured correctly for Excel 2007. CCE-1323-5 The "Disable commands" setting should be configured correctly for Excel 2007. CCE-1469-6 The "Disable commands - Office Button | Excel Options | Customize | All Commands | Save as Web Page" setting should be configured correctly for Excel 2007. CCE-1473-8 The "Disable commands - Office Button | Excel Options | Customize | All Commands | Web Page Preview" setting should be configured correctly for Excel 2007. CCE-1499-3 The "Disable commands - Office Button | Send | Email" setting should be configured correctly for Excel 2007. CCE-1024-9 The "Disable commands - Insert | Links | Hyperlink" setting should be configured correctly for Excel 2007. CCE-1530-5 The "Disable commands - Review | Changes | Protect Sheet" setting should be configured correctly for Excel 2007. CCE-1120-5 The "Disable commands - Review | Changes | Protect Workbook" setting should be configured correctly for Excel 2007. CCE-1252-6 The "Disable commands - Review | Changes | Protect and Share Workbook" setting should be configured correctly for Excel 2007. CCE-1151-0 The "Disable commands - View | Macros | Macros" setting should be configured correctly for Excel 2007. CCE-1301-1 The "Disable commands - Developer | Code | Macros" setting should be configured correctly for Excel 2007. CCE-1310-2 The "Disable commands - Developer | Code | Record Macro" setting should be configured correctly for Excel 2007. CCE-1213-8 The "Disable commands - Developer | Code | Macro Security" setting should be configured correctly for Excel 2007. CCE-1362-3 The "Disable commands - Developer | Code | Visual Basic" setting should be configured correctly for Excel 2007. CCE-1156-9 The "Disable commands - Office Button | Excel Options | Customize | All Commands | Document Location" setting should be configured correctly for Excel 2007. CCE-1429-0 The "Disable shortcut keys" setting should be configured correctly for Excel 2007. CCE-1182-5 The "Disable shortcut keys - Ctrl+K (Insert | Links | Hyperlink)" setting should be configured correctly for Excel 2007. CCE-1525-5 The "Disable shortcut keys - Alt+F8 (Developer | Code | Macros)" setting should be configured correctly for Excel 2007. CCE-1547-9 The "Disable shortcut keys - Alt+F11 (Developer | Code | Visual Basic)" setting should be configured correctly for Excel 2007. CCE-1300-3 The "Block opening of pre-release versions of file formats new to Excel 2007" setting should be configured correctly for Excel 2007. CCE-1331-8 The "Block opening of Open XML file types" setting should be configured correctly for Excel 2007. CCE-1468-8 The "Block opening of Binary 12 file types" setting should be configured correctly for Excel 2007. CCE-1490-2 The "Block opening of Binary file types" setting should be configured correctly for Excel 2007. CCE-1512-3 The "Block opening of Html and Xmlss files types" setting should be configured correctly for Excel 2007. CCE-1543-8 The "Block opening of Xml file types" setting should be configured correctly for Excel 2007. CCE-1195-7 The "Block opening of DIF and SYLK file types" setting should be configured correctly for Excel 2007. CCE-554-6 The "Block opening of Text file types" setting should be configured correctly for Excel 2007. CCE-1415-9 The "Block opening of Xll file type" setting should be configured correctly for Excel 2007. CCE-1437-3 The "Block saving of Open Xml file types" setting should be configured correctly for Excel 2007. CCE-1446-4 The "Block saving of Binary12 file types" setting should be configured correctly for Excel 2007. CCE-1098-3 The "Block saving of Binary file types" setting should be configured correctly for Excel 2007. CCE-562-9 The "Block saving of Html and Xmlss file types" setting should be configured correctly for Excel 2007. CCE-1507-3 The "Block saving Xml file types" setting should be configured correctly for Excel 2007. CCE-1406-8 The "Block saving DIF and SYLK file types" setting should be configured correctly for Excel 2007. CCE-573-6 The "Block saving of Text file types" setting should be configured correctly for Excel 2007. CCE-1336-7 The "Locally cache network file storages" setting should be configured correctly for Excel 2007. CCE-1230-2 The "Locally cache PivotTable reports" setting should be configured correctly for Excel 2007. CCE-1375-5 The "OLAP PivotTable User Defined Function (UDF) security setting (Allow ALL UDFs | Allow safe UDFs only | Allow NO UDFs)" setting should be configured correctly for Excel 2007. CCE-1380-5 The "Recognize SmartTags" setting should be configured correctly for Excel 2007. CCE-1376-3 The "Number of documents in the Recent Documents list (0 - 9)" setting should be configured correctly for InfoPath 2007. CCE-1398-7 The "Offline Mode status (Disabled | Enabled, InfoPath in Offline Mode | Enabled, InfoPath not in Offline Mode)" setting should be configured correctly for InfoPath 2007. CCE-569-4 The "Disable commands" setting should be configured correctly for InfoPath 2007. CCE-1065-2 The "Disable commands - File | Print" setting should be configured correctly for InfoPath 2007. CCE-1361-5 The "Disable commands - File | Send to Mail Recipient" setting should be configured correctly for InfoPath 2007. CCE-1096-7 The "Disable commands - File | Open from SharePoint Site" setting should be configured correctly for InfoPath 2007. CCE-1391-2 The "Disable commands - File | Print Preview" setting should be configured correctly for InfoPath 2007. CCE-1519-8 The "Disable commands - File | Page Setup" setting should be configured correctly for InfoPath 2007. CCE-1523-0 The "Disable commands - Insert | Hyperlinks..." setting should be configured correctly for InfoPath 2007. CCE-1171-8 The "Disable commands - Tools | Set Language" setting should be configured correctly for InfoPath 2007. CCE-1457-1 The "Disable commands - Tools | Customize..." setting should be configured correctly for InfoPath 2007. CCE-1426-6 The "Disable commands - Tools | Options..." setting should be configured correctly for InfoPath 2007. CCE-805-2 The "Disable commands - Help | Microsoft Office Online" setting should be configured correctly for InfoPath 2007. CCE-1453-0 The "Disable commands - Office Diagnostics" setting should be configured correctly for InfoPath 2007. CCE-1351-6 The "Disable commands - Help | Activate Product..." setting should be configured correctly for InfoPath 2007. CCE-620-5 The "Disable commands - Print Default" setting should be configured correctly for InfoPath 2007. CCE-1017-3 The "Disable shortcut keys" setting should be configured correctly for InfoPath 2007. CCE-1021-5 The "Disable shortcut keys - Print Shortcut (Ctrl+P)" setting should be configured correctly for InfoPath 2007. CCE-1299-7 The "Disable shortcut keys - Insert Hyperlink Shortcut (Ctrl+K)" setting should be configured correctly for InfoPath 2007. CCE-1197-3 The "Control behavior for Windows SharePoint Services gradual upgrade (Allow redirections to any location | Allow redirections to Intranet only | Block all redirections)" setting should be configured correctly for InfoPath 2007. CCE-704-7 The "Disable opening of solutions from the Internet security zone" setting should be configured correctly for InfoPath 2007. CCE-1105-6 The "Disable fully trusted solutions full access to computer" setting should be configured correctly for InfoPath 2007. ` The "Allow the use of ActiveX Custom Controls in InfoPath forms" setting should be configured correctly for InfoPath 2007. CCE-761-7 The "Run forms in restricted mode if they do not specify a publish location and use only features introduced before InfoPath 2003 SP1" setting should be configured correctly for InfoPath 2007. CCE-739-3 The "Allow file types as attachments to forms" setting should be configured correctly for InfoPath 2007. CCE-1259-1 The "Block specific file types as attachments to forms" setting should be configured correctly for InfoPath 2007. CCE-1267-4 The "Prevent users from allowing unsafe file types to be attached to forms" setting should be configured correctly for InfoPath 2007. CCE-1060-3 The "Display a warning that a form is digitally signed" setting should be configured correctly for InfoPath 2007. CCE-955-5 The "Control behavior when opening forms in the Internet security zone (Block | Prompt | Allow)" setting should be configured correctly for InfoPath 2007. CCE-1479-5 The "Control behavior when opening forms in the Intranet security zone (Block | Prompt | Allow)" setting should be configured correctly for InfoPath 2007. CCE-1360-7 The "Control behavior when opening forms in the Local Machine security zone (Block | Prompt | Allow)" setting should be configured correctly for InfoPath 2007. CCE-1386-2 The "Control behavior when opening forms in the Trusted Site security zone (Block | Prompt | Allow)" setting should be configured correctly for InfoPath 2007. CCE-893-8 The "Beaconing UI for forms opened in InfoPath (Never show beaconing UI | Always show beaconing UI | Show UI if Form Template is from Internet Zone)" setting should be configured correctly for InfoPath 2007. CCE-1290-6 The "Beaconing UI for forms opened in InfoPath Editor ActiveX (Never show beaconing UI | Always show beaconing UI | Show UI if Form Template is from Internet Zone)" setting should be configured correctly for InfoPath 2007. CCE-1381-3 The "Disable all application add-ins" setting should be configured correctly for InfoPath 2007. CCE-1135-3 The "Require that application add-ins are signed by Trusted Publisher" setting should be configured correctly for InfoPath 2007. CCE-1157-7 The "Disable Trust Bar Notification for unsigned application add-ins" setting should be configured correctly for InfoPath 2007. CCE-1434-0 The "Control behavior when opening InfoPath e-mail forms containing code or script (Run without prompting | Prompt before running | Never run)" setting should be configured correctly for InfoPath 2007. CCE-1315-1 The "Disable sending form template with e-mail forms" setting should be configured correctly for InfoPath 2007. CCE-1210-4 The "Disable dynamic caching of the form template in InfoPath e-mail forms" setting should be configured correctly for InfoPath 2007. CCE-1236-9 The "Disable sending InfoPath 2003 Forms as e-mail forms" setting should be configured correctly for InfoPath 2007. CCE-884-7 The "Disable e-mail forms running in restricted security level" setting should be configured correctly for InfoPath 2007. CCE-1518-0 The "Disable e-mail forms from the Internet security zone" setting should be configured correctly for InfoPath 2007. CCE-1170-0 The "Disable e-mail forms from the Intranet security zone" setting should be configured correctly for InfoPath 2007. CCE-1316-9 The "Disable e-mail forms from the Full Trust security zone" setting should be configured correctly for InfoPath 2007. CCE-1567-7 The "Disable InfoPath e-mail forms in Outlook" setting should be configured correctly for InfoPath 2007. CCE-1265-8 The "Information Rights Management" setting should be configured correctly for InfoPath 2007. CCE-1538-8 The "Custom code" setting should be configured correctly for InfoPath 2007. CCE-1564-4 The "Email Forms Beaconing UI (Never show UI | Always show UI | Show UI if XSN is in Internet Zone)" setting should be configured correctly for InfoPath 2007. CCE-1212-0 The "Disable user customization of Quick Access Toolbar via UI" setting should be configured correctly CCE-1344-1 The "Disable user customization of Quick Access Toolbar via UI - Disallow in Word" setting should be configured correctly CCE-723-7 The "Disable user customization of Quick Access Toolbar via UI - Disallow in Excel" setting should be configured correctly CCE-1384-7 The "Disable user customization of Quick Access Toolbar via UI - Disallow in PowerPoint" setting should be configured correctly CCE-1159-3 The "Disable user customization of Quick Access Toolbar via UI - Disallow in Access" setting should be configured correctly CCE-1146-0 The "Disable user customization of Quick Access Toolbar via UI - Disallow in Outlook" setting should be configured correctly CCE-1542-0 The "Disable all user customization of Quick Access Toolbar" setting should be configured correctly CCE-582-7 The "Disable all user customization of Quick Access Toolbar - Disallow in Word" setting should be configured correctly CCE-1291-4 The "Disable all user customization of Quick Access Toolbar - Disallow in Excel" setting should be configured correctly CCE-1326-8 The "Disable all user customization of Quick Access Toolbar - Disallow in PowerPoint" setting should be configured correctly CCE-1330-0 The "Disable all user customization of Quick Access Toolbar - Disallow in Access" setting should be configured correctly CCE-1335-9 The "Disable all user customization of Quick Access Toolbar - Disallow in Outlook" setting should be configured correctly CCE-1229-4 The "Disable UI extending from documents and templates" setting should be configured correctly CCE-630-4 The "Disable UI extending from documents and templates - Disallow in Word" setting should be configured correctly CCE-1154-4 The "Disable UI extending from documents and templates - Disallow in Excel" setting should be configured correctly CCE-1410-0 The "Disable UI extending from documents and templates - Disallow in PowerPoint" setting should be configured correctly CCE-1432-4 The "Disable UI extending from documents and templates - Disallow in Access" setting should be configured correctly CCE-1198-1 The "Disable UI extending from documents and templates - Disallow in Outlook" setting should be configured correctly CCE-929-0 The "Recognize smart tags in Excel" setting should be configured correctly CCE-1074-4 The "Disable Clip Art and Media downloads from the client and from Office Online website" setting should be configured correctly CCE-1458-9 The "Disable template downloads from the client and from Office Online website" setting should be configured correctly CCE-1233-6 The "Disable access to updates, add-ins, and patches on the Office Online website" setting should be configured correctly CCE-1379-7 The "Prevents users from uploading document templates to the Office Online community." setting should be configured correctly CCE-1401-9 The "Disable training practice downloads from the Office Online website" setting should be configured correctly CCE-1528-9 The "Disable customer-submitted templates downloads from Office Online" setting should be configured correctly CCE-1533-9 The "Open Office documents as read/write while browsing" setting should be configured correctly CCE-646-0 The "Rely on VML for displaying graphics in browsers" setting should be configured correctly CCE-1438-1 The "Allow PNG as an output format" setting should be configured correctly CCE-711-2 The "Improve Proofing Tools" setting should be configured correctly CCE-1292-2 The "Disable Opt-in Wizard on first run" setting should be configured correctly. CCE-1615-4 The "Microsoft Office Online" setting should be configured correctly CCE-1191-6 The "Disable Password Caching" setting should be configured correctly CCE-1587-5 The "Disable all Trust Bar notifications for security issues" setting should be configured correctly CCE-1486-0 The "Protect document metadata for rights managed Office Open XML Files" setting should be configured correctly CCE-1508-1 The "Protect document metadata for password protected files." setting should be configured correctly CCE-1640-2 The "Encryption type for password protected Office Open XML files" setting should be configured correctly CCE-1539-6 The "Encryption type for password protected Office 97-2003 files" setting should be configured correctly CCE-1561-0 The "Load Controls in Forms3 (1 | 2 | 3 | 4)" setting should be configured correctly CCE-1068-6 The "Automation Security (Disable macros by default | Use application macro security level | Macros enabled)" setting should be configured correctly CCE-1574-3 The "Prevent Word and Excel from loading managed code extensions" setting should be configured correctly CCE-1239-3 The "Disable hyperlink warnings" setting should be configured correctly CCE-1623-8 The "Disable password to open UI" setting should be configured correctly CCE-1083-5 The "Download Office Controls" setting should be configured correctly CCE-1343-3 The "Disable All ActiveX" setting should be configured correctly CCE-1242-7 The "Allow mix of policy and user locations" setting should be configured correctly CCE-770-8 The "Disable Smart Document's use of manifests" setting should be configured correctly CCE-903-5 The "Completely disable the Smart Documents feature in Word and Excel" setting should be configured correctly CCE-1555-2 The "Disable Internet Fax feature" setting should be configured correctly CCE-1061-1 The "Prevent users from changing permissions on rights managed content" setting should be configured correctly CCE-1603-0 The "Allow users with earlier versions of Office to read with browsers..." setting should be configured correctly CCE-1612-1 The "Always require users to connect to verify permission" setting should be configured correctly CCE-1493-6 The "Always expand groups in Office when restricting permission for documents" setting should be configured correctly CCE-1409-2 The "Never allow users to specify groups when restricting permission for documents" setting should be configured correctly CCE-1589-1 The "Disable Microsoft Passport service for content with restricted permission" setting should be configured correctly CCE-1237-7 The "Do not allow users to upgrade Information Rights Management