<div dir="ltr"><p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">Product:<br>
</span></b><span lang="EN"> BigFix
Compliance</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">Title:<br>
</span></b><span lang="EN">Updated Universal Checklist for Windows Server (Beta)
to support more recent versions of CIS and DISA benchmarks.</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><i><span lang="EN">Note: The Universal Checklist for
Windows Server remains in Beta. This release updates the Beta content with the
latest benchmark coverage.</span></i></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">New to the Universal Checklist for
Windows Server? See the original Beta announcement here:
<a href="https://forum.bigfix.com/t/announcing-the-beta-release-universal-checklist-for-windows-server/52706">https://forum.bigfix.com/t/announcing-the-beta-release-universal-checklist-for-windows-server/52706</a></span><span lang="EN" style="font-family:"Roboto Mono";color:rgb(24,128,56)"></span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">Published Sites:<br>
</span></b><span lang="EN"> Universal
Checklist for Windows Server, site version 4.<br>
(The site version is provided for
air-gap customers.)</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">Details: Universal Checklist for
Windows Server (Beta)</span></b></p>
<p class="MsoNormal" style="margin:12pt 0in 0.0001pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Total Fixlets: 525</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Total New Fixlets: 17</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Total Updated Fixlets:47</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Total Deleted Fixlets: 0</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Fixlets with Remediation: 510</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Parameterized Fixlets : 378</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Benchmark Sources: CIS and DISA
STIGs</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Applies To: Windows Server 2016,
2019, 2022, 2025</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">NEW FIXLETS:</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Disable HTTP proxy
features: Disable WPAD' is set to 'Enabled: Checked'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Enable / disable CLFS
logfile authentication' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Disable HTTP proxy
features: Disable proxy authentication' is set to 'Enabled: Disable
authentication over loopback interfaces' or higher</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit file system failures.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit file system successes.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit handle manipulation failures.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit handle manipulation successes.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit registry failures.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
to audit registry successes.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Windows Server must be configured
for named-based strong mappings for certificates.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Join Microsoft MAPS' is
set to 'Enabled: Advanced'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Require IPPS for IPP
printers' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Set TLS/SSL security
policy for IPP printers: Disallow invalid certificate authority' is set to
'Enabled: Checked'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Set TLS/SSL security
policy for IPP printers: Disallow invalid certificate common name' is set to
'Enabled: Checked'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Set TLS/SSL security
policy for IPP printers: Disallow invalid certificate date' is set to 'Enabled:
Checked'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Set TLS/SSL security
policy for IPP printers: Disallow non-server certificates' is set to 'Enabled:
Checked'</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Impersonate a client after
authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE,
SERVICE, RESTRICTED SERVICES\PrintSpoolerService'</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN"> </span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN"> </span></p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN"> </span></p>
<p class="MsoNormal" style="margin:0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">UPDATED FIXLETS:</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Interactive logon: Do not
require CTRL+ALT+DEL' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Windows Firewall: Domain:
Logging: Name' is configured</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Windows Firewall: Private:
Logging: Name' is configured</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Windows Firewall: Public:
Logging: Name' is configured</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Limit Diagnostic Log
Collection' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Limit Dump Collection' is
set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Enable OneSettings
Auditing' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Set time limit for active
but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or
less, but not Never (0)'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Configure 'Accounts: Rename guest
account'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Configure 'Accounts: Rename
administrator account'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Account lockout duration'
is set to '15 or more minute(s)'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure validation of
ROCA-vulnerable WHfB keys during authentication' is set to 'Enabled: Block' (DC
only)</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Post-authentication
actions: Actions' is set to 'Enabled: Reset the password and logoff the managed
account' or higher</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Password Settings:
Password Complexity' is set to 'Enabled: Large letters + small letters +
numbers + special characters' or 'Passphrase'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Prevent automatic download
