================================================================================
  Windows Group Policy Security Audit Report
  Domain: CORPNET.INTERNAL
  Domain Controller: DC01.corpnet.internal (Windows Server 2022)
  Audit Date: 2026-04-08 10:15:33 UTC
  Auditor: GPOAudit v2.4.1
================================================================================

  Overall Compliance Score: 31 / 100  [######........................]
  Baseline: CIS Microsoft Windows Server 2022 Benchmark v2.0.0

================================================================================
  ACCOUNT POLICIES
================================================================================

[FAIL] Password Policy - Minimum Password Length
  Current:  0 characters (no minimum)
  CIS Req:  14 characters minimum
  GPO Path: Computer Configuration > Policies > Windows Settings > Security
            Settings > Account Policies > Password Policy
  Risk:     CRITICAL - Users can set empty or single-character passwords.

[FAIL] Password Policy - Password Complexity Requirements
  Current:  Disabled
  CIS Req:  Enabled (must contain uppercase, lowercase, digit, special char)
  Risk:     HIGH - Passwords like "password" or "123456" are permitted.

[FAIL] Password Policy - Maximum Password Age
  Current:  0 days (passwords never expire)
  CIS Req:  365 days or less
  Risk:     MEDIUM - Compromised passwords remain valid indefinitely.

[FAIL] Password Policy - Minimum Password Age
  Current:  0 days
  CIS Req:  1 day minimum
  Risk:     LOW - Users can cycle through password history instantly.

[FAIL] Password Policy - Enforce Password History
  Current:  0 passwords remembered
  CIS Req:  24 passwords remembered
  Risk:     MEDIUM - Users can immediately reuse old passwords.

[FAIL] Account Lockout Policy - Account Lockout Threshold
  Current:  0 (account lockout disabled)
  CIS Req:  5 invalid logon attempts
  Risk:     CRITICAL - Unlimited brute-force attempts against any account.

[FAIL] Account Lockout Policy - Account Lockout Duration
  Current:  Not configured (lockout disabled)
  CIS Req:  15 minutes or greater
  Risk:     CRITICAL - No lockout means no brute-force mitigation.

[FAIL] Account Lockout Policy - Reset Account Lockout Counter
  Current:  Not configured
  CIS Req:  15 minutes or greater
  Risk:     HIGH - Dependent on lockout threshold being enabled.

================================================================================
  AUDIT POLICIES
================================================================================

[FAIL] Audit Policy - Audit Logon Events
  Current:  No Auditing
  CIS Req:  Success and Failure
  Risk:     HIGH - Failed and successful logons are not logged.

[FAIL] Audit Policy - Audit Account Logon Events
  Current:  No Auditing
  CIS Req:  Success and Failure
  Risk:     HIGH - Kerberos/NTLM authentication events are not tracked.

[FAIL] Audit Policy - Audit Object Access
  Current:  No Auditing
  CIS Req:  Success and Failure
  Risk:     MEDIUM - File and registry access attempts are not logged.

[FAIL] Audit Policy - Audit Privilege Use
  Current:  No Auditing
  CIS Req:  Success and Failure
  Risk:     HIGH - Privilege escalation events are invisible.

[FAIL] Audit Policy - Audit Process Creation
  Current:  No Auditing
  CIS Req:  Success
  Risk:     HIGH - Malware execution and process injection are not tracked.

[FAIL] Audit Policy - Include Command Line in Process Creation Events
  Current:  Disabled
  CIS Req:  Enabled
  GPO Path: Computer Configuration > Administrative Templates > System >
            Audit Process Creation
  Risk:     HIGH - Cannot see what arguments were passed to executed processes.

[FAIL] Audit Policy - Audit Policy Change
  Current:  No Auditing
  CIS Req:  Success and Failure
  Risk:     CRITICAL - Attackers can modify audit policies without detection.

================================================================================
  POWERSHELL LOGGING
================================================================================

[FAIL] PowerShell - Module Logging
  Current:  Disabled
  CIS Req:  Enabled for all modules (*)
  GPO Path: Computer Configuration > Administrative Templates > Windows
            Components > Windows PowerShell > Turn on Module Logging
  Risk:     CRITICAL - PowerShell-based attacks leave no trace.

[FAIL] PowerShell - Script Block Logging
  Current:  Disabled
  CIS Req:  Enabled
  GPO Path: Computer Configuration > Administrative Templates > Windows
            Components > Windows PowerShell > Turn on Script Block Logging
  Risk:     CRITICAL - Obfuscated and encoded PowerShell commands are not logged.

[FAIL] PowerShell - Transcription Logging
  Current:  Disabled
  CIS Req:  Enabled with output directory configured
  Risk:     HIGH - No record of interactive PowerShell sessions.

[WARN] PowerShell - Constrained Language Mode
  Current:  Not enforced
  CIS Req:  Enforce via AppLocker or WDAC
  Risk:     HIGH - Unrestricted PowerShell allows .NET, COM, and WMI access.

================================================================================
  WINDOWS DEFENDER / ENDPOINT PROTECTION
================================================================================

[FAIL] Windows Defender - Real-Time Protection
  Current:  Enabled
  Status:   PASS - Real-time protection is active.
  Note:     However, see exclusion findings below.

[FAIL] Windows Defender - Exclusion Paths
  Current:  C:\, D:\Shares, C:\Users, C:\ProgramData, C:\Windows\Temp
  CIS Req:  Minimize exclusions to specific application paths only
  Risk:     CRITICAL - Exclusions cover nearly the entire filesystem. Malware
            dropped in any excluded path will not be scanned.

[FAIL] Windows Defender - Exclusion Extensions
  Current:  .exe, .dll, .ps1, .bat, .cmd, .vbs, .js
  CIS Req:  No executable extension exclusions
  Risk:     CRITICAL - All common malware file types are excluded from scanning.