configuration" setting should be configured correctly CCE-1404-3 The "Key Usage Filtering" setting should be configured correctly CCE-1396-1 The "EKU filtering" setting should be configured correctly CCE-1167-6 The "Legacy format signatures" setting should be configured correctly CCE-1585-9 The "Suppress Office Signing Providers (Enable Western and East Asian | Suppress default Western | Suppress default East Asian | Suppress both Western and East Asian)" setting should be configured correctly CCE-1572-7 The "Suppress external signature services menu item" setting should be configured correctly CCE-1220-3 The "Disable Check For Solutions" setting should be configured correctly CCE-1634-5 The "Disable inclusion of document properties in PDF and XPS output" setting should be configured correctly CCE-1643-6 The "Disable Document Information Panel" setting should be configured correctly CCE-1546-1 The "Document Information Panel Beaconing UI (Never show UI | Always show UI | Show UI if XSN is in Internet Zone)" setting should be configured correctly CCE-1505-7 The "Disable the Office client from polling the Office server for published links" setting should be configured correctly CCE-1545-3 The "Block opening of pre-release versions of file formats new to Word 2007 through the Compatibility Pack for the 2007 Office system and Word 2007 Open XML/Word 97-2003 Format Converter" setting should be configured correctly CCE-1549-5 The "Block opening of pre-release versions of file formats new to Excel 2007 through the Compatibility Pack for the 2007 Office system and Excel 2007 Converter" setting should be configured correctly CCE-1431-6 The "Block opening of pre-release versions of file formats new to PowerPoint 2007 through the Compatibility Pack for the 2007 Office system and PowerPoint 2007 Converter" setting should be configured correctly CCE-1594-1 The "Control Blogging (Enabled | Only SharePoint blogs allowed | All blogging disabled)" setting should be configured correctly CCE-1241-9 The "Enable Smart Resume" setting should be configured correctly CCE-1607-1 The "Do not upload media files" setting should be configured correctly CCE-752-6 The "Disable hyperlinks to web templates in File | New and task panes" setting should be configured correctly CCE-1166-8 The "Prevent access to Web-based file storage" setting should be configured correctly CCE-654-4 The "Do not allow attachment previewing in Outlook" setting should be configured correctly for Outlook 2007. CCE-1192-4 The "Read e-mail as plain text" setting should be configured correctly for Outlook 2007. CCE-791-4 The "Read signed e-mail as plain text" setting should be configured correctly for Outlook 2007. CCE-1456-3 The "Prevent publishing to Office Online" setting should be configured correctly for Outlook 2007. CCE-1478-7 The "Prevent publishing to a DAV server" setting should be configured correctly for Outlook 2007. CCE-1368-0 The "Restrict level of calendar details users can publish (All options are available | Disables 'Full details' | Disables 'Full details' and 'Limited details')" setting should be configured correctly for Outlook 2007. CCE-1641-0 The "Access to published calendars" setting should be configured correctly for Outlook 2007. CCE-1266-6 The "Restrict upload method" setting should be configured correctly for Outlook 2007. CCE-1399-5 The "Hide Junk Mail UI" setting should be configured correctly for Outlook 2007. CCE-1187-4 The "Junk E-mail protection level (No Protection, Low, High, Trusted Lists Only)" setting should be configured correctly for Outlook 2007. CCE-1588-3 The "Trust E-mail from Contacts" setting should be configured correctly for Outlook 2007. CCE-1117-1 The "Add e-mail recipients to users' Safe Senders Lists" setting should be configured correctly for Outlook 2007. CCE-1130-4 The "Dial-up options" setting should be configured correctly for Outlook 2007. CCE-1093-4 The "Dial-up options - Warn before switching dial-up connection" setting should be configured correctly for Outlook 2007. CCE-1599-0 The "Dial-up options - Hang up when finished sending, receiving, or updating" setting should be configured correctly for Outlook 2007. CCE-1621-2 The "Dial-up options - Automatically dial during a background Send/Receive" setting should be configured correctly for Outlook 2007. CCE-1269-0 The "Do not allow creating, replying, or forwarding signatures for e-mail messages" setting should be configured correctly for Outlook 2007. CCE-1419-1 The "Send copy of pictures with HTML messages instead of reference to Internet location" setting should be configured correctly for Outlook 2007. CCE-1551-1 The "Outlook Rich Text options (Convert to HTML | Convert to Plain Text format | Send Using Outlook Rich Text format)" setting should be configured correctly for Outlook 2007. CCE-655-1 The "Plain text options" setting should be configured correctly for Outlook 2007. CCE-1592-5 The "Plain text options - Encode attachments in UUENCODE format when sending a plain text message" setting should be configured correctly for Outlook 2007. CCE-1614-7 The "Set message format (HTML | Rich Text | Plain Text)" setting should be configured correctly for Outlook 2007. CCE-1526-3 The "Make Outlook the default program for E-mail, Contacts, and Calendar" setting should be configured correctly for Outlook 2007. CCE-1111-4 The "Do not allow folders in non-default stores to be set as folder home pages" setting should be configured correctly for Outlook 2007. CCE-1494-4 The "Use Unicode format when dragging e-mail message to file system" setting should be configured correctly for Outlook 2007. CCE-1287-2 The "Do not allow Outlook object model scripts to run for shared folders" setting should be configured correctly for Outlook 2007. CCE-1529-7 The "Do not allow Outlook object model scripts to run for public folders" setting should be configured correctly for Outlook 2007. CCE-1560-2 The "Set maximum level of online status on a person name (Do not allow | Allow everywhere except To and CC field | Allow everywhere)" setting should be configured correctly for Outlook 2007. CCE-1596-6 The "Display online status on a person name (Never | Everywhere except To and CC field | Everywhere)" setting should be configured correctly for Outlook 2007. CCE-1604-8 The "Turn off Enable the Person Names Smart Tag option" setting should be configured correctly for Outlook 2007. CCE-1648-5 The "Outlook Security Mode (Outlook Default Security | Use Security Form from 'Outlook Security Settings' Public Folder | Use Security Form from 'Outlook 10 Security Settings' Public Folder | Use Outlook Security Group Policy)" setting should be configured correctly for Outlook 2007. CCE-1516-4 The "Display Level 1 attachments" setting should be configured correctly for Outlook 2007. CCE-1296-3 The "Allow users to demote attachments to Level 2" setting should be configured correctly for Outlook 2007. CCE-1388-8 The "Do not prompt about Level 1 attachments when sending an item" setting should be configured correctly for Outlook 2007. CCE-1652-7 The "Do not prompt about Level 1 attachments when closing an item" setting should be configured correctly for Outlook 2007. CCE-1569-3 The "Allow in-place activation of embedded OLE objects" setting should be configured correctly for Outlook 2007. CCE-1459-7 The "Display OLE package objects" setting should be configured correctly for Outlook 2007. CCE-1608-9 The "Add file extensions to block as Level 1" setting should be configured correctly for Outlook 2007. CCE-1617-0 The "Remove file extensions blocked as Level 1" setting should be configured correctly for Outlook 2007. CCE-1631-1 The "Add file extensions to block as Level 2" setting should be configured correctly for Outlook 2007. CCE-1155-1 The "Remove file extensions blocked as Level 2" setting should be configured correctly for Outlook 2007. CCE-1556-0 The "Allow scripts in one-off Outlook forms" setting should be configured correctly for Outlook 2007. CCE-1595-8 The "Set Outlook object model Custom Actions execution prompt (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1436-5 The "Set control ItemProperty prompt (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly CCE-1586-7 The "Configure Outlook object model prompt when sending mail (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1590-9 The "Configure Outlook object model prompt when accessing an address book (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1004-1 The "Configure Outlook object model prompt when reading address information (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1273-2 The "Configure Outlook object model prompt when responding to meeting and task requests (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1172-6 The "Configure Outlook object model prompt when executing Save As (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1568-5 The "Configure Outlook object model prompt When accessing the Formula property of a UserProperty object (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1573-5 The "Configure Outlook object model prompt when accessing address information via UserProperties.Find (Prompt User | Automatically Approve | Automatically Deny | Prompt user based on computer security)" setting should be configured correctly for Outlook 2007. CCE-1454-8 The "Required Certificate Authority" setting should be configured correctly for Outlook 2007. CCE-1498-5 The "S/MIME interoperability with external clients: (Handle internally | Handle externally | Handle if possible)" setting should be configured correctly for Outlook 2007. CCE-1630-3 The "Always use Rich Text formatting in S/MIME messages" setting should be configured correctly for Outlook 2007. CCE-1626-1 The "S/MIME password settings" setting should be configured correctly for Outlook 2007. CCE-1163-5 The "S/MIME password settings - Default S/MIME password time (minutes): (0 - 2147483647)" setting should be configured correctly for Outlook 2007. CCE-1445-6 The "S/MIME password settings - Maximum S/MIME password time (minutes): (0 - 2147483647)" setting should be configured correctly for Outlook 2007. CCE-1582-6 The "Message Formats" setting should be configured correctly for Outlook 2007. CCE-1357-3 The "Message Formats - Support the following message formats: (S/MIME | Exchange | Fortezza | S/MIME and Exchange | S/MIME and Fortezza | Exchange and Fortezza | S/MIME, Exchange, and Fortezza)" setting should be configured correctly for Outlook 2007. CCE-1132-0 2007: The "Do not provide Continue option on Encryption warning dialog boxes" setting should be configured correctly for Outlook 2007. 2003: The "Disable Continue button on all Encryption warning dialogs" setting should be configured correctly. CCE-1511-5 The "Run in FIPS compliant mode" setting should be configured correctly for Outlook 2007. CCE-1018-1 The "Encrypt all e-mail messages" setting should be configured correctly for Outlook 2007 and 2003. CCE-1181-7 The "Sign all e-mail messages" setting should be configured correctly for Outlook 2007. CCE-1639-4 The "URL for S/MIME certificates" setting should be configured correctly for Outlook 2007. CCE-677-5 The "Ensure all S/MIME signed messages have a label" setting should be configured correctly for Outlook 2007. CCE-687-4 The "S/MIME receipt requests (Open message if receipt can't be sent | Don't open message if receipt can't be sent | Always prompt before sending receipt | Never send S/MIME )" setting should be configured correctly for Outlook 2007. CCE-1613-9 The "Fortezza certificate policies" setting should be configured correctly for Outlook 2007. CCE-1402-7 The "Require SuiteB algorithms for S/MIME operations" setting should be configured correctly for Outlook 2007. CCE-1658-4 The "Missing CRLs" setting should be configured correctly for Outlook 2007. CCE-1662-6 The "Missing CRLs - Indicate a missing CRL as a(n): (warning | error)" setting should be configured correctly for Outlook 2007. CCE-1080-1 The "Missing root certificates" setting should be configured correctly for Outlook 2007. CCE-1076-9 The "Missing root certificates - Indicate a missing root certificate as a(n): (neither error nor warning | warning | error)" setting should be configured correctly for Outlook 2007. CCE-1636-0 The "Promote Level 2 errors as errors, not warnings" setting should be configured correctly for Outlook 2007. CCE-943-1 The "Attachment Secure Temporary Folder" setting should be configured correctly for Outlook 2007. CCE-1591-7 The "Display pictures and external content in HTML e-mail" setting should be configured correctly for Outlook 2007. CCE-1133-8 The "Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists" setting should be configured correctly for Outlook 2007. CCE-725-2 The "Do not permit download of content from safe zones" setting should be configured correctly for Outlook 2007. CCE-1347-4 The "Block Trusted Zones" setting should be configured correctly for Outlook 2007. CCE-1475-3 The "Include Internet in Safe Zones for Automatic Picture Download" setting should be configured correctly for Outlook 2007. CCE-1497-7 The "Include Intranet in Safe Zones for Automatic Picture Download" setting should be configured correctly for Outlook 2007. CCE-1501-6 The "Security setting for macros (Always warn | Never warn, disable all | Warn for signed, disable unsigned | No security check)" setting should be configured correctly for Outlook 2007. CCE-1030-6 The "Enable links in e-mail messages" setting should be configured correctly for Outlook 2007. CCE-1052-0 The "Apply macro security settings to macros, add-ins, and SmartTags" setting should be configured correctly for Outlook 2007. CCE-1462-1 The "Automatically configure profile based on Active Directory Primary SMTP address" setting should be configured correctly for Outlook 2007. CCE-1281-5 The "Do not allow users to change permissions on folders" setting should be configured correctly for Outlook 2007. CCE-1303-7 The "Enable RPC encryption" setting should be configured correctly for Outlook 2007. CCE-1082-7 The "Authentication with Exchange Server (Kerberos/NTLM Password Authentication | Kerberos Password Authentication | NTLM Password Authentication)" setting should be configured correctly for Outlook 2007. CCE-1712-9 The "Synchronize Outlook RSS Feeds with Common Feed List" setting should be configured correctly for Outlook 2007. CCE-1131-2 The "Turn off RSS feature" setting should be configured correctly for Outlook 2007. CCE-1620-4 The "Automatically download enclosures" setting should be configured correctly for Outlook 2007. CCE-1541-2 The "Download full text of articles as HTML attachments" setting should be configured correctly for Outlook 2007. CCE-1311-0 The "Automatically download attachments" setting should be configured correctly for Outlook 2007. CCE-1682-4 The "Do not include Internet Calendar integration in Outlook" setting should be configured correctly for Outlook 2007. CCE-1461-3 The "Disable user entries to server list (Publish default, allow others | Publish default, disallow others)" setting should be configured correctly for Outlook 2007. CCE-1041-3 The "Do not expand distribution lists" setting should be configured correctly for Outlook 2007. CCE-1565-1 The "Save files in this format (PowerPoint Presentation (*.pptx) | PowerPoint Macro-Enabled Presentation (*.pptm) | PowerPoint 97-2003 Presentation (*.ppt))" setting should be configured correctly for PowerPoint 2007. CCE-1719-4 The "Number of documents in the Recent Documents list (0 - 50)" setting should be configured correctly for PowerPoint 2007. CCE-1477-9 The "Determine whether to force encrypted macros to be scanned in Microsoft PowerPoint Open XML presentations" setting should be configured correctly for PowerPoint 2007. CCE-1142-9 The "Run Programs (disable (don't run any programs) | enable (prompt user before running) | enable all (run without prompting))" setting should be configured correctly for PowerPoint 2007. CCE-1649-3 The "Make hidden markup visible" setting should be configured correctly for PowerPoint 2007. CCE-1279-9 The "Unblock automatic download of linked images" setting should be configured correctly for PowerPoint 2007. CCE-1451-4 The "Disable all application add-ins" setting should be configured correctly for PowerPoint 2007. CCE-1204-7 The "Require that application add-ins are signed by Trusted Publisher" setting should be configured correctly for PowerPoint 2007. CCE-1107-2 The "Disable Trust Bar Notification for unsigned application add-ins" setting should be configured correctly for PowerPoint 2007. CCE-743-5 The "Allow Trusted Locations not on the computer" setting should be configured correctly for PowerPoint 2007. CCE-747-6 The "Disable all trusted locations" setting should be configured correctly for PowerPoint 2007. CCE-782-3 The "Disable commands" setting should be configured correctly for PowerPoint 2007. CCE-1327-6 The "Disable commands - Office Button | PowerPoint Options | Customize | All Commands | Web Page Preview" setting should be configured correctly for PowerPoint 2007. CCE-1723-6 The "Disable commands - Office Button | Send | Email" setting should be configured correctly for PowerPoint 2007. CCE-1366-4 The "Disable commands - Insert | Links | Hyperlink" setting should be configured correctly for PowerPoint 2007. CCE-1679-0 The "Disable commands - Review | Proofing | Language" setting should be configured correctly for PowerPoint 2007. CCE-1173-4 The "Disable commands - View | Macros | Macros" setting should be configured correctly for PowerPoint 