Edit C:\Program Files\Neptune\data\security-posture.json
{ "data": { "collected_at": "2026-06-12T13:03:13.0307044+02:00", "score": 28, "checks": [ { "id": "firewall_enabled", "category": "firewall", "name": "Windows Firewall Enabled", "status": "fail", "severity": "critical", "details": "Windows Firewall is disabled for: Domain, Private, Public", "remediation": "Enable Windows Firewall: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True", "compliance": [ { "framework": "CIS", "control_id": "9.1.1", "title": "Ensure Windows Defender Firewall is enabled for Domain profile" }, { "framework": "CIS", "control_id": "9.2.1", "title": "Ensure Windows Defender Firewall is enabled for Private profile" }, { "framework": "CIS", "control_id": "9.3.1", "title": "Ensure Windows Defender Firewall is enabled for Public profile" }, { "framework": "ANSSI", "control_id": "R7", "title": "Enable and configure Windows Firewall" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A6", "title": "Harden Windows Firewall" } ] }, { "id": "antivirus_installed", "category": "antivirus", "name": "Antivirus Software Installed", "status": "fail", "severity": "critical", "details": "No antivirus software detected", "remediation": "Install an antivirus solution. For Windows Server, enable Microsoft Defender or deploy an enterprise AV product", "compliance": [ { "framework": "CIS", "control_id": "8.1", "title": "Ensure antivirus software is installed and running" }, { "framework": "ANSSI", "control_id": "R22", "title": "Deploy and maintain antivirus protection" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A16", "title": "Configure antivirus protection" } ] }, { "id": "antivirus_realtime", "category": "antivirus", "name": "Antivirus Real-Time Protection Enabled", "status": "fail", "severity": "critical", "details": "No antivirus detected to provide real-time protection", "remediation": "Install and enable an antivirus solution with real-time protection", "compliance": [ { "framework": "CIS", "control_id": "18.9.47.4.1", "title": "Ensure Turn on real-time protection is set to Enabled" }, { "framework": "ANSSI", "control_id": "R22", "title": "Deploy and maintain antivirus protection" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A16", "title": "Configure antivirus protection" } ] }, { "id": "antivirus_definitions", "category": "antivirus", "name": "Antivirus Definitions Up-to-Date", "status": "fail", "severity": "high", "details": "No antivirus installed to check definitions", "remediation": "Install an antivirus solution", "compliance": [ { "framework": "CIS", "control_id": "18.9.47.9", "title": "Ensure definition updates are configured" }, { "framework": "ANSSI", "control_id": "R22", "title": "Deploy and maintain antivirus protection" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A16", "title": "Configure antivirus protection" } ] }, { "id": "bitlocker_enabled", "category": "encryption", "name": "BitLocker Drive Encryption", "status": "warning", "severity": "medium", "details": "Unable to query BitLocker status (may require elevated privileges)", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.9.11.1", "title": "Ensure BitLocker is configured for fixed data drives" }, { "framework": "ANSSI", "control_id": "R14", "title": "Enable BitLocker drive encryption" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A12", "title": "Configure disk encryption" } ] }, { "id": "uac_enabled", "category": "access_control", "name": "User Account Control (UAC) Enabled", "status": "pass", "severity": "critical", "details": "User Account Control (UAC) is enabled", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "2.3.17.1", "title": "Ensure User Account Control: Admin Approval Mode is enabled" }, { "framework": "ANSSI", "control_id": "R15", "title": "Enable and configure User Account Control" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "smb1_disabled", "category": "network", "name": "SMBv1 Protocol Disabled", "status": "fail", "severity": "high", "details": "SMBv1 protocol is enabled", "remediation": "Disable SMBv1: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart", "compliance": [ { "framework": "CIS", "control_id": "18.3.3", "title": "Ensure Configure SMB v1 server is set to Disabled" }, { "framework": "ANSSI", "control_id": "R8", "title": "Disable SMBv1 protocol" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A7", "title": "Harden SMB configuration" } ] }, { "id": "rdp_nla_required", "category": "network", "name": "RDP Network Level Authentication