================================================================================ Windows Group Policy Security Audit Report Domain: CORPNET.INTERNAL Domain Controller: DC01.corpnet.internal (Windows Server 2022) Audit Date: 2026-04-08 10:15:33 UTC Auditor: GPOAudit v2.4.1 ================================================================================ Overall Compliance Score: 31 / 100 [######........................] Baseline: CIS Microsoft Windows Server 2022 Benchmark v2.0.0 ================================================================================ ACCOUNT POLICIES ================================================================================ [FAIL] Password Policy - Minimum Password Length Current: 0 characters (no minimum) CIS Req: 14 characters minimum GPO Path: Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy Risk: CRITICAL - Users can set empty or single-character passwords. [FAIL] Password Policy - Password Complexity Requirements Current: Disabled CIS Req: Enabled (must contain uppercase, lowercase, digit, special char) Risk: HIGH - Passwords like "password" or "123456" are permitted. [FAIL] Password Policy - Maximum Password Age Current: 0 days (passwords never expire) CIS Req: 365 days or less Risk: MEDIUM - Compromised passwords remain valid indefinitely. [FAIL] Password Policy - Minimum Password Age Current: 0 days CIS Req: 1 day minimum Risk: LOW - Users can cycle through password history instantly. [FAIL] Password Policy - Enforce Password History Current: 0 passwords remembered CIS Req: 24 passwords remembered Risk: MEDIUM - Users can immediately reuse old passwords. [FAIL] Account Lockout Policy - Account Lockout Threshold Current: 0 (account lockout disabled) CIS Req: 5 invalid logon attempts Risk: CRITICAL - Unlimited brute-force attempts against any account. [FAIL] Account Lockout Policy - Account Lockout Duration Current: Not configured (lockout disabled) CIS Req: 15 minutes or greater Risk: CRITICAL - No lockout means no brute-force mitigation. [FAIL] Account Lockout Policy - Reset Account Lockout Counter Current: Not configured CIS Req: 15 minutes or greater Risk: HIGH - Dependent on lockout threshold being enabled. ================================================================================ AUDIT POLICIES ================================================================================ [FAIL] Audit Policy - Audit Logon Events Current: No Auditing CIS Req: Success and Failure Risk: HIGH - Failed and successful logons are not logged. [FAIL] Audit Policy - Audit Account Logon Events Current: No Auditing CIS Req: Success and Failure Risk: HIGH - Kerberos/NTLM authentication events are not tracked. [FAIL] Audit Policy - Audit Object Access Current: No Auditing CIS Req: Success and Failure Risk: MEDIUM - File and registry access attempts are not logged. [FAIL] Audit Policy - Audit Privilege Use Current: No Auditing CIS Req: Success and Failure Risk: HIGH - Privilege escalation events are invisible. [FAIL] Audit Policy - Audit Process Creation Current: No Auditing CIS Req: Success Risk: HIGH - Malware execution and process injection are not tracked. [FAIL] Audit Policy - Include Command Line in Process Creation Events Current: Disabled CIS Req: Enabled GPO Path: Computer Configuration > Administrative Templates > System > Audit Process Creation Risk: HIGH - Cannot see what arguments were passed to executed processes. [FAIL] Audit Policy - Audit Policy Change Current: No Auditing CIS Req: Success and Failure Risk: CRITICAL - Attackers can modify audit policies without detection. ================================================================================ POWERSHELL LOGGING ================================================================================ [FAIL] PowerShell - Module Logging Current: Disabled CIS Req: Enabled for all modules (*) GPO Path: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Module Logging Risk: CRITICAL - PowerShell-based attacks leave no trace. [FAIL] PowerShell - Script Block Logging Current: Disabled CIS Req: Enabled GPO Path: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Block Logging Risk: CRITICAL - Obfuscated and encoded PowerShell commands are not logged. [FAIL] PowerShell - Transcription Logging Current: Disabled CIS Req: Enabled with output directory configured Risk: HIGH - No record of interactive PowerShell sessions. [WARN] PowerShell - Constrained Language Mode Current: Not enforced CIS Req: Enforce via AppLocker or WDAC Risk: HIGH - Unrestricted PowerShell allows .NET, COM, and WMI access. ================================================================================ WINDOWS DEFENDER / ENDPOINT PROTECTION ================================================================================ [FAIL] Windows Defender - Real-Time Protection Current: Enabled Status: PASS - Real-time protection is active. Note: However, see exclusion findings below. [FAIL] Windows Defender - Exclusion Paths Current: C:\, D:\Shares, C:\Users, C:\ProgramData, C:\Windows\Temp CIS Req: Minimize exclusions to specific application paths only Risk: CRITICAL - Exclusions cover nearly the entire filesystem. Malware dropped in any excluded path will not be scanned. [FAIL] Windows Defender - Exclusion Extensions Current: .exe, .dll, .ps1, .bat, .cmd, .vbs, .js CIS Req: No executable extension exclusions Risk: CRITICAL - All common malware file