2007. CCE-1714-5 The "Disable commands - Developer | Code | Macros" setting should be configured correctly for PowerPoint 2007. CCE-1485-2 The "Disable commands - Developer | Code | Macro Security" setting should be configured correctly for PowerPoint 2007. CCE-1687-3 The "Disable commands - Developer | Code | Visual Basic" setting should be configured correctly for PowerPoint 2007. CCE-1709-5 The "Disable commands - Office Button | PowerPoint Options | Customize | All Commands | Document Location" setting should be configured correctly for PowerPoint 2007. CCE-1463-9 The "Disable commands - Disable shortcut keys" setting should be configured correctly for PowerPoint 2007. CCE-1467-0 The "Disable commands - Ctrl+K (Insert | Links | Hyperlink)" setting should be configured correctly for PowerPoint 2007. CCE-1740-0 The "Disable commands - Alt+F8 (Developer | Code | Macros)" setting should be configured correctly for PowerPoint 2007. CCE-1780-6 The "Disable commands - Alt+F11 (Developer | Code | Visual Basic)" setting should be configured correctly for PowerPoint 2007. CCE-1661-8 The "Block opening of pre-release versions of file formats new to PowerPoint 2007" setting should be configured correctly for PowerPoint 2007. CCE-1688-1 The "Block opening of Open Xml files types" setting should be configured correctly for PowerPoint 2007. CCE-1701-2 The "Block opening of Binary file types" setting should be configured correctly for PowerPoint 2007. CCE-1348-2 The "Block opening of Html file types" setting should be configured correctly for PowerPoint 2007. CCE-1644-4 The "Block opening of Outlines" setting should be configured correctly for PowerPoint 2007. CCE-1194-0 The "Block opening of Converters" setting should be configured correctly for PowerPoint 2007. CCE-1216-1 The "Block saving of Open Xml file types" setting should be configured correctly for PowerPoint 2007. CCE-1506-5 The "Block saving of Binary file types" setting should be configured correctly for PowerPoint 2007. CCE-1136-1 The "Block saving of Html file types" setting should be configured correctly for PowerPoint 2007. CCE-1766-5 The "Block saving of Outlines" setting should be configured correctly for PowerPoint 2007. CCE-1180-9 The "Block saving of GraphicFilters" setting should be configured correctly for PowerPoint 2007. CCE-1722-8 The "Disable Slide Update" setting should be configured correctly for PowerPoint 2007. CCE-1731-9 The "Hidden text" setting should be configured correctly for Word 2007. CCE-885-4 The "Save files in this format (Word document (*.docx) | Single Files Web Page (*.mht) | Web Page (*.htm; *.html) | Web Page, Filtered (*.htm, *.html) | Rich Text Format (*.rtf) | Plain Text (*.txt) | Word 6.0/95 (*.doc) | Word 6.0/95 - Chinese (Simplified) (*.doc) | Word 6.0/95 - Chinese (Traditional) (*.doc) | Word 6.0/95 - Japanese (*.doc) | Word 6.0/95 - Korean (*.doc) | Word 97-2002 & 6.0/95 - RTF | Word 5.1 for Macintosh (*.mcw) | Word 5.0 for Macintosh (*.mcw) | Word 2.x for Windows (*.doc) | Works 4.0 for Windows (*.wps) | WordPerfect 5.x for Windows (*.doc) | WordPerfect 5.1 for DOS (*.doc) | Word 2007 Macro Enabled Document (*.docm) | Word 2007 Macro Free Template (*.dotx) | Word 2007 Macro Enabled Template (*.dotm) | Word 97 - 2003 Document (*.doc) | Word 97 - 2003 Template (*.dot) | Flat XML Document (*.xml))" setting should be configured correctly for Word 2007. CCE-1656-8 The "Number of documents in the Recent Documents list (0-50)" setting should be configured correctly for Word 2007. CCE-1537-0 The "Update automatic links at Open" setting should be configured correctly for Word 2007. CCE-1249-2 The "Save smart tags in e-mail" setting should be configured correctly for Word 2007. CCE-1509-9 The "Determine whether to force encrypted macros to be scanned in Microsoft Word Open XML documents" setting should be configured correctly for Word 2007. CCE-1280-7 The "Disable all application add-ins" setting should be configured correctly for Word 2007. CCE-1681-6 The "Require that application add-ins are signed by Trusted Publisher" setting should be configured correctly for Word 2007. CCE-1562-8 The "Disable Trust Bar Notification for unsigned application add-ins" setting should be configured correctly for Word 2007. CCE-1333-4 The "Allow Trusted Locations not on the computer" setting should be configured correctly for Word 2007. CCE-1355-7 The "Disable all trusted locations" setting should be configured correctly for Word 2007. CCE-1637-8 The "Disable commands" setting should be configured correctly for Word 2007. CCE-1659-2 The "Disable commands - Office Button | Word Options | Customize | All Commands | Save As Web Page" setting should be configured correctly for Word 2007. CCE-1329-2 The "Disable commands - Office Button | Word Options | Customize | All Commands | Web Page Preview" setting should be configured correctly for Word 2007. CCE-1632-9 The "Disable commands - Office Button | Send | Email" setting should be configured correctly for Word 2007. CCE-1425-8 The "Disable commands - Insert | Links | Hyperlink" setting should be configured correctly for Word 2007. CCE-1196-5 The "Disable commands - Review | Protect | Protect Document" setting should be configured correctly for Word 2007. CCE-936-5 The "Disable commands - View | Macros | Macros" setting should be configured correctly for Word 2007. CCE-1354-0 The "Disable commands - Developer | Code | Macros" setting should be configured correctly for Word 2007. CCE-1125-4 The "Disable commands - Developer | Code | Record Macro" setting should be configured correctly for Word 2007. CCE-1742-6 The "Disable commands - Developer | Code | Macro Security" setting should be configured correctly for Word 2007. CCE-1782-2 The "Disable commands - Developer | Code | Visual Basic" setting should be configured correctly for Word 2007. CCE-1306-0 The "Disable commands - Developer | Templates | Document Template" setting should be configured correctly for Word 2007. CCE-1548-7 The "Disable shortcut keys" setting should be configured correctly for Word 2007. CCE-1716-0 The "Disable shortcut keys - Ctrl+F (Home | Editing | Find)" setting should be configured correctly for Word 2007. CCE-1597-4 The "Disable shortcut keys - Ctrl+K (Insert | Links | Hyperlink)" setting should be configured correctly for Word 2007. CCE-1689-9 The "Disable shortcut keys - Alt+F8 (Developer | Code | Macros)" setting should be configured correctly for Word 2007. CCE-1570-1 The "Disable shortcut keys - Alt+F11 (Developer | Code | Visual Basic)" setting should be configured correctly for Word 2007. CCE-1720-2 The "Block opening of pre-release versions of file formats new to Word 2007" setting should be configured correctly for Word 2007. CCE-1746-7 The "Block opening of Open XML file types" setting should be configured correctly for Word 2007. CCE-1504-0 The "Block opening of Binary file types" setting should be configured correctly for Word 2007. CCE-1654-3 The "Block opening of HTML file types" setting should be configured correctly for Word 2007. CCE-1160-1 The "Block opening of Word 2003 XML file types" setting should be configured correctly for Word 2007. CCE-958-9 The "Block opening of RTF file types" setting should be configured correctly for Word 2007. CCE-1579-2 The "Block open Converters" setting should be configured correctly for Word 2007. CCE-984-5 The "Block opening of Text file types" setting should be configured correctly for Word 2007. CCE-1072-8 The "Block opening of Internal file types" setting should be configured correctly for Word 2007. CCE-1503-2 The "Block opening of files before version" setting should be configured correctly for Word 2007. CCE-1371-4 The "Block saving of Open XML file types" setting should be configured correctly for Word 2007. CCE-1019-9 The "Block saving of Binary file types" setting should be configured correctly for Word 2007. CCE-1684-0 The "Block saving of HTML file types" setting should be configured correctly for Word 2007. CCE-1675-8 The "Block saving of Word 2003 XML file types" setting should be configured correctly for Word 2007. CCE-1200-5 The "Block saving of RTF file types" setting should be configured correctly for Word 2007. CCE-1741-8 The "Block saving of Converters" setting should be configured correctly for Word 2007. CCE-1231-0 The "Block saving of Text file types" setting should be configured correctly for Word 2007. CCE-1755-8 The InfoPath APTCA Assembly Whitelist setting should be configured correctly. CCE-1169-2 The Windows Internet Explorer Feature Control Opt-In (None | InfoPath.exe, Document Information Panel and Workflow forms | InfoPath.exe, Document Information Panel, Workflow forms and 3rd Party Hosting) setting should be configured correctly. CCE-1735-0 The InfoPath APTCA Assembly Whitelist Enforcement setting should be configured correctly. CCE-1739-2 The Disable Package Repair setting should be configured correctly. CCE-933-2 The Disable user name and password setting should be configured correctly. CCE-1563-6 The Disable user name and password - excel.exe setting should be configured correctly. CCE-1215-3 The Disable user name and password - powerpnt.exe setting should be configured correctly. CCE-1484-5 The Disable user name and password - pptview.exe setting should be configured correctly. CCE-1629-5 The Disable user name and password - winword.exe setting should be configured correctly. CCE-1762-4 The Disable user name and password - outlook.exe setting should be configured correctly. CCE-1660-0 The Disable user name and password - spDesign.exe setting should be configured correctly. CCE-1057-9 The Disable user name and password - msaccess.exe setting should be configured correctly. CCE-1285-6 The Bind to object setting should be configured correctly. CCE-1669-1 The Bind to object - excel.exe setting should be configured correctly. CCE-1691-5 The Bind to object - powerpnt.exe setting should be configured correctly. CCE-1338-3 The Bind to object - pptview.exe setting should be configured correctly. CCE-1717-8 The Bind to object - winword.exe setting should be configured correctly. CCE-1488-6 The Bind to object - outlook.exe setting should be configured correctly. CCE-1638-6 The Bind to object - spDesign.exe setting should be configured correctly. CCE-1647-7 The Bind to object - msaccess.exe setting should be configured correctly. CCE-1294-8 The Saved from URL setting should be configured correctly. CCE-1193-2 The Saved from URL - excel.exe setting should be configured correctly. CCE-1352-4 The Saved from URL - powerpnt.exe setting should be configured correctly. CCE-928-2 The Saved from URL - pptview.exe setting should be configured correctly. CCE-1576-8 The Saved from URL - pptview.exe setting should be configured correctly. CCE-1100-7 The Saved from URL - outlook.exe setting should be configured correctly. CCE-1232-8 The Saved from URL - spDesign.exe setting should be configured correctly. CCE-1774-9 The Saved from URL - msaccess.exe setting should be configured correctly. CCE-906-8 The Navigate URL setting should be configured correctly. CCE-1034-8 The Navigate URL - excel.exe setting should be configured correctly. CCE-1435-7 The Navigate URL - powerpnt.exe setting should be configured correctly. CCE-1708-7 The Navigate URL - pptview.exe setting should be configured correctly. CCE-808-6 The Navigate URL - winword.exe setting should be configured correctly. CCE-1650-1 The Navigate URL - outlook.exe setting should be configured correctly. CCE-1223-7 The Navigate URL - spDesign.exe setting should be configured correctly. CCE-1764-0 The Navigate URL - msaccess.exe setting should be configured correctly. CCE-1769-9 The Block popups setting should be configured correctly. CCE-1152-8 The Block popups - excel.exe setting should be configured correctly. CCE-1566-9 The Block popups - powerpnt.exe setting should be configured correctly. CCE-1077-7 The Block popups - pptview.exe setting should be configured correctly. CCE-1606-3 The Block popups - winword.exe setting should be configured correctly. CCE-1738-4 The Block popups - outlook.exe setting should be configured correctly. CCE-1262-5 The Block popups - spDesign.exe setting should be configured correctly. CCE-1663-4 The Block popups - msaccess.exe setting should be configured correctly. CCE-1544-6 The "Prevent users from customizing attachment security settings" setting should be configured correctly. CCE-1443-1 The "Access: Macro Security Level" setting should be configured correctly. CCE-1161-9 The "Access: Trust all installed add – ins and templates" setting should be configured correctly. CCE-1421-7 The "Excel: Macro Security Level" setting should be configured correctly. CCE-1571-9 The "Excel: Trust all installed add – ins and templates" setting should be configured correctly. CCE-1721-0 The "Outlook: Macro Security Level" setting should be configured correctly. CCE-1602-2 The "Outlook: Trust all installed add-ins and templates" setting should be configured correctly. CCE-1624-6 The "Outlook virus security settings" setting should be configured correctly. CCE-1522-2 The "S/MIME receipt requests" setting should be configured correctly. CCE-1183-3 The "PowerPoint: Macro Security Level" setting should be configured correctly. CCE-1611-3 The "PowerPoint: Trust all installed add – ins and templates" setting should be configured correctly. CCE-1633-7 The "Publisher: Macro Security Level" setting should be configured correctly. CCE-822-7 The "Publisher: Trust all installed add–ins and templates" setting should be configured correctly. CCE-1734-3 The "Word: Macro Security Level" setting should be configured correctly. CCE-1628-7 The "Word: Trust all installed add–ins and templates" setting should be configured correctly. CCE-1761-6 The "Store random number to improve merge accuracy" setting should be configured correctly. CCE-1302-9 The "Prevent Users from Changing Office Encryption Settings" setting should be configured correctly. CCE-1307-8 The "reset account lockout counter after" policy should meet minimum requirements. CCE-2715-1 CCE-3574-1 CCE-3687-1 CCE-2466-1 The "account lockout duration" policy should meet minimum requirements. CCE-2363-0 CCE-2627-8 CCE-3960-2 CCE-2928-0 The "account lockout threshold" policy should meet minimum requirements. CCE-3177-3 CCE-3551-9 CCE-3229-2 CCE-2986-8 Auditing of "account logon" events on success should be enabled or disabled as appropriate.. CCE-2820-9 CCE-3321-7 CCE-3859-6 CCE-2867-0 Auditing of "account logon" events on failure should be enabled or disabled as appropriate.. CCE-3089-0 CCE-3467-8 CCE-3881-0 CCE-3008-0 Auditing of "account management" events on success should be enabled or disabled as appropriate.. CCE-3234-2 CCE-3427-2 CCE-3753-1 CCE-2902-5 Auditing of "account management" events on failure should be enabled or disabled as appropriate.. CCE-3287-0 CCE-3449-6 CCE-3885-1 CCE-2906-6 Auditing of "directory service access" events on success should be enabled or disabled as appropriate.. CCE-3041-1 CCE-2827-4 CCE-5236-5 CCE-2933-0 Auditing of "directory service access" events on failure should be enabled or disabled as appropriate.. CCE-3309-2 CCE-3101-3 CCE-4719-1 CCE-2206-1 Auditing of "logon" events on success should be enabled or disabled as appropriate.. CCE-3076-7 CCE-3603-8 CCE-3907-3 CCE-2100-6 Auditing of "logon" events on failure should be enabled or disabled as appropriate.. CCE-2970-2 CCE-3391-0 CCE-3678-0 CCE-2343-2 Auditing of "object access" events on success should be enabled or disabled as appropriate.. CCE-2724-3 CCE-3286-2 CCE-3313-4 CCE-2259-0 Auditing of "object access" events on failure should be enabled or disabled as appropriate.. CCE-3243-3 CCE-3290-4 CCE-3846-3 CCE-2766-4 Auditing of "policy change" events on success should be enabled or disabled as appropriate.. CCE-2746-6 CCE-3546-9 CCE-3366-2 CCE-2971-0 Auditing of "policy change" events on failure should be enabled or disabled as appropriate.. CCE-2653-4 CCE-3312-6 CCE-2995-9 CCE-2759-9 Auditing of "privilege use" events on success should be enabled or disabled as appropriate.. CCE-2322-6 CCE-3211-0 CCE-3779-6 CCE-2913-2 Auditing of "privilege use" events on failure should be enabled or disabled as appropriate.. CCE-3257-3 CCE-3383-7 CCE-3925-5 CCE-2918-1 Auditing of "process tracking" events on success should be enabled or disabled as appropriate.. CCE-3024-7 CCE-3510-5 CCE-3215-1 CCE-2816-7 Auditing of "process tracking" events on failure should be enabled or disabled as appropriate.. CCE-2927-2 CCE-3453-8 CCE-3911-5 CCE-2939-7 Auditing of "system" events on success should be enabled or disabled as appropriate.. CCE-2953-8 CCE-3594-9 CCE-3792-9 CCE-2878-7 Auditing of "system" events on failure should be enabled or disabled as appropriate.. CCE-3222-7 CCE-3611-1 CCE-3937-0 CCE-2843-1 The "restrict guest access to application log" policy should be set correctly. CCE-3121-1 CCE-3281-3 CCE-3880-2 CCE-2116-2 The application log maximum size should be configured correctly.. CCE-3015-5 CCE-3550-1 CCE-3775-4 CCE-2904-1 The "when maximum log size is reached" property should be set correctly for the Application log. CCE-2905-8 CCE-3797-8 CCE-3014-8 The "restrict guest access to security log" policy should be set correctly. CCE-2659-1 CCE-2946-2 CCE-3964-4 CCE-2794-6 The security log maximum size should be configured correctly.. CCE-3302-7 CCE-3343-1 CCE-3096-5 CCE-2693-0 The "when maximum log size is reached" property should be set correctly for the Security log. CCE-3196-3 CCE-3484-3 CCE-3589-9 CCE-2336-6 The "restrict guest access to