Required", "status": "pass", "severity": "high", "details": "Network Level Authentication (NLA) is required for RDP", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.9.65.3.9.2", "title": "Ensure Require user authentication for remote connections by using NLA is enabled" }, { "framework": "ANSSI", "control_id": "R16", "title": "Harden Remote Desktop configuration" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A9", "title": "Harden Remote Desktop Services" } ] }, { "id": "rdp_encryption_level", "category": "encryption", "name": "RDP Encryption Level High", "status": "warning", "severity": "high", "details": "RDP encryption level is Client Compatible (should be High)", "remediation": "Set encryption to High: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v MinEncryptionLevel /t REG_DWORD /d 3 /f", "compliance": [ { "framework": "CIS", "control_id": "18.9.65.3.9.1", "title": "Ensure Set client connection encryption level is set to High Level" }, { "framework": "ANSSI", "control_id": "R16", "title": "Harden Remote Desktop configuration" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A9", "title": "Harden Remote Desktop Services" } ] }, { "id": "auto_updates", "category": "updates", "name": "Windows Automatic Updates", "status": "pass", "severity": "high", "details": "Automatic updates are enabled via Group Policy", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.9.108.1.1", "title": "Ensure Configure Automatic Updates is set to Enabled" }, { "framework": "ANSSI", "control_id": "R23", "title": "Configure automatic security updates" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A4", "title": "Manage security updates" } ] }, { "id": "password_min_length", "category": "password_policy", "name": "Password Minimum Length", "status": "fail", "severity": "medium", "details": "Minimum password length is only 0 characters", "remediation": "Set minimum password length to 14: net accounts /minpwlen:14", "compliance": [ { "framework": "CIS", "control_id": "1.1.4", "title": "Ensure Minimum password length is set to 14 or more characters" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "password_complexity", "category": "password_policy", "name": "Password Complexity Requirements", "status": "pass", "severity": "medium", "details": "Password complexity requirements are enabled", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.5", "title": "Ensure Password must meet complexity requirements is set to Enabled" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "password_max_age", "category": "password_policy", "name": "Password Maximum Age", "status": "pass", "severity": "medium", "details": "Password maximum age is 42 days", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.2", "title": "Ensure Maximum password age is set to 365 or fewer days but not 0" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "account_lockout", "category": "password_policy", "name": "Account Lockout Policy", "status": "fail", "severity": "high", "details": "Account lockout is disabled (no limit on failed login attempts)", "remediation": "Set lockout policy: net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15", "compliance": [ { "framework": "CIS", "control_id": "1.2.1", "title": "Ensure Account lockout duration is set to 15 or more minutes" }, { "framework": "CIS", "control_id": "1.2.2", "title": "Ensure Account lockout threshold is set to 5 or fewer invalid logon attempts" }, { "framework": "ANSSI", "control_id": "R19", "title": "Configure account lockout policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "listening_ports", "category": "network", "name": "No Risky Listening Ports", "status": "warning", "severity": "high", "details": "Risky services listening on all interfaces: SMTP(25)", "remediation": "Review and disable unnecessary services, or configure Windows Firewall to block these ports", "compliance": [ { "framework": "CIS", "control_id": "2.1", "title": "Ensure unnecessary services are removed" }, { "framework": "ANSSI", "control_id": "R24", "title": "Disable unnecessary services" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A14", "title": "Harden system services" } ] }, { "id": "guest_account_disabled", "category": "access_control", "name": "Guest Account Disabled", "status": "warning", "severity": "critical", "details": "Unable to query Guest account status", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.1", "title": "Ensure Accounts: Guest account status is set to Disabled" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "remote_registry_disabled", "category": "network", "name": "Remote