types are excluded from scanning. [FAIL] Windows Defender - Exclusion Processes Current: powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe CIS Req: No exclusions for LOLBins (Living Off the Land Binaries) Risk: CRITICAL - Key attack tools are explicitly excluded from monitoring. [FAIL] Windows Defender - Controlled Folder Access Current: Disabled CIS Req: Enabled (Block mode) Risk: HIGH - No ransomware protection for user data folders. [FAIL] Windows Defender - Attack Surface Reduction (ASR) Rules Current: Not configured CIS Req: Enable all ASR rules in Block mode Risk: HIGH - No protection against Office macro abuse, credential theft, or untrusted process execution. [FAIL] Windows Defender - Network Protection Current: Disabled CIS Req: Enabled (Block mode) Risk: MEDIUM - No web-based threat protection at the endpoint level. ================================================================================ APPLICATION CONTROL ================================================================================ [FAIL] AppLocker - Executable Rules Current: Not configured (no AppLocker policy) CIS Req: Default rules + custom allow rules for approved applications Risk: HIGH - Any executable can run. No application whitelisting. [FAIL] AppLocker - Script Rules Current: Not configured CIS Req: Restrict scripts to approved paths and publishers Risk: HIGH - Malicious scripts can execute from any location. [FAIL] AppLocker - DLL Rules Current: Not configured CIS Req: Restrict DLLs to approved publishers Risk: MEDIUM - DLL sideloading and injection attacks are unrestricted. [FAIL] Windows Defender Application Control (WDAC) Current: Not deployed CIS Req: Deploy code integrity policy in enforced mode Risk: HIGH - No kernel-level code integrity enforcement. ================================================================================ REMOTE ACCESS ================================================================================ [FAIL] Remote Desktop - User Access Current: Allowed for "Everyone" group CIS Req: Restrict to specific security group (e.g., "RDP-Users") GPO Path: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Allow log on through Remote Desktop Services Risk: CRITICAL - Any domain user can RDP to any server. [FAIL] Remote Desktop - Network Level Authentication (NLA) Current: Disabled CIS Req: Enabled Risk: HIGH - Pre-authentication not required. Exposes RDP to exploits like BlueKeep (CVE-2019-0708). [FAIL] Remote Desktop - Session Timeout Current: No idle timeout configured CIS Req: 15 minutes idle timeout, 8 hour maximum session Risk: MEDIUM - Abandoned sessions remain active indefinitely. [WARN] WinRM Service Current: Enabled with HTTP listener (tcp/5985) CIS Req: HTTPS only (tcp/5986) with certificate authentication Risk: HIGH - WinRM over HTTP transmits credentials in plaintext on the local network. ================================================================================ ADDITIONAL FINDINGS ================================================================================ [FAIL] Local Administrator Account Current: Enabled, account name "Administrator" (default) CIS Req: Rename and disable the built-in Administrator account Risk: MEDIUM - Default account name is the first target for brute-force. [FAIL] Guest Account Current: Enabled CIS Req: Disabled Risk: MEDIUM - Guest account provides unauthenticated local access. [FAIL] SMBv1 Protocol Current: Enabled CIS Req: Disabled Risk: CRITICAL - SMBv1 is vulnerable to EternalBlue (MS17-010) and related exploits. WannaCry and NotPetya spread via SMBv1. [FAIL] LLMNR (Link-Local Multicast Name Resolution) Current: Enabled CIS Req: Disabled GPO Path: Computer Configuration > Administrative Templates > Network > DNS Client > Turn Off Multicast Name Resolution Risk: HIGH - LLMNR poisoning allows credential interception on the local network (Responder/Inveigh attacks). [FAIL] NetBIOS over TCP/IP Current: Enabled CIS Req: Disabled Risk: MEDIUM - Similar to LLMNR, enables name resolution poisoning. [FAIL] Windows Remote Management (WinRM) - Allow Unencrypted Traffic Current: Enabled CIS Req: Disabled Risk: HIGH - Credentials and data can be intercepted in transit. [WARN] LAPS (Local Administrator Password Solution) Current: Not deployed CIS Req: Deploy LAPS to all workstations and member servers Risk: HIGH - Local administrator passwords are likely identical across machines, enabling lateral movement. ================================================================================ SUMMARY ================================================================================ Total Checks: 42 Passed: 1 Failed: 38 Warnings: 3 Critical Findings: 10 High Findings: 18 Medium Findings: 9 Low Findings: 1 TOP PRIORITIES: 1. Enable account lockout policy (brute-force prevention) 2. Fix Windows Defender exclusions (nearly all scanning is bypassed) 3. Enable PowerShell logging (module, script block, transcription) 4. Disable SMBv1 (EternalBlue/WannaCry vector) 5. Restrict Remote Desktop to specific security groups 6. Enable all audit policies (logon, process creation, privilege use) 7. Deploy AppLocker or WDAC for application whitelisting 8. Enforce password complexity and minimum length ================================================================================ END OF REPORT ================================================================================