system log" policy should be set correctly. CCE-2839-9 CCE-3488-4 CCE-3990-9 CCE-2345-7 The system log maximum size should be configured correctly.. CCE-3165-8 CCE-3506-3 CCE-3889-3 CCE-3006-4 The "when maximum log size is reached" property should be set correctly for the System log. CCE-2931-4 CCE-3422-3 CCE-3805-9 CCE-2777-1 The "maximum password age" policy should meet minimum requirements. CCE-2967-8 CCE-3530-3 CCE-3827-3 CCE-2920-7 The "minimum password age" policy should meet minimum requirements. CCE-3240-9 CCE-3548-5 CCE-3224-3 CCE-2439-8 The "minimum password length" policy should meet minimum requirements. CCE-2883-7 CCE-3424-9 CCE-3228-4 CCE-2981-9 The "password must meet complexity requirments" policy should be set correctly. CCE-3033-8 CCE-3442-1 CCE-3042-9 CCE-2735-9 The "enforce password history" policy should meet minimum requirements. CCE-2323-4 CCE-3446-2 CCE-3588-1 CCE-2994-2 The "store password using reversible encryption for all users in the domain" policy should be set correctly. CCE-3311-8 CCE-2644-3 CCE-3852-1 CCE-2889-4 The startup type of the Messenger service should be correct. CCE-3316-7 CCE-3494-2 CCE-3738-2 CCE-2915-7 The startup type of the NetMeeting Remote Desktop Sharing service should be correct. CCE-3082-5 CCE-2909-0 CCE-4035-2 CCE-2896-9 The behavior surrounding Anonymous users' abiliity to display lists of SAM accounts and shares should be correct. CCE-3232-6 CCE-3591-5 CCE-3837-2 CCE-2804-3 The behavior surrounding Anonymous users' abiliity to display lists of SAM accounts should be correct. CCE-3272-2 CCE-3631-9 CCE-2147-7 The behavior surrounding Anonymous SID/Name translation should be correct. CCE-2339-0 CCE-3402-5 CCE-2973-6 Use of the built-in Guest account should be enabled or disabled as appropriate. CCE-3248-2 CCE-2908-2 CCE-3766-3 CCE-3040-3 Use of the built-in Administrator account should be enabled or disabled as appropriate. CCE-3032-0 CCE-2943-9 The "Message title for users attempting to log on" policy should be set correctly. CCE-3314-2 CCE-2790-4 CCE-3669-9 CCE-2573-4 The "Message text for users attempting to log on" policy should be set correctly. CCE-3336-5 CCE-3672-3 CCE-4012-1 CCE-2472-9 Automatic Logon should be properly configured. CCE-3072-6 CCE-3690-5 CCE-3559-2 CCE-2776-3 Autoplay on all Drive Types should be properly configured. CCE-2719-3 CCE-3597-2 CCE-3726-7 CCE-2710-2 ICMP Redirects should be properly configured. CCE-3239-1 CCE-3725-9 CCE-3704-4 CCE-2824-1 IP Source Routing should be properly configured. CCE-3261-5 CCE-3227-6 CCE-3915-6 CCE-3132-8 IRDP should be properly configured. CCE-3279-7 CCE-3509-7 CCE-4065-9 CCE-2652-6 Display Last User Name in Logon Screen should be properly configured. CCE-3173-2 CCE-3527-9 CCE-3646-7 CCE-2930-6 System availability to Master Browser should be properly configured. CCE-3067-6 CCE-3620-2 CCE-2952-0 TCP/IP Dead Gateway Detection should be properly configured. CCE-3120-3 CCE-2919-9 CCE-3884-4 CCE-2718-5 The TCP/IP KeepAlive Time should be set correctly . CCE-3142-7 CCE-2812-6 CCE-3600-4 CCE-2559-3 TCP/IP NetBIOS Name Release on Request Prevented should be properly configured. CCE-2785-4 CCE-2817-5 CCE-3922-2 CCE-3118-7 TCP/IP SYN Flood Attack Protection should be properly configured. CCE-2679-9 CCE-3616-0 CCE-4085-7 CCE-2916-5 Security Audit log warning level should be properly configured. CCE-3181-5 CCE-3966-9 CCE-3061-9 Safe DLL Search Mode should be properly configured. CCE-3199-7 CCE-3778-8 CCE-2841-5 The built-in Administrator account should be correctly named. CCE-2714-4 CCE-2853-0 CCE-3899-2 CCE-3135-1 The built-in Guest account should be correctly named. CCE-2359-8 CCE-3743-2 CCE-4045-1 CCE-3025-4 The amount of idle time required before disconnecting a session should be set correctly. CCE-2519-7 CCE-3761-4 CCE-3921-4 CCE-3157-5 The "Audit the access of global system objects" policy should be set correctly. CCE-3285-4 CCE-3774-7 CCE-4049-3 CCE-3162-5 The "Audit the use of backup and restore privilege" policy should be set correctly. CCE-3303-5 CCE-3814-1 CCE-3476-9 CCE-2955-3 The "Disable CTRL+ALT+Delete Requirement for Logon" policy should be set correctly. CCE-3307-6 CCE-3060-1 CCE-3886-9 CCE-2891-0 The "Prevent Users from Installing Printer Drivers" policy should be set correctly. CCE-3325-8 CCE-3769-7 CCE-3675-6 CCE-2789-6 The "Restrict CD-ROM Access to Locally Logged-On User Only" policy should be set correctly. CCE-2858-9 CCE-3694-7 CCE-3529-5 CCE-2974-4 The "Restrict Floppy Access to Locally Logged-On User Only" policy should be set correctly. CCE-3168-2 CCE-2822-5 CCE-3185-6 CCE-2873-8 The "Secure Channel: Require Strong (Windows 2000 or later) Session Key" policy should be set correctly. CCE-3212-8 CCE-3478-5 CCE-3978-4 CCE-3151-8 The "Send Unencrypted Password to Connect to Third-Party SMB Servers" policy should be set correctly. CCE-2838-1 CCE-2870-4 CCE-3392-8 CCE-3049-4 The "Users Prompted to Change Password Before Expiration" policy should be set correctly. CCE-3230-0 CCE-3804-2 CCE-3098-1 CCE-2701-1 The "Shut Down system immediately if unable to log security audits" policy should be set correctly. CCE-3001-5 CCE-3430-6 CCE-4070-9 CCE-2851-4 The "Digitally Sign Client Communication (Always)" policy should be set correctly. CCE-3252-4 CCE-3652-5 CCE-3747-3 CCE-3027-0 The "Digitally Sign Client Communication (When Possible)" policy should be set correctly. CCE-2380-4 CCE-3994-1 CCE-2802-7 The "Digitally Sign Server Communication (Always)" policy should be set correctly. CCE-3023-9 CCE-3295-3 CCE-3783-8 CCE-3053-6 The "Digitally Sign Server Communication (When Possible)" policy should be set correctly. CCE-3164-1 CCE-3189-8 CCE-3928-9 CCE-2688-0 The "Number of Previous Logons to Cache" policy should be set correctly. CCE-2376-2 CCE-3709-3 CCE-3545-1 CCE-3106-2 The "Allowed to Format and Eject Removable NTFS Media" policy should be set correctly. CCE-3225-0 CCE-3586-5 CCE-4069-1 CCE-3111-2 The "Secure Channel: Digitally Encrypt or Sign Secure Channel Data (Always)" policy should be set correctly. CCE-3330-8 CCE-3731-7 CCE-3607-9 CCE-3097-3 The "Secure Channel: Digitally Encrypt Secure Channel Data (When Possible)" policy should be set correctly. CCE-2467-9 CCE-3370-4 CCE-3849-7 CCE-2996-7 The "Secure Channel: Digitally Sign Secure Channel Data (When Possible)" policy should be set correctly. CCE-3233-4 CCE-3511-3 CCE-4025-3 CCE-3000-7 The "Smart Card Removal Behavior" policy should be set correctly. CCE-3251-6 CCE-3674-9 CCE-3596-4 CCE-3133-6 The "Prevent System Maintenance of Computer Account Password" policy should be set correctly. CCE-3255-7 CCE-3145-0 CCE-2313-5 The "Limit local account user of blank passwords to console logon only" policy should be set correctly. CCE-2398-6 CCE-3357-1 CCE-2344-0 The "Allow undock without having to logon" policy should be set correctly. CCE-3326-6 CCE-3613-7 CCE-3009-8 The "Maximum machine account password age" policy should be set correctly. CCE-3075-9 CCE-2984-3 CCE-3018-9 The "Require Domain Controller authentication to unlock workstation" policy should be set correctly. CCE-3220-1 CCE-3504-8 CCE-3172-4 The "Disconnect clients when logon hours expire" policy should be set correctly. CCE-3361-3 CCE-3773-9 CCE-4786-0 CCE-2692-2 The "Do not allow storage of credentials or .NET Passports" policy should be set correctly. CCE-3379-5 CCE-3420-7 CCE-3088-2 The "Let Everyone permissions apply to anonymous users" policy should be set correctly. CCE-2457-0 CCE-3817-4 CCE-3110-4 The "Named Pipes that can be accessed anonymously" policy should be set correctly. CCE-3380-3 CCE-3711-9 CCE-3150-0 The "Remotely accessible registry paths" policy should be set correctly. CCE-2825-8 CCE-3729-1 CCE-3155-9 The "Shares that can be accessed anonymously" policy should be set correctly. CCE-3349-8 CCE-3592-3 CCE-3036-1 The "Sharing and security model for local accounts" policy should be set correctly. CCE-3367-0 CCE-3112-0 CCE-3058-5 The "Do not store LAN Manager hash value on next password change" policy should be set correctly. CCE-3138-5 CCE-3632-7 CCE-2993-4 The "Force logoff when logon hours expire" policy should be set correctly. CCE-3283-9 CCE-3719-2 CCE-3139-3 The "Current user screensaver timeout" policy should be set correctly. CCE-3050-2 CCE-3764-8 CCE-4000-6 CCE-2980-1 The "Always Prompt Client for Password upon Connection" policy should be set correctly for Terminal Services. CCE-3429-8 CCE-3666-5 CCE-2949-6 The "Allow Solicited Remote Assistance" policy should be set correctly for Terminal Services. CCE-3323-3 CCE-3599-8 CCE-3007-2 The "Allow Unsolicited Remote Assistance" policy should be set correctly for Terminal Services. CCE-3217-7 CCE-3617-8 CCE-3012-2 The "Configure Automatic Updates" should be set correctly CCE-3358-9 CCE-3740-8 The "Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box" should be set correctly CCE-3345-6 The "Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box" should be set correctly CCE-3363-9 The "No auto-restart for scheduled Automatic Updates installations CCE-2462-0 CCE-3277-1 The "Reschedule Automatic Updates scheduled installations" should be set correctly CCE-2852-2 CCE-3661-6 The "DCOM: Machine access Restrictions in Security Descriptor Definition Language (SDDL) syntax" setting should be configured correctly. CCE-3371-2 CCE-4799-3 CCE-3010-6 The "DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax" security option should be set correctly. CCE-3266-4 CCE-4689-6 CCE-2662-5 The "Display user information when the session is locked" setting should be configured correctly. CCE-3411-6 CCE-2917-3 The "Interactive logon: Requre smart card" setting should be configured correctly. CCE-2772-2 CCE-4768-8 CCE-3186-4 The "Network access: Restrict anonymous access to named pipes and shares" setting should be configured correctly. CCE-3292-0 CCE-2834-0 MSS:(TCPMaxConnectResponseRetransmission) SYN-ACK retansmissions when a connection request is not acknowledged CCE-3459-5 CCE-2213-7 MSS:(TCPMaxDataRetransmissions) How many times unacknowledged data is retransmitted CCE-3460-3 CCE-2239-2 MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames. CCE-3244-1 CCE-2683-1 RPC Endpiont Mapper Client Authentication (SP2 only) CCE-3394-4 CCE-2956-1 Restrictions for Unauthenticated RPC clients (SP2 only) CCE-3160-9 CCE-3273-0 Domain Profile: Protect all network connections (SP2 only) CCE-3054-4 CCE-3154-2 Domain Profile: Do not allow exceptions (SP2 only) CCE-3187-2 CCE-3194-8 Domain Profile: Allow local program exceptions CCE-3405-8 CCE-2828-2 Domain Profile: Allow remote administration CCE-3158-3 CCE-2476-0 Domain Profile: Allow file and printer sharing exception (SP2 only) CCE-3431-4 CCE-3247-4 Domain Profile: Allow Remote Desktop exception (SP2 only) CCE-3458-7 CCE-3304-3 Domain Profile: Allow UPnP framework exception (SP2 only) CCE-2964-5 CCE-3176-5 The "Windows Firewall: Prohibit notifications" setting should be configured correctly for the Domain Profile. CCE-3365-4 CCE-3198-9 The "Log Dropped Packets" option for the Windows Firewall should be configured correctly for the Domain Profile. CCE-3260-7 CCE-2965-2 The log file path and name for the Windows Firewall should be configured correctly for the Domain Profile. CCE-2533-8 CCE-2923-1 The log file size limit for the Windows Firewall should be configured correctly for the Domain Profile. CCE-3299-5 CCE-2958-7 The "Log Successful Connections" option for the Windows Firewall should be configured correctly for the Domain Profile. CCE-3414-0 CCE-3090-8 Unicast response to multicast or broadcast requests should be enabled or disabled as appropriate for the Domain Profile. CCE-3436-3 CCE-2972-8 Domain Profile: Define port exceptions (SP2 only) CCE-3202-9 CCE-2866-2 Domain Profile: Allow local port exceptions (SP2 only) CCE-3180-7 CCE-3258-1 Standard Profile: Protect all network connections (SP2 only) CCE-3329-0 CCE-3284-7 Standard Profile: Do not allow exceptions (SP2 only) CCE-3347-2 CCE-3179-9 Standard Profile: Allow local program exceptions (SP2 only) CCE-3334-0 CCE-3183-1 Standard Profile: Allow remote administration exception (SP2 only) CCE-3352-2 CCE-2954-6 Standard Profile: Allow file and printer sharing exception (SP2 only) CCE-3369-6 CCE-3262-3 Standard Profile: Allow Remote Desktop exception (SP2 only) CCE-3387-8 CCE-3213-6 Standard Profile: Allow UPnP framework exception (SP2 only) CCE-3268-0 CCE-3235-9 The "Windows Firewall: Prohibit notifications" setting should be configured correctly for the Standard Profile. CCE-3409-0 CCE-3134-4 Unicast response to multicast or broadcast requests should be enabled or disabled as appropriate for the Standard Profile. CCE-3440-5 CCE-3103-9 Standard Profile: Define port exceptions (SP2 only) CCE-3462-9 CCE-3231-8 Standard Profile: Allow local port exceptions (SP2 only) CCE-3356-3 CCE-2989-2 Domain Profile - Inbound Connections CCE-2999-1 Domain Profile - Outbound Connections CCE-3439-7 Domain Profile - Apply Local Firewall Rules CCE-3457-9 Domain Profile - Apply Local Connection Security Rules CCE-2977-7 CCE-3452-0 CCE-5053-4 Private Profile- Firewall State CCE-3373-8 Private Profile - Inbound Connections CCE-3395-1 Private Profile - Outbound Connections CCE-3166-6 User notifications when a program is blocked from receiving inbound connections by Windows Firewall should be enabled or disabled as appropriate for the Private Profile. CCE-3417-3 Unicast response to multicast or broadcast requests should be enabled or disabled as appropriate for the Private Profile. CCE-2924-9 Private Profile - Apply Local Firewall Rules CCE-3360-5 Private Profile - Apply Local Connection Security Rules CCE-2854-8 Public Profile- Firewall State CCE-3246-6 Public Profile - Inbound Connections CCE-3263-1 Public Profile - Outbound Connections CCE-3351-4 User notifications when a program is blocked from receiving inbound connections by Windows Firewall should be enabled or disabled as appropriate for the Public Profile. CCE-2998-3 Unicast response to multicast or broadcast requests should be enabled or disabled as appropriate for the Public Profile. CCE-2641-9 Public Profile - Apply Local Firewall Rules CCE-2650-0 Public Profile - Apply Local Connection Security Rules CCE-3426-4 Logon - Do not process the legacy run list CCE-3320-9 Logon - Do not process the run once list CCE-3086-6 CCE-5032-8 Turn off Internet download for Web publishing and online ordering wizards CCE-3364-7 CCE-5099-7 Turn off the Windows Messenger Customer Experience Improvement Program CCE-3259-9 CCE-4224-2 Turn off Search Companion content file updates CCE-2778-9 CCE-5055-9 Turn off printing over HTTP CCE-3421-5 CCE-4513-8 Turn off downloading of print drivers over HTTP CCE-2754-0 CCE-5200-1 Turn off Windows Update device driver searching CCE-3278-9 CCE-5014-6 Enumerate administrator accounts on elevation CCE-2471-1 Require trusted path for credential entry CCE-3310-0 Deny all add-ons unless specifically allowed in the Add-on List CCE-3327-4 The "Do not allow passwords to be saved" setting should be configured correctly for Terminal Services. CCE-2975-1 CCE-4849-6 The "Do not allow drive redirection" setting should be configured correctly for Terminal Services. CCE-2874-6 CCE-4501-3 Access to registry editing tools is set correctly. CCE-3415-7 Prompt for password on resume from hibernate/suspend is set correctly. CCE-3169-0 CCE-4390-1 Do not preserve zone information in file attachments is set correcly. CCE-3437-1 CCE-4412-3 Hide mechanisms to remove zone information is set correcly. CCE-2979-3 CCE-5042-7 Notify antivirus programs when opening attachments is set correcly. CCE-3300-1 CCE-5059-1 Outlook Express attachment blocking is set correctly. CCE-3305-0 Audit: Force audit policy subcategory settings are set correcly. CCE-3450-4 The "Log Access For Setup Log" setting should be configured correctly. CCE-3102-1 The startup type of the Windows Search service should be configured correctly. CCE-3388-6 The startup type of Microsoft Peer-to-Peer Networking Services should be configured correctly. CCE-3270-6 CCE-5194-6 The "Prohibit Access of the Windows Connect Now Wizards" setting should be configured correctly. CCE-3045-2 The "Allow remote access to the PnP interface" setting should be configured correctly. CCE-3331-6 The "Do not create system restore point when new device driver installed" setting should be configured correctly. CCE-3464-5 The "Do not send a Windows Error Report when a generic driver is installed on a device" setting should be configured correctly. CCE-3468-6 The "Turn Off Access to All Windows Update Feature" setting should be configured correctly. CCE-3362-1 The "Turn Off Automatic Root Certificates Update" setting should be configured correctly. CCE-3454-6 CCE-5054-2 The "Turn Off Event Views 'Events.asp' Links" setting should be configured correctly. CCE-3348-0 CCE-4953-6 The "Turn Off Handwriting Reconition Error Reporting" setting should be configured correctly. CCE-2868-8 The "Turn Off Help and Support Center "Did You Know?" Content" setting should be configured correctly. CCE-2877-9 The "Turn Off Help and Support Center Microsoft Knowledge Base Search" setting should be configured correctly. CCE-3406-6 The "Turn Off Internet Connection Wizard if URL Connection is Referring to Microsoft.com" setting should be configured correctly. CCE-3432-2 CCE-4707-6 The "Turn Off Internet File Association Service" setting should be configured correctly. CCE-2697-1 CCE-5121-9 The "Turn Off Registration if URL Connection is Referring to Microsoft.com" setting should be configured correctly. CCE-3093-2 CCE-4641-7 The "Turn Off the 'Order Prints' Picture