of applications associated with device metadata' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure Deny log on as a service
user right on domain-joined member servers must be configured to prevent access
from highly privileged domain accounts. No other groups or accounts must be
assigned this right.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure Deny log on as a batch job
user right on domain-joined member servers must be configured to prevent access
from highly privileged domain accounts and from unauthenticated access on all
systems.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Enable Certificate
Padding' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Reset account lockout
counter after' is set to '15 or more minute(s)'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Toggle user control over
Insider builds' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn off Microsoft
Defender AntiVirus' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Change the time zone' is
set to 'Administrators, LOCAL SERVICE'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'MSS:
(ScreenSaverGracePeriod) The time in seconds before the screen saver grace
period expires' is set to 'Enabled: 5 or fewer seconds'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure registry policy
processing: Do not apply during periodic background processing' is set to
'Enabled: FALSE'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn off picture password
sign-in' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn off Microsoft
consumer experiences' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Disable OneSettings
Downloads' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Join Microsoft MAPS' is
set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure local setting
override for reporting to Microsoft MAPS' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure Attack Surface
Reduction rules' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure Attack Surface
Reduction rules: Set the state for each ASR rule' is configured</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Prevent users and apps
from accessing dangerous websites' is set to 'Enabled: Block'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Enable file hash
computation feature' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Scan all downloaded files
and attachments' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn off real-time
protection' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn on script scanning'
is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure Watson events'
is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Scan packed executables'
is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Scan removable drives' is
set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Turn on e-mail scanning'
is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Configure detection for
potentially unwanted applications' is set to 'Enabled: Block'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Allow Custom SSPs and APs
to be loaded into LSASS' is set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'WDigest Authentication' is
set to 'Disabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Network security: Do not
store LAN Manager hash value on next password change' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Do not allow WebAuthn
redirection' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure 'Prevent device metadata
retrieval from the Internet' is set to 'Enabled'</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">Ensure impersonate a client after
authentication user right must only be assigned to Administrators, Service,
Local Service, and Network Service.</span></p>
<p class="MsoNormal" style="margin:0in 0in 0in 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN"> </span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">Actions to take:</span></b></p>
<p class="MsoNormal" style="margin:12pt 0in 0.0001pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">To subscribe to the above site,
you can use the License Overview Dashboard to enable and gather the site. Note
that you must be entitled to the BigFix Compliance product, and you must be
using BigFix version 10 and later.</span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">If you use custom sites, update
your custom sites accordingly to use the latest content. You can synchronize
your content by using the Synchronize Custom Checks wizard. For more
information, see<a href="https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html"><span style="color:windowtext;text-decoration:none"> </span></a><a href="https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html">Using the Synchronize Custom Checks wizard</a>.</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><b><span lang="EN">More information:<br>
</span></b><span lang="EN"> To know more
about the BigFix Compliance SCM checklists, please see the following resources:</span></p>
<p class="MsoNormal" style="margin:12pt 0in 0.0001pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">BigFix Forum:<a href="https://forum.bigfix.com/c/release-announcements/compliance"><span style="color:windowtext;text-decoration:none"> </span></a><a href="https://forum.bigfix.com/c/release-announcements/compliance">https://forum.bigfix.com/c/release-announcements/compliance</a></span></p>
<p class="MsoNormal" style="margin:0in 0in 12pt 0.5in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">●<span style="font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:"Times New Roman"">
</span></span><span lang="EN">BigFix Compliance SCM Checklists:<a href="https://forum.bigfix.com/t/universal-compliance-checklist/54703"><span style="color:windowtext;text-decoration:none"> </span></a><a href="https://forum.bigfix.com/t/universal-compliance-checklist/54703">https://forum.bigfix.com/t/universal-compliance-checklist/54703</a></span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><span lang="EN">We hope you find this latest release of
SCM content useful and effective. Thank you.</span></p>
<p class="MsoNormal" style="margin:12pt 0in;line-height:115%;font-size:11pt;font-family:Arial,sans-serif"><i><span lang="EN">– The BigFix Compliance team</span></i><span lang="EN"></span></p></div>