Registry Service Disabled", "status": "warning", "severity": "high", "details": "Remote Registry service is stopped but start type is 'Automatic'", "remediation": "Disable Remote Registry: Set-Service -Name 'RemoteRegistry' -StartupType Disabled -Status Stopped", "compliance": [ { "framework": "CIS", "control_id": "5.27", "title": "Ensure Remote Registry (RemoteRegistry) is set to Disabled" }, { "framework": "ANSSI", "control_id": "R24", "title": "Disable unnecessary services" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A14", "title": "Harden system services" } ] }, { "id": "powershell_execution_policy", "category": "access_control", "name": "PowerShell Execution Policy Restricted", "status": "warning", "severity": "medium", "details": "PowerShell execution policy is RemoteSigned (local unsigned scripts can run)", "remediation": "Restrict PowerShell: Set-ExecutionPolicy AllSigned -Scope LocalMachine -Force", "compliance": [ { "framework": "CIS", "control_id": "18.9.100.1", "title": "Ensure Turn on PowerShell Script Block Logging is set to Enabled" }, { "framework": "ANSSI", "control_id": "R17", "title": "Configure PowerShell security" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A15", "title": "Harden PowerShell configuration" } ] }, { "id": "winrm_encrypted", "category": "encryption", "name": "WinRM Encrypted Traffic Only", "status": "pass", "severity": "high", "details": "WinRM requires encrypted traffic", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.9.102.1.1", "title": "Ensure Allow unencrypted traffic is set to Disabled" }, { "framework": "ANSSI", "control_id": "R35", "title": "Harden WinRM configuration" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A19", "title": "Secure WinRM configuration" } ] }, { "id": "lsa_anonymous_restricted", "category": "access_control", "name": "Anonymous Access to LSA Restricted", "status": "fail", "severity": "high", "details": "Anonymous access to LSA is not restricted (enumeration risk)", "remediation": "Restrict anonymous access: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" /v RestrictAnonymous /t REG_DWORD /d 1 /f", "compliance": [ { "framework": "CIS", "control_id": "2.3.10.5", "title": "Ensure Network access: Let Everyone permissions apply to anonymous users is set to Disabled" }, { "framework": "ANSSI", "control_id": "R37", "title": "Restrict anonymous enumeration" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A11", "title": "Harden authentication mechanisms" } ] }, { "id": "audit_logon_events", "category": "access_control", "name": "Audit Logon Events Enabled", "status": "pass", "severity": "high", "details": "Logon events auditing is configured for Success and Failure", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "17.5.1", "title": "Ensure Audit Logon is set to Success and Failure" }, { "framework": "ANSSI", "control_id": "R18", "title": "Configure comprehensive audit policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A10", "title": "Configure audit and logging" } ] }, { "id": "smb_signing_required", "category": "network", "name": "SMB Signing Required", "status": "fail", "severity": "high", "details": "SMB signing is not required (vulnerable to relay attacks)", "remediation": "Enable SMB signing: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" /v RequireSecuritySignature /t REG_DWORD /d 1 /f \u0026\u0026 reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\" /v RequireSecuritySignature /t REG_DWORD /d 1 /f", "compliance": [ { "framework": "CIS", "control_id": "2.3.8.1", "title": "Ensure Microsoft network client: Digitally sign communications (always) is set to Enabled" }, { "framework": "CIS", "control_id": "2.3.9.2", "title": "Ensure Microsoft network server: Digitally sign communications (always) is set to Enabled" }, { "framework": "ANSSI", "control_id": "R9", "title": "Require SMB signing" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A7", "title": "Harden SMB configuration" } ] }, { "id": "powershell_script_block_logging", "category": "access_control", "name": "PowerShell Script Block Logging Enabled", "status": "fail", "severity": "high", "details": "PowerShell Script Block Logging is not configured", "remediation": "Enable via GPO or registry: reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f", "compliance": [ { "framework": "CIS", "control_id": "18.9.100.1", "title": "Ensure Turn on PowerShell Script Block Logging is set to Enabled" }, { "framework": "ANSSI", "control_id": "R17", "title": "Configure