Task" setting should be configured correctly. CCE-3115-3 CCE-5072-4 The "Turn off the 'Publish to Web' task for files and folders" setting should be configured correctly. CCE-2477-8 CCE-4887-6 The "Turn Off Windows Movies Maker Automatic Codec Downloads" setting should be configured correctly. CCE-3403-3 CCE-4242-4 The "Turn Off Windows Movie Maker Online Web Links" setting should be configured correctly. CCE-3297-9 CCE-4732-4 The "Turn Off Windows Movie Maker Saving to Online Video Hosting Provider" setting should be configured correctly. CCE-3385-2 CCE-4997-3 The "Don't Display the Getting Started Welcome Screen at Logon" setting should be configured correctly. CCE-2781-3 CCE-5160-7 The "Turn off Windows Startup Sound" setting should be configured correctly. CCE-2922-3 The "Require a Password when a Computer Wakes (On Battery)" setting should be configured correctly. CCE-2821-7 The "Require a Password when a Computer Wakes (Plugged)" setting should be configured correctly. CCE-3469-4 The "Allow only Vista or later connections" setting should be configured correctly. CCE-2742-5 The "Customization Warning Messages" setting should be configured correctly. CCE-2887-8 The "Turn on bandwidth optimization" setting should be configured correctly. CCE-3407-4 The "Turn on session logging" setting should be configured correctly. CCE-3271-4 The "Prevent IIS Installation" setting should be configured correctly. CCE-3288-8 CCE-4262-2 The "Turn off Active Help" setting should be configured correctly. CCE-3434-8 The "Turn off Untrusted Content" setting should be configured correctly. CCE-3046-0 The "Turn off downloading of enclosures" setting should be configured correctly. CCE-3477-7 CCE-4581-5 The "Allow indexing of encrypted files" setting should be configured correctly. CCE-3376-1 The "Prevent indexing uncached Exchange folders" setting should be configured correctly. CCE-3143-5 The "Turn off Windows Calendar" setting should be configured correctly. CCE-2914-0 The "Allow Corporate redirection of Customer Experience Improvement uploads" setting should be configured correctly. CCE-3178-1 The "Turn off Windows Defender" setting should be configured correctly. CCE-3209-4 The "Turn off Heap termination on corruption" setting should be configured correctly. CCE-2962-9 The "Turn off shell protocol protected mode" setting should be configured correctly. CCE-3125-2 CCE-4270-5 The "Prohibit non-administrators from applying vendor signed updates" setting should be configured correctly. CCE-3398-5 CCE-5025-2 The "Report Logon Server Not Available During User logon" setting should be configured correctly. CCE-3341-5 The "Turn off the communitication features" setting should be configured correctly. CCE-2521-3 The "Turn off Windows Mail application" setting should be configured correctly. CCE-2525-4 The "Prevent Windows Media DRM Internet Access" setting should be configured correctly. CCE-3486-8 The "Turn off Windows Meeting Space" setting should be configured correctly. CCE-2557-7 The "Turn on Windows Meeting Space audting" setting should be configured correctly. CCE-3328-2 The "Disable unpacking and installation of gadgets that are not digitally signed" setting should be configured correctly. CCE-3456-1 The "Override the More Gadgets Link" setting should be configured correctly. CCE-3214-4 The "Turn Off User Installed Windows Sidebar Gadgets" setting should be configured correctly. CCE-3500-6 The "Do not allow Digital Locker to run" setting should be configured correctly. CCE-3482-7 The "Turn Off Downloading of Game Information" setting should be configured correctly. CCE-2755-7 The "IPv6 Block of Protocols 41" setting should be configured correctly. CCE-2865-4 The "IPv6 Block of UDP 3544" setting should be configured correctly. CCE-3508-9 The "Enforce user logon restrictions" policy should be set correctly. CCE-4662-3 CCE-3700-2 CCE-4645-8 CCE-3188-0 The "Maximum Service Ticket Litfetime" policy should be set correctly. CCE-4666-4 CCE-3237-5 CCE-4865-2 CCE-2708-6 The "Maximum User Ticket Lifetime" policy should be set correctly. CCE-3936-2 CCE-3625-1 CCE-4750-6 CCE-2803-5 The "Maximum User Renewal Lifetime" policy should be set correctly. CCE-4755-5 CCE-4684-7 CCE-3063-5 The "Maximum tolerance for computer clock synchronization" policy should be set correctly. CCE-4702-7 CCE-3396-9 CCE-4715-9 CCE-3208-6 TCP/IP PMTU Discovery should be properly configured. CCE-3949-5 CCE-3739-0 CCE-3939-6 CCE-3017-1 Kerberos and RSVP Traffic Protected by IPSec should be properly configured. CCE-4904-9 CCE-3942-0 CCE-3044-5 The "Remotely accessible registry paths and subpaths" policy should be set correctly. CCE-4781-1 The "LAN Manager Authentication Level" policy should be set correctly. CCE-4922-1 CCE-3703-6 CCE-4014-7 CCE-2926-4 The "LDAP client signing requirements" policy should be set correctly. CCE-4940-3 CCE-2819-1 CCE-2991-8 The "Minimum session security for NTLM SSP based clients" policy should be set correctly. CCE-4583-1 CCE-3614-5 CCE-3156-7 The "Minimum session security for NTLM SSP based servers" policy should be set correctly. CCE-4213-5 CCE-3759-8 CCE-2799-5 The "Recovery Console: Allow Automatic Administrative Logon" policy should be set correctly. CCE-4107-9 CCE-3659-0 CCE-4067-5 CCE-2935-5 The "Recovery Console: Allow Floppy Copy and Access to All Drives and All Folders" policy should be set correctly. CCE-3953-7 CCE-3676-4 CCE-3463-7 CCE-2957-9 The "Allow System to be Shut Down Without Having to Log On" policy should be set correctly. CCE-3954-5 CCE-3448-8 CCE-3629-3 CCE-2983-5 The "Clear Virtual Memory Pagefile at shutdown" policy should be set correctly. CCE-3969-3 CCE-3593-1 CCE-3333-2 CCE-3128-6 The "Use FIPS compliant algorithms for encryption, hashing, and signing" policy should be set correctly. CCE-4774-6 CCE-3441-3 CCE-3084-1 The "Require Case Insensitivity for Non-Windows Sybsystems" policy should be set correctly. CCE-4841-3 CCE-3714-3 CCE-2987-6 The "Strengthen Default Permissions of Global System Objects" policy should be set correctly. CCE-4011-3 CCE-2963-7 CCE-3956-0 CCE-3005-6 The "User Account Control: Admin Approval Mode for the Built-in Administrator account" setting should be configured correctly. CCE-4955-1 The "Behavior of the elevation prompt for administrators in Admin Approval Mode" setting should be configured correctly. CCE-4016-2 The "Behavior of the elevation prompt for standard users" setting should be configured correctly. CCE-4969-2 The "User Account Control: Detect application installations and prompt for elevation" setting should be configured correctly. CCE-4612-8 The "User Account Control: Only elevate executables that are signed and validated" setting should be configured correctly. CCE-5004-7 The "User Account Control: Only elevate UIAccess applications that are installed in secure locations" setting should be configured correctly. CCE-4020-4 The "User Account Control: Run all administrators in Admin Approval Mode" setting should be configured correctly. CCE-4907-2 The "User Account Control: Switch to the secure desktop when prompting for elevation" setting should be configured correctly. CCE-4925-4 The "User Account Control: Virtualize file and registry write failures to per-user locations" setting should be configured correctly. CCE-4194-7 The "access this computer from the network" user right should be assigned to the correct accounts. CCE-4334-9 CCE-3322-5 CCE-3917-2 CCE-2379-6 The "act as part of the operating system" user right should be assigned to the correct accounts. CCE-4088-1 CCE-3490-0 CCE-3736-6 CCE-2167-5 The "adjust memory quotas for a process" user right should be assigned to the correct accounts. CCE-4854-6 CCE-3147-6 CCE-3688-9 CCE-2547-8 The "log on locally" user right should be assigned to the correct accounts. CCE-4872-8 CCE-3557-6 CCE-3238-3 CCE-2829-0 The "allow logon through Terminal Services" user right should be assigned to the correct accounts. CCE-4264-8 CCE-3499-1 CCE-3004-9 The "back up files and directories" user right should be assigned to the correct accounts. CCE-4827-2 CCE-2869-6 CCE-3393-6 CCE-2299-6 The "bypass traverse checking" user right should be assigned to the correct accounts. CCE-4973-4 CCE-3375-3 CCE-3653-3 CCE-2806-8 The "change the system time" user right should be assigned to the correct accounts. CCE-4863-7 CCE-3397-7 CCE-3296-1 CCE-2846-4 The "Change the time zone" user right should be assigned to the appropriate accounts. CCE-5008-8 The "create a pagefile" user right should be assigned to the correct accounts. CCE-4757-1 CCE-3538-6 CCE-3943-8 CCE-2786-2 The "Create a token object" user right should be assigned to the correct accounts. CCE-4902-3 CCE-3498-3 CCE-3860-4 CCE-2791-2 The "Create global objects" user right should be assigned to the correct accounts. CCE-4792-8 CCE-4790-2 CCE-3107-0 The "create permanent shared objects" user right should be assigned to the correct accounts. CCE-4184-8 CCE-3269-8 CCE-3767-1 CCE-1969-5 The "debug programs" user right should be assigned to the correct accounts. CCE-4687-0 CCE-2576-7 CCE-3772-1 CCE-2864-7 The "deny access to this computer from the network" user right should be assigned to the correct accounts. CCE-4704-3 CCE-3062-7 CCE-3503-0 CCE-1978-6 The "deny logon as a batch job" user right should be assigned to the correct accounts. CCE-4722-5 CCE-2649-2 CCE-4156-6 CCE-2898-5 The "deny logon as a service" user right should be assigned to the correct accounts. CCE-4867-8 CCE-3543-6 CCE-4235-8 CCE-2792-0 The "deny logon locally" user right should be assigned to the correct accounts. CCE-4889-2 CCE-3531-1 CCE-3489-2 CCE-2700-3 The "deny logon through Terminal Services" user right should be assigned to the correct accounts. CCE-4656-5 CCE-3438-9 CCE-2814-2 The "force shutdown from a remote system" user right should be assigned to the correct accounts. CCE-4673-0 CCE-3359-7 CCE-3904-0 CCE-2886-0 The "generate security audits" user right should be assigned to the correct accounts. CCE-4488-3 CCE-3491-8 CCE-3811-7 CCE-2767-2 The "Impersonate a client after authentication" user right should be assigned to the correct accounts. CCE-4382-8 CCE-4332-3 CCE-2737-5 The "Increase a Process Working Set" setting should be configured correctly. CCE-4651-6 The "increase scheduling priority" user right should be assigned to the correct accounts. CCE-4796-9 CCE-3539-4 CCE-3630-1 CCE-2944-7 The "load and unload device drivers" user right should be assigned to the correct accounts. CCE-4034-5 CCE-3293-8 CCE-3798-6 CCE-2446-3 The "lock pages in memory" user right should be assigned to the correct accounts. CCE-4317-4 CCE-2936-3 CCE-3317-5 CCE-2609-6 The "log on as a batch job" user right should be assigned to the correct accounts. CCE-4083-2 CCE-3191-4 CCE-3965-1 CCE-2882-9 The "log on as a service" user right should be assigned to the correct accounts. CCE-4038-6 CCE-3332-4 CCE-3877-8 CCE-2948-8 The "manage auditing and security log" user right should be assigned to the correct accounts. CCE-4046-9 CCE-3575-8 CCE-3507-1 CCE-2247-5 The "Modify an object label" user right should be assigned to the appropriate accounts. CCE-4285-3 The "modify firmware environment values" user right should be assigned to the correct accounts. CCE-4048-5 CCE-3218-5 CCE-3903-2 CCE-2657-5 The "perform volume maintenance tasks" user right should be assigned to the correct accounts. CCE-4071-7 CCE-3319-1 CCE-2960-3 The "profile single process" user right should be assigned to the correct accounts. CCE-4962-7 CCE-2861-3 CCE-3926-3 CCE-2807-6 The "profile system performance" user right should be assigned to the correct accounts. CCE-4618-5 CCE-3002-3 CCE-3445-4 CCE-2675-7 The "remove computer from docking station" user right should be assigned to the correct accounts. CCE-4861-1 CCE-2663-3 CCE-3829-9 CCE-2335-8 The "replace a process-level token" user right should be assigned to the correct accounts. CCE-4372-9 CCE-3447-0 CCE-3970-1 CCE-2860-5 The "restore files and directories" user right should be assigned to the correct accounts. CCE-4948-6 CCE-3465-2 CCE-3912-3 CCE-2847-2 The "shut down the system" user right should be assigned to the correct accounts. CCE-4569-0 CCE-3346-4 CCE-3934-7 CCE-2366-3 The "synchronize directory service data" user right should be assigned to the correct accounts. CCE-4970-0 CCE-3368-8 CCE-3850-5 CCE-2810-0 The "take ownership of files or other objects" user right should be assigned to the correct accounts. CCE-4988-2 CCE-2848-0 CCE-3471-0 CCE-2021-4 The required permissions for the WLAN AutoConfig service should be assigned. CCE-4627-6 The "Turn on Responder (RSPNDR) driver" setting should be configured correctly for the domain profile. CCE-4077-4 Installation and Configuration of Network Bridge on the DNS Domain Network should be properly configured. CCE-4152-5 CCE-3443-9 CCE-2173-3 The "Prohibit use of Internet Connection Firewall on your DNS domain network" setting should be configured correctly. CCE-5020-3 CCE-5022-9 The startup type of the Internet Connection Sharing service should be correct. CCE-4078-2 CCE-2678-1 CCE-3554-3 CCE-3026-2 The "Configuration of wireless settings using Windows Connect Now" setting should be configured correctly for Wireless Connect Now over Ethernet (UPnP). CCE-5061-7 The "Internet Explorer Maintenance Policy Processing - Allow processing across a slow network connection" setting should be configured correctly. CCE-4081-6 CCE-4665-6 The "Enable Error Reporting" policy should be set correctly. CCE-4694-6 CCE-3758-0 CCE-3038-7 Use Classic Logon should be properly configured. CCE-4813-2 CCE-3100-5 The 'Approved Installation Sites for ActiveX Controls' security mechanism should be enabled or disabled as appropriate. CCE-4579-9 The setup log maximum size should be configured correctly. CCE-4086-5 The "Set Client connection Encryption Level" policy should be set correctly for Terminal Services. CCE-4866-0 CCE-3812-5 CCE-3116-1 The "Set time limit for disconnected sessions" policy should be set correctly for Terminal Services. CCE-5007-0 CCE-2875-3 CCE-2961-1 The "Set time limit for idle sessions" policy should be set correctly for Terminal Services. CCE-4267-1 CCE-3665-7 CCE-3124-5 Computer-wide, rather than per-user, use of Microsoft Spynet Reporting for Windows Defender should be enabled or disabled as appropriate. CCE-4761-3 The "Disable Logging" setting should be configured correctly. CCE-4915-5 The "Disable Windows Error Reporting" setting should be configured correctly. CCE-5034-4 The "Display Error Notification" setting should be configured correctly. CCE-4919-7 CCE-5136-7 The "Do not send additional data" setting should be configured correctly. CCE-4089-9 The "Set Safe for Scripting" policy should be set correctly. CCE-4991-6 CCE-4108-7 CCE-2830-8 The "Enable User Control Over Installs" policy should be set correctly. CCE-4629-2 CCE-3547-7 CCE-3861-2 CCE-3094-0 The "Do Not Show First Use Dialog Boxes" setting for Windows Media Player should be configured correctly. CCE-4405-7 CCE-4791-0 The "Disable Media Player for automatic updates" policy should be set correctly. CCE-4898-3 CCE-3720-0 CCE-2826-6 The "Prevent Desktop Shortcut Creation" setting for Windows Media Player should be configured correctly. CCE-5052-6 CCE-4482-6 The "Do Not Automatically Start Windows Messenger" policy should be set correctly. CCE-4797-7 CCE-3306-8 CCE-2455-4 The "Current user screensaver secure" policy should be set correctly. CCE-4290-3 CCE-3781-2 CCE-4145-9 CCE-4500-5 The "Prevent users from sharing files within their profile" setting should be configured correctly. CCE-5070-8 Auditing of "Account Management: Application Group Management" events on success should be enabled or disabled as appropriate. CCE-4938-7 Auditing of "Account Management: Application Group Management" events on failure should be enabled or disabled as appropriate. CCE-4700-1 Auditing of "Account Management: Computer Account Management" events on success should be enabled or disabled as appropriate. CCE-4093-1 Auditing of "Account Management: Computer Account Management" events on failure should be enabled or disabled as appropriate. CCE-4228-3 Auditing of "Account Management: Distribution Group Management" events on success should be enabled or disabled as appropriate. CCE-4115-2 Auditing of "Account Management: Distribution Group Management" events on failure should be enabled or disabled as appropriate. CCE-4140-0 Auditing of "Account Management: Other Account Management Events" events on success should be enabled or disabled as appropriate. CCE-4916-3 Auditing of "Account Management: Other Account Management Events" events on failure should be enabled or disabled as appropriate. CCE-4783-7 Auditing of "Account Management: Security Group Management" events on success should be enabled or disabled as appropriate. CCE-5048-4 Auditing of "Account Management: Security Group Management" events on failure should be enabled or disabled as appropriate. CCE-4142-6 Auditing of "Account Management: User Account Management" events on success should be enabled or disabled as appropriate. CCE-4833-0 Auditing of "Account Management: User Account Management" events on failure should be enabled or disabled as appropriate. CCE-5097-1 Auditing of "Detailed Tracking: DPAPI Activity" events on success should be enabled or disabled as appropriate. CCE-5000-5 Auditing of "Detailed Tracking: DPAPI Activity" events on failure should be enabled or disabled as appropriate. CCE-4493-3 Auditing of "Detailed Tracking: Process Creation" events on success should be enabled or disabled as appropriate. CCE-4166-5 Auditing of "Detailed