[FAIL] Windows Defender - Exclusion Processes
  Current:  powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe
  CIS Req:  No exclusions for LOLBins (Living Off the Land Binaries)
  Risk:     CRITICAL - Key attack tools are explicitly excluded from monitoring.

[FAIL] Windows Defender - Controlled Folder Access
  Current:  Disabled
  CIS Req:  Enabled (Block mode)
  Risk:     HIGH - No ransomware protection for user data folders.

[FAIL] Windows Defender - Attack Surface Reduction (ASR) Rules
  Current:  Not configured
  CIS Req:  Enable all ASR rules in Block mode
  Risk:     HIGH - No protection against Office macro abuse, credential theft,
            or untrusted process execution.

[FAIL] Windows Defender - Network Protection
  Current:  Disabled
  CIS Req:  Enabled (Block mode)
  Risk:     MEDIUM - No web-based threat protection at the endpoint level.

================================================================================
  APPLICATION CONTROL
================================================================================

[FAIL] AppLocker - Executable Rules
  Current:  Not configured (no AppLocker policy)
  CIS Req:  Default rules + custom allow rules for approved applications
  Risk:     HIGH - Any executable can run. No application whitelisting.

[FAIL] AppLocker - Script Rules
  Current:  Not configured
  CIS Req:  Restrict scripts to approved paths and publishers
  Risk:     HIGH - Malicious scripts can execute from any location.

[FAIL] AppLocker - DLL Rules
  Current:  Not configured
  CIS Req:  Restrict DLLs to approved publishers
  Risk:     MEDIUM - DLL sideloading and injection attacks are unrestricted.

[FAIL] Windows Defender Application Control (WDAC)
  Current:  Not deployed
  CIS Req:  Deploy code integrity policy in enforced mode
  Risk:     HIGH - No kernel-level code integrity enforcement.

================================================================================
  REMOTE ACCESS
================================================================================

[FAIL] Remote Desktop - User Access
  Current:  Allowed for "Everyone" group
  CIS Req:  Restrict to specific security group (e.g., "RDP-Users")
  GPO Path: Computer Configuration > Windows Settings > Security Settings >
            Local Policies > User Rights Assignment > Allow log on through
            Remote Desktop Services
  Risk:     CRITICAL - Any domain user can RDP to any server.

[FAIL] Remote Desktop - Network Level Authentication (NLA)
  Current:  Disabled
  CIS Req:  Enabled
  Risk:     HIGH - Pre-authentication not required. Exposes RDP to exploits
            like BlueKeep (CVE-2019-0708).

[FAIL] Remote Desktop - Session Timeout
  Current:  No idle timeout configured
  CIS Req:  15 minutes idle timeout, 8 hour maximum session
  Risk:     MEDIUM - Abandoned sessions remain active indefinitely.

[WARN] WinRM Service
  Current:  Enabled with HTTP listener (tcp/5985)
  CIS Req:  HTTPS only (tcp/5986) with certificate authentication
  Risk:     HIGH - WinRM over HTTP transmits credentials in plaintext on
            the local network.

================================================================================
  ADDITIONAL FINDINGS
================================================================================

[FAIL] Local Administrator Account
  Current:  Enabled, account name "Administrator" (default)
  CIS Req:  Rename and disable the built-in Administrator account
  Risk:     MEDIUM - Default account name is the first target for brute-force.

[FAIL] Guest Account
  Current:  Enabled
  CIS Req:  Disabled
  Risk:     MEDIUM - Guest account provides unauthenticated local access.

[FAIL] SMBv1 Protocol
  Current:  Enabled
  CIS Req:  Disabled
  Risk:     CRITICAL - SMBv1 is vulnerable to EternalBlue (MS17-010) and
            related exploits. WannaCry and NotPetya spread via SMBv1.

[FAIL] LLMNR (Link-Local Multicast Name Resolution)
  Current:  Enabled
  CIS Req:  Disabled
  GPO Path: Computer Configuration > Administrative Templates > Network >
            DNS Client > Turn Off Multicast Name Resolution
  Risk:     HIGH - LLMNR poisoning allows credential interception on the
            local network (Responder/Inveigh attacks).

[FAIL] NetBIOS over TCP/IP
  Current:  Enabled
  CIS Req:  Disabled
  Risk:     MEDIUM - Similar to LLMNR, enables name resolution poisoning.

[FAIL] Windows Remote Management (WinRM) - Allow Unencrypted Traffic
  Current:  Enabled
  CIS Req:  Disabled
  Risk:     HIGH - Credentials and data can be intercepted in transit.

[WARN] LAPS (Local Administrator Password Solution)
  Current:  Not deployed
  CIS Req:  Deploy LAPS to all workstations and member servers
  Risk:     HIGH - Local administrator passwords are likely identical across
            machines, enabling lateral movement.

================================================================================
  SUMMARY
================================================================================

  Total Checks:     42
  Passed:           1
  Failed:           38
  Warnings:         3

  Critical Findings: 10
  High Findings:     18
  Medium Findings:   9
  Low Findings:      1

  TOP PRIORITIES:
  1. Enable account lockout policy (brute-force prevention)
  2. Fix Windows Defender exclusions (nearly all scanning is bypassed)
  3. Enable PowerShell logging (module, script block, transcription)
  4. Disable SMBv1 (EternalBlue/WannaCry vector)
  5. Restrict Remote Desktop to specific security groups
  6. Enable all audit policies (logon, process creation, privilege use)
  7. Deploy AppLocker or WDAC for application whitelisting
  8. Enforce password complexity and minimum length

================================================================================
  END OF REPORT
================================================================================