PowerShell security" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A15", "title": "Harden PowerShell configuration" } ] }, { "id": "credential_guard", "category": "encryption", "name": "Credential Guard Enabled", "status": "warning", "severity": "high", "details": "Virtualization Based Security registry key not found (may not be supported)", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.3.6", "title": "Ensure Turn On Virtualization Based Security is set to Enabled" }, { "framework": "ANSSI", "control_id": "R12", "title": "Enable Credential Guard" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A8", "title": "Protect credentials in memory" } ] }, { "id": "autorun_disabled", "category": "access_control", "name": "AutoRun Disabled", "status": "fail", "severity": "high", "details": "AutoRun policy is not configured", "remediation": "Disable AutoRun: reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f", "compliance": [ { "framework": "CIS", "control_id": "18.9.16.2", "title": "Ensure Turn off Autoplay is set to Enabled: All drives" }, { "framework": "ANSSI", "control_id": "R21", "title": "Disable AutoRun and AutoPlay" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A13", "title": "Restrict AutoRun functionality" } ] }, { "id": "screensaver_lock", "category": "access_control", "name": "Screen Saver Password Protection", "status": "warning", "severity": "medium", "details": "Unable to query screen saver lock policy", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "19.1.3.3", "title": "Ensure Screen saver timeout is set to Enabled: 900 seconds or fewer" }, { "framework": "ANSSI", "control_id": "R29", "title": "Configure automatic screen lock" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A17", "title": "Configure screen lock policy" } ] }, { "id": "llmnr_disabled", "category": "network", "name": "LLMNR Disabled", "status": "fail", "severity": "high", "details": "LLMNR is not explicitly disabled (vulnerable to credential relay attacks)", "remediation": "Disable LLMNR: reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" /v EnableMulticast /t REG_DWORD /d 0 /f", "compliance": [ { "framework": "CIS", "control_id": "18.4.1", "title": "Ensure Turn off multicast name resolution is set to Enabled" }, { "framework": "ANSSI", "control_id": "R10", "title": "Disable LLMNR and NetBIOS name resolution" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A11", "title": "Harden authentication mechanisms" } ] }, { "id": "wdigest_disabled", "category": "encryption", "name": "WDigest Authentication Disabled", "status": "pass", "severity": "critical", "details": "WDigest UseLogonCredential key not set (disabled by default on Server 2012 R2+)", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.3.7", "title": "Ensure WDigest Authentication is set to Disabled" }, { "framework": "ANSSI", "control_id": "R11", "title": "Disable WDigest authentication" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A8", "title": "Protect credentials in memory" } ] }, { "id": "null_session_pipes", "category": "network", "name": "Null Session Pipes Restricted", "status": "pass", "severity": "medium", "details": "Anonymous access to named pipes and shares is restricted", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "2.3.10.8", "title": "Ensure Network access: Restrict anonymous access to Named Pipes and Shares is set to Enabled" }, { "framework": "ANSSI", "control_id": "R30", "title": "Restrict null session access" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A11", "title": "Harden authentication mechanisms" } ] }, { "id": "security_event_log_size", "category": "access_control", "name": "Security Event Log Size Adequate", "status": "fail", "severity": "medium", "details": "Security event log max size is only 20480 KB (events overwritten too quickly)", "remediation": "Increase Security log size: wevtutil sl Security /ms:201326592", "compliance": [ { "framework": "CIS", "control_id": "18.9.26.4.1", "title": "Ensure Security: Specify the maximum log file size (KB) is set to Enabled: 196,608 or greater" }, { "framework": "ANSSI", "control_id": "R31", "title": "Configure adequate event log retention" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A10", "title": "Configure audit and logging" } ] }, { "id": "rdp_idle_timeout", "category": "access_control", "name": "RDP Idle Session Timeout Configured", "status": "fail", "severity": "medium", "details": "RDP idle session timeout is not configured (sessions persist indefinitely)", "remediation": "Set