Tracking: Process Creation" events on failure should be enabled or disabled as appropriate. CCE-5094-8 Auditing of "Detailed Tracking: Process Termination" events on success should be enabled or disabled as appropriate. CCE-4869-4 Auditing of "Detailed Tracking: Process Termination" events on failure should be enabled or disabled as appropriate. CCE-4363-8 Auditing of "Detailed Tracking: RPC Events" events on success should be enabled or disabled as appropriate. CCE-4891-8 Auditing of "Detailed Tracking: RPC Events" events on failure should be enabled or disabled as appropriate. CCE-4759-7 Auditing of "DS Access: Detailed Directory Service Replication" events on success should be enabled or disabled as appropriate. CCE-5023-7 Auditing of "DS Access: Detailed Directory Service Replication" events on failure should be enabled or disabled as appropriate. CCE-4658-1 Auditing of "DS Access: Directory Service Access" events on success should be enabled or disabled as appropriate. CCE-5028-6 Auditing of "DS Access: Directory Service Access" events on failure should be enabled or disabled as appropriate. CCE-4931-2 Auditing of "DS Access: Directory Service Changes" events on success should be enabled or disabled as appropriate. CCE-5067-4 Auditing of "DS Access: Directory Service Changes" events on failure should be enabled or disabled as appropriate. CCE-4808-2 Auditing of "DS Access: Directory Service Replication" events on success should be enabled or disabled as appropriate. CCE-5089-8 Auditing of "DS Access: Directory Service Replication" events on failure should be enabled or disabled as appropriate. CCE-4176-4 Auditing of "Logon/Logoff: Account Lockout" events on success should be enabled or disabled as appropriate. CCE-4342-2 Auditing of "Logon/Logoff: Account Lockout" events on failure should be enabled or disabled as appropriate. CCE-4857-9 Auditing of "Logon/Logoff: IPsec Extended Mode" events on success should be enabled or disabled as appropriate. CCE-5011-2 Auditing of "Logon/Logoff: IPsec Extended Mode" events on failure should be enabled or disabled as appropriate. CCE-4505-4 Auditing of "Logon/Logoff: IPsec Main Mode" events on success should be enabled or disabled as appropriate. CCE-5016-1 Auditing of "Logon/Logoff: IPsec Main Mode" events on failure should be enabled or disabled as appropriate. CCE-4650-8 Auditing of "Logon/Logoff: IPsec Quick Mode" events on success should be enabled or disabled as appropriate. CCE-5038-5 Auditing of "Logon/Logoff: IPsec Quick Mode" events on failure should be enabled or disabled as appropriate. CCE-4928-8 Auditing of "Logon/Logoff: Logoff" events on success should be enabled or disabled as appropriate. CCE-4703-5 Auditing of "Logon/Logoff: Logoff" events on failure should be enabled or disabled as appropriate. CCE-4183-0 Auditing of "Logon/Logoff: Logon" events on success should be enabled or disabled as appropriate. CCE-5018-7 Auditing of "Logon/Logoff: Logon" events on failure should be enabled or disabled as appropriate. CCE-4423-0 Auditing of "Logon/Logoff: Other Logon/Logoff Events" events on success should be enabled or disabled as appropriate. CCE-5163-1 Auditing of "Logon/Logoff: Other Logon/Logoff Events" events on failure should be enabled or disabled as appropriate. CCE-5066-6 Auditing of "Logon/Logoff: Special Logon" events on success should be enabled or disabled as appropriate. CCE-4956-9 Auditing of "Logon/Logoff: Special Logon" events on failure should be enabled or disabled as appropriate. CCE-4824-9 Auditing of "Object Access: Application Generated" events on success should be enabled or disabled as appropriate. CCE-5084-9 Auditing of "Object Access: Application Generated" events on failure should be enabled or disabled as appropriate. CCE-4829-8 Auditing of "Object Access: Certification Services" events on success should be enabled or disabled as appropriate. CCE-4714-2 Auditing of "Object Access: Certification Services" events on failure should be enabled or disabled as appropriate. CCE-4868-6 Auditing of "Object Access: File Share" events on success should be enabled or disabled as appropriate. CCE-4200-2 Auditing of "Object Access: File Share" events on failure should be enabled or disabled as appropriate. CCE-5145-8 Auditing of "Object Access: File System" events on success should be enabled or disabled as appropriate. CCE-4921-3 Auditing of "Object Access: File System" events on failure should be enabled or disabled as appropriate. CCE-5039-3 Auditing of "Object Access: Filtering Platform Connection" events on success should be enabled or disabled as appropriate. CCE-4568-2 Auditing of "Object Access: Filtering Platform Connection" events on failure should be enabled or disabled as appropriate. CCE-5079-9 Auditing of "Object Access: Filtering Platform Packet Drop" events on success should be enabled or disabled as appropriate. CCE-4947-8 Auditing of "Object Access: Filtering Platform Packet Drop" events on failure should be enabled or disabled as appropriate. CCE-4335-6 Auditing of "Object Access: Handle Manipulation" events on success should be enabled or disabled as appropriate. CCE-4828-0 Auditing of "Object Access: Handle Manipulation" events on failure should be enabled or disabled as appropriate. CCE-4965-0 Auditing of "Object Access: Kernel Object" events on success should be enabled or disabled as appropriate. CCE-4996-5 Auditing of "Object Access: Kernel Object" events on failure should be enabled or disabled as appropriate. CCE-4885-0 Auditing of "Object Access: Other Object Access Events" events on success should be enabled or disabled as appropriate. CCE-5132-6 Auditing of "Object Access: Other Object Access Events" events on failure should be enabled or disabled as appropriate. CCE-4691-2 Auditing of "Object Access: Registry" events on success should be enabled or disabled as appropriate. CCE-4594-8 Auditing of "Object Access: Registry" events on failure should be enabled or disabled as appropriate. CCE-5087-2 Auditing of "Object Access: SAM" events on success should be enabled or disabled as appropriate. CCE-4616-9 Auditing of "Object Access: SAM" events on failure should be enabled or disabled as appropriate. CCE-4982-5 Auditing of "Policy Change: Audit Policy Change" events on success should be enabled or disabled as appropriate. CCE-4201-0 Auditing of "Policy Change: Audit Policy Change" events on failure should be enabled or disabled as appropriate. CCE-5137-5 Auditing of "Policy Change: Authentication Policy Change" events on success should be enabled or disabled as appropriate. CCE-4877-7 Auditing of "Policy Change: Authentication Policy Change" events on failure should be enabled or disabled as appropriate. CCE-4516-1 Auditing of "Policy Change: Authorization Policy Change" events on success should be enabled or disabled as appropriate. CCE-5172-2 Auditing of "Policy Change: Authorization Policy Change" events on failure should be enabled or disabled as appropriate. CCE-5058-3 Auditing of "Policy Change: Filtering Platform Policy Change" events on success should be enabled or disabled as appropriate. CCE-5177-1 Auditing of "Policy Change: Filtering Platform Policy Change" events on failure should be enabled or disabled as appropriate. CCE-4939-5 Auditing of "Policy Change: MPSSVC Rule-Level Policy Change" events on success should be enabled or disabled as appropriate. CCE-5181-3 Auditing of "Policy Change: MPSSVC Rule-Level Policy Change" events on failure should be enabled or disabled as appropriate. CCE-4204-4 Auditing of "Policy Change: Other Policy Change Events" events on success should be enabled or disabled as appropriate. CCE-4479-2 Auditing of "Policy Change: Other Policy Change Events" events on failure should be enabled or disabled as appropriate. CCE-4995-7 Auditing of "Privilege Use: Non Sensitive Privilege Use" events on success should be enabled or disabled as appropriate. CCE-5114-4 Auditing of "Privilege Use: Non Sensitive Privilege Use" events on failure should be enabled or disabled as appropriate. CCE-4990-8 Auditing of "Privilege Use: Other Privilege Use Events" events on success should be enabled or disabled as appropriate. CCE-5131-8 Auditing of "Privilege Use: Privilege Use: Other Privilege Use Events" events on failure should be enabled or disabled as appropriate. CCE-4205-1 Auditing of "Privilege Use: Sensitive Privilege Use" events on success should be enabled or disabled as appropriate. CCE-4300-0 Auditing of "Privilege Use: Sensitive Privilege Use" events on failure should be enabled or disabled as appropriate. CCE-4734-0 Auditing of "System: Ipsec Driver" events on success should be enabled or disabled as appropriate. CCE-4976-7 Auditing of "System: Ipsec Driver" events on failure should be enabled or disabled as appropriate. CCE-4879-3 Auditing of "System: Other System Events" events on success should be enabled or disabled as appropriate. CCE-4998-1 Auditing of "System: Other System Events" events on failure should be enabled or disabled as appropriate. CCE-4883-5 Auditing of "System: Security State Change" events on success should be enabled or disabled as appropriate. CCE-4535-1 Auditing of "System: Security State Change" events on failure should be enabled or disabled as appropriate. CCE-5157-3 Auditing of "System: Security System Extension" events on success should be enabled or disabled as appropriate. CCE-5170-6 Auditing of "System: Security System Extension" events on failure should be enabled or disabled as appropriate. CCE-4910-6 Auditing of "System: System Integrity" events on success should be enabled or disabled as appropriate. CCE-5047-6 Auditing of "System: System Integrity" events on failure should be enabled or disabled as appropriate. CCE-4822-3 User notifications when a program is blocked from receiving inbound connections by Windows Firewall should be enabled or disabled as appropriate for the Domain Profile. CCE-4941-1 The "Log Dropped Packets" option for the Windows Firewall should be configured correctly for the Private Profile. CCE-4597-1 The "Log Successful Connections" option for the Windows Firewall should be configured correctly for the Private Profile. CCE-4963-5 The log file path and name for the Windows Firewall should be configured correctly for the Private Profile. CCE-4206-9 The log file size limit for the Windows Firewall should be configured correctly for the Private Profile. CCE-4207-7 The "Log Dropped Packets" option for the Windows Firewall should be configured correctly for the Public Profile. CCE-4507-0 The "Log Successful Connections" option for the Windows Firewall should be configured correctly for the Public Profile. CCE-5128-4 The log file path and name for the Windows Firewall should be configured correctly for the Public Profile. CCE-4639-1 The log file size limit for the Windows Firewall should be configured correctly for the Public Profile. CCE-4278-8 The ISATAP tunneling protocol for IPv6 should be enabled or disabled as appropriate. CCE-5146-6 The 6to4 tunneling protocol for IPv6 should be enabled or disabled as appropriate. CCE-5036-9 The Teredo tunneling protocol for IPv6 should be enabled or disabled as appropriate. CCE-4811-6 The "Turn off Help Experience Improvement Program" setting should be configured correctly. CCE-5239-9 The "Turn off Help Ratings" setting should be configured correctly. CCE-4851-2 The "Create Symbolic Links" user right should be assigned to the appropriate accounts. CCE-4294-5 The "enable computer and user accounts to be trusted for delegation" user right should be assigned to the correct accounts. CCE-3473-6 CCE-3282-1 CCE-2982-7 The "add workstations to domain" user right should be assigned to the correct accounts. CCE-3354-8 CCE-3542-8 CCE-2374-7 The "Allow System to be Shut Down Without Having to Log On" policy should be set correctly. CCE-2884-5 CCE-3959-4 If the Application log's retention method is set to "Overwrite events by days," an appropriate value should be set for the number of days' logs to keep. CCE-3567-5 CCE-3444-7 CCE-3019-7 If the Security log's retention method is set to "Overwrite events by days," an appropriate value should be set for the number of days' logs to keep. CCE-3127-8 CCE-3968-5 CCE-2966-0 If the System log's retention method is set to "Overwrite events by days," an appropriate value should be set for the number of days' logs to keep. CCE-3512-1 CCE-3823-2 CCE-2050-3 The startup type of the Alerter service should be correct. CCE-3635-0 CCE-3372-0 CCE-3034-6 The startup type of the Automatic Update service should be correct. CCE-2671-6 CCE-2937-1 The startup type of the Background Intelligent Transfer Service (BITS) service should be correct. CCE-3200-3 CCE-2818-3 The startup type of the ClipBook service should be correct. CCE-3350-6 CCE-3892-7 CCE-2713-6 The startup type of the Fax service should be correct. CCE-3565-9 CCE-3059-3 CCE-2849-8 The startup type of the FTP Publishing service should be correct. CCE-3582-4 CCE-3830-7 CCE-2888-6 The startup type of the IIS Admin service should be correct. CCE-3353-0 CCE-3835-6 CCE-3016-3 The startup type of the Indexing service should be correct. CCE-3618-6 CCE-4794-4 CCE-2910-8 The startup type of the .NET Framework service should be correct. CCE-3640-0 CCE-4764-7 CCE-2053-7 The startup type of the Print Services for Unix service should be correct. CCE-3552-7 CCE-2280-6 The startup type of the Remote Access Auto connection Manager service should be correct. CCE-3428-0 CCE-4539-3 CCE-2940-5 The startup type of the Remote Desktop Help Session Manager service should be correct. CCE-3556-8 CCE-2255-8 The startup type of the Remote Registry service should be correct. CCE-3612-9 CCE-3572-5 CCE-3030-4 The startup type of the Routing and Remote Access service should be correct. CCE-3621-0 CCE-3973-5 CCE-3035-3 The startup type of the Remote Shell service should be correct. CCE-3602-0 CCE-3995-8 CCE-2427-3 The startup type of the Simple TCP/IP service should be correct. CCE-3497-5 CCE-3515-4 CCE-2449-7 The startup type of the Simple Mail Transport Protocol (SMTP) service should be correct. CCE-3386-0 CCE-3643-4 CCE-2233-5 The startup type of the SNMP Service service should be correct. CCE-3532-9 CCE-3524-6 CCE-2779-7 The startup type of the SNMP Trap Service service should be correct. CCE-3536-0 CCE-3819-0 CCE-2520-5 The startup type of the SSDP Discovery service should be correct. CCE-3541-0 CCE-2661-7 The startup type of the Task Scheduler service should be correct. CCE-3558-4 CCE-4667-2 CCE-2934-8 The startup type of the Telnet service should be correct. CCE-3078-3 CCE-3951-1 CCE-2326-7 The startup type of the Terminal Services service should be correct. CCE-2832-4 CCE-3043-7 The startup type of the Universal Plug and Play Device Host (UPnP) service should be correct. CCE-3475-1 CCE-3048-6 The startup type of the World Wide Web Publishing service should be correct. CCE-3492-6 CCE-3722-6 CCE-2942-1 The startup type of the Automatic Update service should be correct. CCE-3633-5 CCE-3634-3 The startup type of the Background Intelligent Transfer Service (BITS) service should be correct. CCE-3638-4 CCE-3721-8 The startup type of the Print Services for Unix service should be correct. CCE-3175-7 CCE-3069-2 The correct service permissions for the Alerter service should be assigned. CCE-2695-5 CCE-2076-8 The correct service permissions for the Automatic Updates service should be assigned. CCE-3637-6 CCE-2626-0 The correct service permissions for the ClipBook service should be assigned. CCE-3642-6 CCE-2815-9 The correct service permissions for the Fax service should be assigned. CCE-3664-0 CCE-3071-8 The correct service permissions for the FTP Publishing service should be assigned. CCE-3435-5 CCE-3057-7 The correct service permissions for the IIS Admin service should be assigned. CCE-3580-8 CCE-2563-5 The correct service permissions for the Indexing service should be assigned. CCE-3474-4 CCE-2836-5 The correct service permissions for the Messenger service should be assigned. CCE-3496-7 CCE-2480-2 The correct service permissions for the NetMeeting service should be assigned. CCE-3483-5 CCE-2119-6 The correct service permissions for the Printer service should be assigned. CCE-3254-0 CCE-3898-4 CCE-2976-9 The startup type of the Remote Access Auto connection Manager service should be correct. CCE-3523-8 The correct service permissions for the Remote Desktop Help Session Manager service should be assigned. CCE-3673-1 CCE-2990-0 The correct service permissions for the Remote Registry service should be assigned. CCE-3193-0 CCE-3021-3 The correct service permissions for the SMTP service should be assigned. CCE-3461-1 CCE-2773-0 The correct service permissions for the SNMP service should be assigned. CCE-3355-5 CCE-2941-3 The correct service permissions for the SNMP Trap service should be assigned. CCE-2687-2 CCE-2945-4 The correct service permissions for the Telnet service should be assigned. CCE-3583-2 CCE-3108-8 The correct service permissions for the Terminal Services service should be assigned. CCE-3226-8 CCE-3130-2 The correct service permissions for the WWW Publishing service should be assigned. CCE-3569-1 CCE-3051-0 The "Anonymous access to the security event log" policy should be set correctly. CCE-3525-3 CCE-3982-6 CCE-2643-5 Disable saving of dial-up passwords should be properly configured. CCE-3757-2 CCE-4010-5 CCE-2444-8 The "Secure Channel: Digitally Encrypt Secure Channel Data (When Possible)" policy should be set correctly. CCE-3796-0 CCE-3900-8 The "Secure Channel: Digitally Sign Secure Channel Data (When Possible)" policy should be set correctly. CCE-3514-7 CCE-4063-4 Always Wait for the Network at Computer Startup and Logon should be properly configured. CCE-3549-3 CCE-3092-4 Background Refresh of Group Policy should be properly configured. CCE-3298-7 CCE-2893-6 Disallow Installation of Printers Using Kernel-mode Drivers should be properly configured. CCE-3708-5 CCE-3087-4 The "Allow Server Operators to Schedule Tasks" policy should be set correctly. CCE-3479-3 CCE-4005-5 CCE-2968-6 The "Unsigned Driver Installation Behavior" policy should be set correctly. CCE-3787-9 CCE-3648-3 CCE-3085-8 The "Default owner for objects created by members of the Administrators group" policy should be set correctly. CCE-2947-0 CCE-2842-3 The "LDAP server signing requirements" policy should be set correctly. CCE-3801-8 CCE-2551-0 The "Refuse machine account password change" policy should be set correctly. CCE-3605-3 CCE-3123-7 The "Current user screensaver" policy should be set correctly. CCE-3526-1 CCE-4008-9 The "Current user screensaver active" policy should be set correctly. CCE-3799-4 CCE-3149-2 The "Default user screensaver timeout" policy should be set correctly. CCE-3693-9 CCE-2764-9 The "Default user screensaver secure" policy should be set correctly. CCE-3698-8 CCE-3161-7 The "Default user screensaver active" policy should be set correctly. CCE-3715-0 CCE-2901-7 The "Current user screensaver" policy should be set correctly. CCE-3609-5 CCE-3170-8 The "Current user screensaver timeout" policy should be set correctly. CCE-3253-2 CCE-3064-3 The "Current user screensaver secure" policy should be set correctly. CCE-2900-9 CCE-2526-2 The "Current user screensaver active" policy should be set correctly. CCE-3671-5 CCE-2174-1 The "password protect the screen saver" setting should be configured correctly CCE-3182-3 The "Screen Saver timeout" should be set correctly. CCE-3534-5 The "Always Install with Elevated Privileges" policy should be set correctly. CCE-3794-5 CCE-3152-6 CCE-2552-8 The "Enable User to Browser for Source While Elevated" policy should be set correctly. CCE-3190-6 CCE-3931-3 The "Enable User to Use Media Source While Elevated" policy should be set correctly. CCE-3587-3 CCE-4094-9 CCE-3011-4 The "Allow Administrator to Install from Terminal Services Session" policy should be set correctly. CCE-2837-3 CCE-4116-0 CCE-3020-5 The "Enable User to Patch Elevated Products" policy should be set correctly. CCE-3803-4 CCE-3980-0 CCE-2293-9 The "Cache Transforms in Secure Location" policy should be set correctly. CCE-3702-8 CCE-4002-2 CCE-3068-4 The "Prevent Codec Download" policy should be set correctly for Windows MediaPlayer. CCE-2863-9 CCE-3117-9 Internet access for Windows Messenger should be configured correctly. CCE-3636-8 CCE-4033-7 The "Do Not Allow Windows Messenger to be Run" policy should be set correctly. CCE-3658-2 CCE-2684-9 The "Hide Property Pages" policy should be set correctly for the Task Scheduler. CCE-3728-3 CCE-4055-0 The "Prohibit New Task Creation" policy should be set correctly for the Task Scheduler. CCE-3746-5 CCE-3451-2 CCE-2711-0 The "Limit Users to One Remote Session" policy should be set correctly for Terminal Services. CCE-3654-1 CCE-2354-9 The "Limit Number of Connections" policy should be set correctly for Terminal Services. CCE-3786-1 CCE-3129-4 The "Do Not Allow New Client Connections" policy should be set correctly for Terminal Services. CCE-3790-3 CCE-3028-8 The "Do Not Allow Local Administrators to Customize Permissions" policy should be set correctly for Terminal Services. CCE-3808-3 CCE-2407-5 The "Remote Control Settings" policy should be set correctly for Terminal Services. CCE-3848-9 CCE-2808-4 The "Do not Use Temp folders per Session" policy should be set correctly for Terminal Services. CCE-3710-1 CCE-2997-5 The "Do not Delete Temp folder on exit" policy should be set correctly for Terminal Services. CCE-3627-7 CCE-2892-8 The "Allow Reconnection from Original Client Only" policy should be set correctly for Terminal Services. CCE-3683-0 CCE-2210-3 The "Terminate session when time limits are reached" policy should be set correctly for Terminal Services. CCE-3577-4 CCE-2959-5 The "Enable Keep-Alive Messages" policy should be set correctly for Terminal Services. CCE-3828-1 CCE-3109-6 Removable storage should have correct permissions set CCE-3788-7 The "Allow automatic updates immediate installation" should be set correctly CCE-3806-7 The "Automatic Updates detection frequency" should be set correctly CCE-3608-7 The "Specify intranet Microsoft update service location" should be set correctly CCE-3730-9 MSS: TCPMaxPortsExhausted, How many dropped connect requests to initiate SYN attack protection. CCE-3250-8 The required auditing for %SystemDrive% directory should be enabled. CCE-3858-8 CCE-2682-3 The required auditing for the registry key HKEY_LOCAL_MACHINE\SOFTWARE should be enabled. CCE-3748-1 CCE-2796-1 The required auditing for the registry key HKEY_LOCAL_MACHINE\SYSTEM should be enabled. CCE-3770-5 CCE-1840-8 The required permissions for the directory %ProgramFiles% should be assigned. CCE-3809-1 CCE-2706-0 The required permissions for the directory %ProgramFiles%\Resource Kit should be assigned. CCE-3869-5 The required permissions for the directory %ProgramFiles%\Resource Pro Kit should be assigned. CCE-3785-3 The required permissions for the directory %SystemDrive% should be assigned. CCE-3807-5 CCE-2085-9 The required permissions for the file %SystemDrive%\AUTOEXEC.BAT should be assigned. CCE-2879-5 CCE-2702-9 The required permissions for the file %SystemDrive%\BOOT.INI should be assigned. CCE-3344-9 The required permissions for the file %SystemDrive%\CONFIG.SYS should be assigned. CCE-3864-6 CCE-2623-7 The required permissions for the file %SystemDrive%\Documents and Settings should be assigned. CCE-3080-9 CCE-2565-0 The required permissions for the directory %SystemDrive%\Documents and Settings\Administrator should be assigned. CCE-3873-7 CCE-2115-4 The required permissions for the directory %SystemDrive%\Documents and Settings\All Users should be assigned. CCE-3419-9 The required permissions for the directory %SystemDrive%\Documents and Settings\All Users\Documents\DrWatson should be assigned. CCE-3763-0 The required permissions for the file %SystemDrive%\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log should be assigned. CCE-3657-4 The required permissions for the directory %SystemDrive%\Documents and Settings\Default User should be assigned. CCE-3697-0 CCE-2741-7 The required permissions for the file %SystemDrive%\IO.SYS should be assigned. CCE-3789-5 CCE-2745-8 The required permissions for the file %SystemDrive%\MSDOS.SYS should be assigned. CCE-3560-0 CCE-2287-1 The required permissions for the file %SystemDrive%\NTBOOTDD.SYS should be assigned. CCE-3335-7 CCE-2798-7 The required permissions for the file %SystemDrive%\NTDETECT.COM should be assigned. CCE-3749-9 CCE-2578-3 The required permissions for the file %SystemDrive%\NTLDR should be assigned. CCE-3771-3 CCE-2234-3 The required permissions for the directory %SystemDrive%\Temp should be assigned. CCE-2895-1 The required permissions for the directory %SystemDrive%\My Download Files should be assigned. CCE-3686-3 The required permissions for the file %SystemDrive%\System Volume Information should be assigned. CCE-3083-3 CCE-2750-8 The required permissions for the directory %SystemRoot% should be assigned. CCE-3105-4 CCE-2160-0 The required permissions for the directory %SystemRoot%\Driver Cache\I386\Driver.cab should be assigned. CCE-3876-0 CCE-2475-2 The required permissions for the directory %SystemRoot%\$NtServicePackUninstall$ should be assigned. CCE-3519-6 CCE-2387-9 The required permissions for the directory %SystemRoot%\$NtServicePackUninstall$ should be assigned. CCE-3197-1 The required permissions for any of the %SystemRoot%\$NtUninstall* directories should be assigned. CCE-3342-3 The required permissions for the directory %SystemRoot%\CSC should be assigned. CCE-3505-5 CCE-2647-6 The required permissions for the directory %SystemRoot%\Debug should be assigned. CCE-3791-1 CCE-2418-2 The required permissions for the directory %SystemRoot%\Debug\UserMode should be assigned. CCE-3192-2 CCE-2329-1 The required permissions for the file %SystemRoot%\regedit.exe should be assigned. CCE-3836-4 CCE-2175-8 The required permissions for the directory %SystemDrive%\NTDS should be assigned. CCE-3091-6 The required permissions for the directory %SystemRoot%\Offline Web Pages should be assigned. CCE-3862-0 The required permissions for the directory %SystemRoot%\Registration should be assigned. CCE-3867-9 CCE-2325-9 The required permissions for the directory %SystemRoot%\repair should be assigned. CCE-3404-1 CCE-2805-0 The required permissions for the directory %SystemRoot%\security should be assigned. CCE-3052-8 CCE-2739-1 The required permissions for the directory %SystemRoot%\SYSVOL should be assigned. CCE-3879-4 The required permissions for the directory %SystemRoot%\SYSVOL\domain\Policies should be assigned. CCE-3544-4 The required permissions for the directory %SystemRoot%\Temp should be assigned. CCE-3408-2 CCE-2638-5 The required permissions for the directory %SystemRoot%\System32 should be assigned. CCE-3800-0 CCE-2660-9 The required permissions for the directory %SystemRoot%\System32\arp.exe should be assigned. CCE-3571-7 CCE-2052-9 The required permissions for the file %SystemRoot%\System32\at.exe should be assigned. CCE-3712-7 CCE-2184-0 The required permissions for the file %SystemRoot%\System32\CONFIG should be assigned. CCE-3716-8 CCE-1842-4 The required permissions for the file %SystemRoot%\System32\CONFIG\AppEvent.evt should be assigned. CCE-3734-1 CCE-1846-5 The required permissions for the file %SystemRoot%\System32\CONFIG\*.evt should be assigned. CCE-3641-8 CCE-2800-1 The required permissions for the directory %SystemRoot%\System32\dllcache should be assigned. CCE-3540-2 CCE-1863-0 The required permissions for the directory %SystemRoot%\System32\DTCLog should be assigned. CCE-3831-5 The required permissions for the directory %SystemRoot%\System32\GroupPolicy should be assigned. CCE-3745-7 CCE-2876-1 The required permissions for the directory %SystemRoot%\System32\ias should be assigned. CCE-3890-1 CCE-2813-4 The required permissions for the file %SystemRoot%\System32\Ntbackup.exe should be assigned. CCE-3784-6 CCE-2903-3 The required permissions for the directory %SystemRoot%\System32\NTMSData should be assigned. CCE-3793-7 CCE-1925-7 The required permissions for the file %SystemRoot%\System32\Rcp.exe should be assigned. CCE-3815-8 CCE-2784-7 The required permissions for the file %SystemRoot%\System32\Regedt32.exe should be assigned. CCE-3824-0 CCE-2833-2 The required permissions for the directory %SystemRoot%\system32\ReinstallBackups should be assigned. CCE-3595-6 The required permissions for the file %SystemRoot%\System32\Rexec.exe should be assigned. CCE-3516-2 CCE-2899-3 The required permissions for the file %SystemRoot%\System32\Rsh.exe should be assigned. CCE-3520-4 CCE-2674-0 The required permissions for the file %SystemRoot%\System32\Secedit.exe should be assigned. CCE-3776-2 CCE-2198-0 The required permissions for the directory %SystemRoot%\System32\Setup should be assigned. CCE-3670-7 CCE-2872-0 The required permissions for the directory %SystemRoot%\System32\repl should be assigned. CCE-3340-7 The required permissions for the directory %SystemRoot%\System32\repl\export should be assigned. CCE-3780-4 The required permissions for the directory %SystemRoot%\System32\repl\import should be assigned. CCE-3423-1 The required permissions for the directory %SystemRoot%\System32\spool\Printers should be assigned. CCE-3802-6 CCE-2753-2 The required permissions for the directory %SystemRoot%\Tasks should be assigned. CCE-3079-1 CCE-2738-3 The required permissions for the directory %ALL%\Program Files\MQSeries should be assigned. CCE-3727-5 The required permissions for the directory %ALL%\Program Files\MQSeries\qmggr should be assigned. CCE-3493-4 The required permissions for the directory %SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\HTML Help ACL should be assigned. CCE-3872-9 The required permissions for the directory %SystemDrive%\WINNT\SECURITY\Database\SECEDIT.SDB ACL should be assigned. CCE-3656-6 The required permissions for the registry key HKEY_CLASSES_ROOT should be assigned. CCE-2929-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE should be assigned. CCE-3308-4 CCE-2619-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes should be assigned. CCE-3723-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Regfile\Shell\Open\Command should be assigned. CCE-3868-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDDE should be assigned. CCE-3563-4 CCE-2612-0 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OS/2 Subsystem for NT should be assigned. CCE-3691-3 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Asr\Commands should be assigned. CCE-3735-8 CCE-2401-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib should be assigned. CCE-3242-5 CCE-2921-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy should be assigned. CCE-3374-6 CCE-2771-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer should be assigned. CCE-3167-4 CCE-2793-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies should be assigned. CCE-3533-7 CCE-2207-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM should be assigned. CCE-2897-7 CCE-2630-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\clone should be assigned. CCE-3839-8 CCE-2775-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset001 should be assigned. CCE-3865-3 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset002 should be assigned. CCE-3513-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset003 should be assigned. CCE-3896-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset004 should be assigned. CCE-3838-0 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset005 should be assigned. CCE-3750-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset006 should be assigned. CCE-3384-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset007 should be assigned. CCE-3680-6 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset008 should be assigned. CCE-3816-6 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset009 should be assigned. CCE-3318-3 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\controlset010 should be assigned. CCE-3882-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg should be assigned. CCE-3521-2 CCE-1960-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Wmi\Security should be assigned. CCE-2932-2 CCE-2859-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum should be assigned. CCE-3651-7 CCE-2938-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles should be assigned. CCE-3210-2 CCE-2850-6 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers should be assigned. CCE-3466-0 CCE-2595-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities should be assigned. CCE-2978-5 CCE-2238-4 The required permissions for the registry key HKEY_USERS\.DEFAULT should be assigned. CCE-3957-8 CCE-2951-2 The required permissions for the registry key HKEY_USERS\.DEFAULT\Software\Microsoft\NetDDE should be assigned. CCE-3961-0 CCE-2845-6 The required permissions for the registry key HKEY_USERS\.DEFAULT\Software\Microsoft\Protected Storage System Provider should be assigned. CCE-3732-5 The required permissions for the registry key HKEY_CLASSES_ROOT should be assigned. CCE-3737-4 The "Decoy Admin Account Not Disabled" policy should be set correctly. CCE-3470-2 The correct password filtering DLL should be installed. CCE-3986-7 The startup type of the Computer Browser service should be correct. CCE-4041-0 CCE-2880-3 The correct service permissions for the Task Scheduler service should be assigned. CCE-3418-1 CCE-3077-5 The "Additional restrictions for anonymous connections" policy should be set correctly. CCE-3938-8 The "Anonymous access to the registry" policy should be set correctly. CCE-4004-8 Administrative Shares should be properly configured. CCE-3893-5 CCE-3137-7 Automatic Execution of the System Debugger should be properly configured. CCE-4039-4 CCE-3031-2 Automatic Reboot After System Crash should be properly configured. CCE-4061-8 CCE-2419-0 Autoplay for Current User should be properly configured. CCE-3871-1 CCE-2154-3 Autoplay for Default User should be properly configured. CCE-3528-7 CCE-2423-2 CD-ROM Autorun should be properly configured. CCE-3555-0 CCE-2925-6 Computer Browser ResetBrowser Frames should be properly configured. CCE-3682-2 CCE-3070-0 Dr. Watson Crash Dumps should be properly configured. CCE-3981-8 CCE-3066-8 File System Checker and Popups should be properly configured. CCE-3920-6 System File Checker should be properly configured. CCE-3095-7 System File Checker Progress Meter should be properly configured. CCE-3972-7 The permitted number of TCP/IP Maximum Half-open Sockets should be set correctly . CCE-3878-6 CCE-2453-9 The permitted number of TCP/IP Maximum Retried Half-open Sockets should be set correctly . CCE-4027-9 CCE-3114-6 Protect Kernel object attributes should be properly configured. CCE-3948-7 The "Send LanMan compatible password" setting should be configured correctly. CCE-3908-1 The "Unsigned Non-Driver Installation Behavior" policy should be set correctly. CCE-3401-7 The "Automatically Log Off Users When Logon Time Expires (local)" policy should be set correctly. CCE-3813-3 Local volumes should be formatted