idle timeout to 15 min: reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" /v MaxIdleTime /t REG_DWORD /d 900000 /f", "compliance": [ { "framework": "CIS", "control_id": "18.9.65.3.10.1", "title": "Ensure Set time limit for active but idle Remote Desktop Services sessions" }, { "framework": "ANSSI", "control_id": "R16", "title": "Harden Remote Desktop configuration" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A9", "title": "Harden Remote Desktop Services" } ] }, { "id": "print_spooler_disabled", "category": "network", "name": "Print Spooler Service Disabled", "status": "fail", "severity": "critical", "details": "Print Spooler service is running (PrintNightmare vulnerability risk on servers)", "remediation": "Disable Print Spooler on servers: Stop-Service -Name 'Spooler' -Force; Set-Service -Name 'Spooler' -StartupType Disabled", "compliance": [ { "framework": "CIS", "control_id": "5.36", "title": "Ensure Print Spooler (Spooler) is set to Disabled" }, { "framework": "STIG", "control_id": "V-253370", "title": "PrintNightmare - Print Spooler must be disabled unless required" }, { "framework": "ANSSI", "control_id": "R24", "title": "Disable unnecessary services" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A14", "title": "Harden system services" } ] }, { "id": "sehop_enabled", "category": "access_control", "name": "SEHOP (Structured Exception Handler Overwrite Protection)", "status": "pass", "severity": "high", "details": "SEHOP is enabled (exception handler chain validation active)", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.3.4", "title": "Ensure SEHOP is enabled" }, { "framework": "ANSSI", "control_id": "R34", "title": "Enable exploit protection features" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A18", "title": "Configure network and exploit protection" } ] }, { "id": "ipv6_disabled_if_unused", "category": "network", "name": "IPv6 Disabled If Not Required", "status": "warning", "severity": "low", "details": "IPv6 configuration not explicitly managed via registry (enabled by default)", "remediation": "If IPv6 is not needed, disable it: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\" /v DisabledComponents /t REG_DWORD /d 0xFF /f", "compliance": [ { "framework": "STIG", "control_id": "V-220697", "title": "IPv6 must be disabled if not in use" }, { "framework": "ANSSI", "control_id": "R32", "title": "Disable IPv6 if not required" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A18", "title": "Configure network and exploit protection" } ] }, { "id": "lsa_protection_enabled", "category": "access_control", "name": "LSA Protection (RunAsPPL) Enabled", "status": "fail", "severity": "critical", "details": "LSA Protection (RunAsPPL) is not configured (credentials vulnerable to Mimikatz)", "remediation": "Enable LSA Protection: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" /v RunAsPPL /t REG_DWORD /d 1 /f (reboot required)", "compliance": [ { "framework": "CIS", "control_id": "18.3.5", "title": "Ensure LSA protection is enabled" }, { "framework": "ANSSI", "control_id": "R36", "title": "Enable LSA protection to prevent credential theft" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A8", "title": "Protect credentials in memory" } ] }, { "id": "w32time_configured", "category": "network", "name": "Windows Time Synchronization Configured", "status": "fail", "severity": "medium", "details": "Windows Time service is not running (audit logs and certificates may be unreliable)", "remediation": "Enable W32Time: Set-Service -Name 'W32Time' -StartupType Automatic -Status Running; w32tm /config /manualpeerlist:\"pool.ntp.org\" /syncfromflags:manual /update", "compliance": [ { "framework": "CIS", "control_id": "2.3.1.2", "title": "Ensure Windows Time service is configured" }, { "framework": "ANSSI", "control_id": "R33", "title": "Configure NTP time synchronization" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A20", "title": "Configure time synchronization" } ] }, { "id": "laps_configured", "category": "access_control", "name": "LAPS (Local Admin Password Solution) Configured", "status": "fail", "severity": "high", "details": "LAPS is not configured (local admin passwords may be identical across servers)", "remediation": "Deploy Windows LAPS via Group Policy or install legacy LAPS from Microsoft Download Center", "compliance": [ { "framework": "CIS", "control_id": "18.2.1", "title": "Ensure LAPS is installed and configured" }, { "framework": "ANSSI", "control_id": "R13", "title": "Deploy LAPS for local admin password management" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "netbios_disabled", "category": "network", "name": "NetBIOS over TCP/IP Disabled", "status": "fail", "severity": "high", "details": "NetBIOS over TCP/IP is enabled on: vmxnet3 Ethernet Adapter (credential relay risk)", "remediation": "Disable NetBIOS on each adapter: Network adapter properties \u003e IPv4 \u003e Advanced \u003e WINS \u003e Disable NetBIOS over TCP/IP", "compliance": [ { "framework": "CIS", "control_id": "18.4.2", "title": "Ensure NetBIOS over TCP/IP is disabled on all interfaces" }, { "framework": "ANSSI", "control_id": "R10", "title": "Disable LLMNR and NetBIOS name resolution" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A11", "title": "Harden authentication mechanisms" } ] }, { "id": "telemetry_restricted", "category": "access_control", "name": "Windows Telemetry Restricted", "status": "warning", "severity": "medium", "details": "Telemetry level is not configured via Group Policy (using system defaults)", "remediation": "Restrict telemetry: reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\" /v AllowTelemetry /t REG_DWORD /d 0 /f", "compliance": [ { "framework": "CIS", "control_id": "18.9.17.1", "title": "Ensure Allow Diagnostic Data is set to Diagnostic data off or Send required diagnostic data" }, { "framework": "ANSSI", "control_id": "R25", "title": "Restrict Windows telemetry and data collection" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A3", "title": "Restrict telemetry and data collection" } ] }, { "id": "no_empty_passwords", "category": "credentials", "name": "No Empty Passwords", "status": "warning", "severity": "critical", "details": "Unable to query local user password requirements", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.5", "title": "Ensure accounts require passwords" }, { "framework": "ANSSI", "control_id": "R20", "title": "Set strong passwords for user accounts" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "builtin_admin_secured", "category": "credentials", "name": "Built-in Administrator Account Disabled", "status": "warning", "severity": "high", "details": "Unable to query built-in Administrator account", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.1", "title": "Ensure the built-in administrator account is disabled" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "cached_credentials_limited", "category": "credentials", "name": "Cached Credentials Limited", "status": "warning", "severity": "medium", "details": "Cached logon count is 10 (recommended: 4 or fewer)", "remediation": "Reduce cached logons: reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v CachedLogonsCount /t REG_SZ /d 4 /f", "compliance": [ { "framework": "CIS", "control_id": "2.3.7.6", "title": "Interactive logon: Number of previous logons to cache" }, { "framework": "ANSSI", "control_id": "R11", "title": "Limit credential caching" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A8", "title": "Protect credentials in memory" } ] }, { "id": "auto_admin_logon_disabled", "category": "credentials", "name": "Auto Admin Logon Disabled", "status": "pass", "severity": "critical", "details": "AutoAdminLogon is disabled", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "18.9.16.1", "title": "Ensure AutoAdminLogon is set to Disabled" }, { "framework": "ANSSI", "control_id": "R11", "title": "Protect stored credentials" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A8", "title": "Protect credentials in memory" } ] }, { "id": "reversible_encryption_disabled", "category": "credentials", "name": "Reversible Password Encryption Disabled", "status": "pass", "severity": "critical", "details": "Reversible password encryption is disabled", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.7", "title": "Ensure Store passwords using reversible encryption is set to Disabled" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] }, { "id": "no_password_never_expires", "category": "credentials", "name": "No Accounts With Non-Expiring Passwords", "status": "warning", "severity": "medium", "details": "Unable to query local user password expiration", "remediation": "", "compliance": [ { "framework": "CIS", "control_id": "1.1.6", "title": "Ensure password expiration policies are applied" }, { "framework": "ANSSI", "control_id": "R20", "title": "Configure password policy" }, { "framework": "BSI", "control_id": "SYS.1.2.3.A5", "title": "Protect access mechanisms" } ] } ] }, "timestamp": 1781262193313972100 }
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de