correctly. CCE-3947-9 CCE-2795-3 Unused USB Ports should be enabled or disabled as appropriate. CCE-3863-8 DEPRECATED in favor of CCE-5236-5, CCE-4719-1. CCE-4812-4 The Smart Card Helper service should be enabled or disabled as appropriate. CCE-4874-4 CCE-2831-6 The License Logging service should be enabled or disabled as appropriate. CCE-4777-9 The Application Management service should be enabled or disabled as appropriate. CCE-4825-6 CCE-3047-8 The Resultant Set of Policy (RSoP) Provider Service should be enabled or disabled as appropriate. CCE-4720-9 Use of the Recycle Bin on file deletion should be enabled or disabled as appropriate. CCE-4848-8 The Network News Transport Protocol (NNTP) service should be enabled or disabled as appropriate. CCE-4729-0 The Network Dynamic Data Exchange (DDE) service should be enabled or disabled as appropriate. CCE-4495-8 CCE-3131-0 The Distributed Link Tracking Server service should be enabled or disabled as appropriate. CCE-4253-1 The Distributed Transaction Coordinator service should be enabled or disabled as appropriate. CCE-4447-9 CCE-3184-9 The required permissions for the file %SystemRoot%\System32\runas.exe should be assigned. CCE-4830-6 CCE-2762-3 The Uninterruptable Power Supply service should be enabled or disabled as appropriate. CCE-4751-4 CCE-3221-9 The Telephony service should be enabled or disabled as appropriate. CCE-4882-7 CCE-2811-8 The Wireless Zero Configuration service should be enabled or disabled as appropriate. CCE-4244-0 CCE-2494-3 The Distributed Link Tracking Client service should be enabled or disabled as appropriate. CCE-4803-3 CCE-3153-4 The Remote Access Connection Manager service should be enabled or disabled as appropriate. CCE-4779-5 CCE-3104-7 The Network DDE DDE Share Database Manager (DSDM) service should be enabled or disabled as appropriate. CCE-4801-7 CCE-3122-9 The Smart Card service should be enabled or disabled as appropriate. CCE-4096-4 CCE-3241-7 Membership in the Power Users group should be assigned to the appropriate accounts. CCE-4003-0 CCE-2862-1 The required permissions for the directory %ALL% should be assigned. CCE-2483-6 The required permissions for the directory %AllUsersProfile% should be assigned. CCE-1849-9 The required permissions for the directory %AllUsersProfile%\Application Data should be assigned. CCE-2620-3 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft should be assigned. CCE-2787-0 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\Crypto\DSSHKLMKeys should be assigned. CCE-2673-2 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\Crypto\RSAHKLMKeys should be assigned. CCE-2782-1 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\Dr Watson should be assigned. CCE-2676-5 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\Dr Watson\drwtsn32.log should be assigned. CCE-1815-0 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\HTML Help should be assigned. CCE-2728-4 The required permissions for the directory %AllUsersProfile%\Application Data\Microsoft\MediaIndex should be assigned. CCE-2763-1 The required permissions for the directory %AllUsersProfile%\Documents\desktop.ini should be assigned. CCE-2768-0 The required permissions for the directory %AllUsersProfile%\DRM should be assigned. CCE-2561-9 The required permissions for the directory %SystemRoot%\Debug\UserMode\userenv.log should be assigned. CCE-2105-5 The required permissions for the file %SystemRoot%\Installer should be assigned. CCE-2752-4 The required permissions for the file %SystemRoot%\Offline Web Pages should be assigned. CCE-2757-3 The required permissions for the file %SystemRoot%\Prefetch should be assigned. CCE-2264-0 The required permissions for the directory %SystemRoot%\Registration\CRMLog should be assigned. CCE-1833-3 The required permissions for the file %SystemRoot%\System32\attrib.exe should be assigned. CCE-2312-7 The required permissions for the file %SystemRoot%\System32\cacls.exe should be assigned. CCE-2726-8 The required permissions for the file %SystemRoot%\System32\ciadv.msc should be assigned. CCE-2250-9 The required permissions for the file %SystemRoot%\System32\Com\comexp.msc should be assigned. CCE-1924-0 The required permissions for the file %SystemRoot%\System32\compmgmt.msc should be assigned. CCE-2598-1 The required permissions for the file %SystemRoot%\System32\debug.exe should be assigned. CCE-2699-7 The required permissions for the file %SystemRoot%\System32\devmgmt.msc should be assigned. CCE-2844-9 The required permissions for the file %SystemRoot%\System32\dfrg.msc should be assigned. CCE-2109-7 The required permissions for the file %SystemRoot%\System32\diskmgmt.msc should be assigned. CCE-2514-8 The required permissions for the file %SystemRoot%\System32\drwatson.exe should be assigned. CCE-2760-7 The required permissions for the file %SystemRoot%\System32\drwtsn32.exe should be assigned. CCE-2425-7 The required permissions for the file %SystemRoot%\System32\edlin.exe should be assigned. CCE-1909-1 The required permissions for the file %SystemRoot%\System32\eventcreate.exe should be assigned. CCE-2145-1 The required permissions for the file %SystemRoot%\System32\eventtriggers.exe should be assigned. CCE-2436-4 The required permissions for the file %SystemRoot%\System32\eventvwr.msc should be assigned. CCE-2704-5 The required permissions for the file %SystemRoot%\System32\fsmgmt.msc should be assigned. CCE-2334-1 The required permissions for the file %SystemRoot%\System32\ftp.exe should be assigned. CCE-2229-3 The required permissions for the file %SystemRoot%\System32\gpedit.msc should be assigned. CCE-2621-1 The required permissions for the directory %SystemRoot%\System32\lusrmgr.msg should be assigned. CCE-2597-3 The required permissions for the directory %SystemRoot%\System32\MSDTC should be assigned. CCE-2747-4 The required permissions for the file %SystemRoot%\System32\nbstat.exe should be assigned. CCE-2139-4 The required permissions for the file %SystemRoot%\System32\net.exe should be assigned. CCE-2178-2 The required permissions for the file %SystemRoot%\System32\net1.exe should be assigned. CCE-2672-4 The required permissions for the file %SystemRoot%\System32\netsh.exe should be assigned. CCE-1916-6 The required permissions for the file %SystemRoot%\System32\netstat.exe should be assigned. CCE-2732-6 The required permissions for the file %SystemRoot%\System32\nslookup.exe should be assigned. CCE-2613-8 The required permissions for the file %SystemRoot%\System32\ntmsoprq.msc should be assigned. CCE-2727-6 The required permissions for the file %SystemRoot%\System32\ntmsmgr.msc should be assigned. CCE-2749-0 The required permissions for the file %SystemRoot%\System32\perfmon.msc should be assigned. CCE-2912-4 The required permissions for the file %SystemRoot%\System32\reg.exe should be assigned. CCE-2220-2 The required permissions for the file %SystemRoot%\System32\regini.exe should be assigned. CCE-2855-5 The required permissions for the file %SystemRoot%\System32\regsvr32.exe should be assigned. CCE-2894-4 The required permissions for the file %SystemRoot%\System32\route.exe should be assigned. CCE-2546-0 The required permissions for the file %SystemRoot%\System32\RSoP.msc should be assigned. CCE-2070-1 The required permissions for the file %SystemRoot%\System32\sc.exe should be assigned. CCE-2176-6 The required permissions for the file %SystemRoot%\System32\secpol.msc should be assigned. CCE-2185-7 The required permissions for the file %SystemRoot%\System32\services.msc should be assigned. CCE-2458-8 The required permissions for the file %SystemRoot%\System32\subst.exe should be assigned. CCE-2788-8 The required permissions for the file %SystemRoot%\System32\systeminfo.exe should be assigned. CCE-2797-9 The required permissions for the file %SystemRoot%\System32\telnet.exe should be assigned. CCE-2691-4 The required permissions for the file %SystemRoot%\System32\tftp.exe should be assigned. CCE-2731-8 The required permissions for the file %SystemRoot%\System32\tlntsvr.exe should be assigned. CCE-1937-2 The required permissions for the file %SystemRoot%\System32\wmimgmt.msc should be assigned. CCE-2857-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography/Calais should be assigned. CCE-2284-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC should be assigned. CCE-2809-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\Security\XAKey should be assigned. CCE-1943-0 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UPnP Device Host should be assigned. CCE-2758-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit should be assigned. CCE-2392-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings should be assigned. CCE-2625-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony should be assigned. CCE-2736-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class should be assigned. CCE-2300-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network should be assigned. CCE-2172-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt\Security should be assigned. CCE-2590-8 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv\Security should be assigned. CCE-2484-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Security should be assigned. CCE-2524-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache should be assigned. CCE-2907-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ersvc\Security should be assigned. CCE-2911-6 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security should be assigned. CCE-2555-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IRENUM\Security should be assigned. CCE-2202-0 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt should be assigned. CCE-2352-3 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netdd\Security should be assigned. CCE-2634-4 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netddedsdm\Security should be assigned. CCE-1973-7 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess should be assigned. CCE-2603-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rpcss\Security should be assigned. CCE-2871-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Samss\Security should be assigned. CCE-2396-0 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Scarddrv\Security should be assigned. CCE-1966-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Scardsvr\Security should be assigned. CCE-2696-3 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stisvc\Security should be assigned. CCE-2881-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries should be assigned. CCE-2780-5 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tapisrv\Security should be assigned. CCE-2428-1 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip should be assigned. CCE-2885-2 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32time\Security should be assigned. CCE-2537-9 The required permissions for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi\Security should be assigned. CCE-2057-8 The required permissions for the registry key HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\Root\ProtectedRoots should be assigned. CCE-2740-9 The startup type of the Fast User Switching service should be correct. CCE-2950-4 The startup type of the Net Logon service should be correct. CCE-2071-9 The correct service permissions for the Background Intelligent Transfer service should be assigned. CCE-3022-1 The correct service permissions for the Computer Browser service should be assigned. CCE-2568-4 The correct service permissions for the File Shares service should be assigned. CCE-2969-4 The correct service permissions for the Net Logon service should be assigned. CCE-2502-3 The correct service permissions for the Routing and Remote Access service should be assigned. CCE-2141-0 The correct service permissions for the Universal Plug and Play service should be assigned. CCE-3029-6 The "Anonymous access to the application event log" policy should be set correctly. CCE-3119-5 The "Anonymous access to the system event log" policy should be set correctly. CCE-2890-2 Delete Roaming Cached Profiles should be properly configured. CCE-3013-0 Show Shared Internet Connection Access UI should be properly configured. CCE-2774-8 The "Default user screensaver" policy should be set correctly. CCE-3099-9 The "System cryptography: Force strong key protection for user keys stored on the computer" setting should be configured correctly. CCE-2992-6 The "System settings: optional subsystems" setting should be configured correctly. CCE-2705-2 the "System settings: Use Certificate Rules on Windows Executables for Software Restriction Polices" setting should be configured correctly. CCE-2723-5 Membership in the Backup Operators group should be assigned to the appropriate accounts. CCE-2690-6 Membership in the Remote Desktop Users group should be assigned to the appropriate accounts. CCE-3136-9 The Application Layer Gateway Service should be enabled or disabled as appropriate. CCE-3171-6 The Cryptographic Services service should be enabled or disabled as appropriate. CCE-3113-8 The DHCP Client service should be enabled or disabled as appropriate. CCE-2756-5 The DNS Client service should be enabled or disabled as appropriate. CCE-2985-0 The Error Reporting Service should be enabled or disabled as appropriate. CCE-3236-7 The Event Log service should be enabled or disabled as appropriate. CCE-3140-1 The Help and Support service should be enabled or disabled as appropriate. CCE-2301-0 The Human Interface Device Access service should be enabled or disabled as appropriate. CCE-3003-1 The IMAPI CD-Burning COM Service should be enabled or disabled as appropriate. CCE-2716-9 The Infrared Monitor service should be enabled or disabled as appropriate. CCE-3223-5 The IPSEC Services service should be enabled or disabled as appropriate. CCE-3245-8 The Logical Disk Manager service should be enabled or disabled as appropriate. CCE-3294-6 The Logical Disk Manager Administrative Service should be enabled or disabled as appropriate. CCE-3073-4 The MS Software Shadow Copy Provider service should be enabled or disabled as appropriate. CCE-3065-0 The Network Connections service should be enabled or disabled as appropriate. CCE-2840-7 The Network Location Awareness (NLA) service should be enabled or disabled as appropriate. CCE-3267-2 The NT LM Security Support Provider service should be enabled or disabled as appropriate. CCE-3056-9 The Performance Logs and Alerts service should be enabled or disabled as appropriate. CCE-3144-3 The Portable Media Serial Number Service service should be enabled or disabled as appropriate. CCE-3289-6 The Protected Storage service should be enabled or disabled as appropriate. CCE-3205-2 The QoS RSVP service should be enabled or disabled as appropriate. CCE-3206-0 The Remote Procedure Call (RPC) service should be enabled or disabled as appropriate. CCE-3126-0 The Remote Procedure Call (RPC) Locator service should be enabled or disabled as appropriate. CCE-3148-4 The Removable Storage service should be enabled or disabled as appropriate. CCE-2567-6 The Secondary Logon service should be enabled or disabled as appropriate. CCE-2823-3 The Security Accounts Manager service should be enabled or disabled as appropriate. CCE-3074-2 The Server service should be enabled or disabled as appropriate. CCE-3219-3 The System Event Notification service should be enabled or disabled as appropriate. CCE-2835-7 The System Restore Service should be enabled or disabled as appropriate. CCE-2321-8 The TCP/IP NetBIOS Helper service should be enabled or disabled as appropriate. CCE-3274-8 The Themes service should be enabled or disabled as appropriate. CCE-3195-5 The Upload Manager service should be enabled or disabled as appropriate. CCE-2988-4 The Volume Shadow Copy service should be enabled or disabled as appropriate. CCE-3146-8 The WebClient service should be enabled or disabled as appropriate. CCE-3291-2 The Windows Audio service should be enabled or disabled as appropriate. CCE-3256-5 The Windows Image Acquisition (WIA) service should be enabled or disabled as appropriate. CCE-2639-3 The Windows Installer service should be enabled or disabled as appropriate. CCE-3159-1 The Windows Management Instrumentation service should be enabled or disabled as appropriate. CCE-3163-3 The Windows Management Instrumentation Driver Extensions service should be enabled or disabled as appropriate. CCE-3203-7 The Windows Time service should be enabled or disabled as appropriate. CCE-2599-9 The WMI Performance Adapter service should be enabled or disabled as appropriate. CCE-3265-6 The Workstation service should be enabled or disabled as appropriate. CCE-2397-8 Domain Profile: Allow ICMP exceptions (SP2 only) CCE-3141-9 Standard Profile: Allow ICMP exceptions (SP2 only) CCE-3081-7 The "Log Dropped Packets" option for the Windows Firewall should be configured correctly for the Standard Profile. CCE-3280-5 The log file path and name for the Windows Firewall should be configured correctly for the Standard Profile. CCE-3174-0 The log file size limit for the Windows Firewall should be configured correctly for the Standard Profile. CCE-3055-1 The "Log Successful Connections" option for the Windows Firewall should be configured correctly for the Standard Profile. CCE-2707-8 The startup type of the Internet Connection Firewall service should be correct. CCE-3037-9 Restricted Groups have been set on the system CCE-2856-3 The required permissions for the file %SystemRoot%\System32\mshta.exe should be assigned. CCE-4952-8