What is the Security Benchmark Score? The Belarc Advisor has audited the security of your computer using a benchmark appropriate to your operating system. The result is a number between zero and ten that gives a measure of the vulnerability of your system to potential threats. The higher the number the less vulnerable your system.

Why are security benchmarks important for IT security? Many current threats are not stopped by perimeter security systems such as firewall and anti-virus systems. Setting and monitoring configurations based on consensus benchmarks is a critical step because this is a pro-active way to avoid many successful attacks. To request a copy of our white paper, "Securing the Enterprise", click here.

What is the DISA Windows 10 Benchmark? The US Department of Defense (DoD) Defense Information Systems Agency (DISA) develops Security Technical Implementation Guides (STIGs) used to secure DoD computers. The DISA Windows 10 STIG is a set of configurations and checklists that describe how to minimize network-based attacks and prevent system access when the attacker is interfacing with the system, either physically at the machine or over a network. Developed by DISA, this benchmark is the standard that many DoD organizations adhere to. Click here for details.

What is the USGCB Benchmark? The United States Government Configuration Baseline (USGCB) is a US Government OMB-mandated security configuration for Windows 7 and Internet Explorer 8. Developed by DoD, with NIST assistance, the benchmark is the product of DoD consensus. Click here for details.

How can you reduce your security vulnerability? The local group policy editor (accessed by running the gpedit.msc command) can be used to configure security settings for your computer. Windows home editions don't include that editor, but most security settings can also be made with registry entries instead. Warning: Applying these security settings may cause some applications to stop working correctly. Back up your system prior to applying these security templates or apply the templates on a test system first. For domain member computers, the benchmark configurations are available from the benchmark creator's web site as Microsoft Group Policy Object files that can be used with Active Directory. Follow the links above to the web site of your Benchmark's creator.

Security Benchmark Score Details

Computer Name:	galaxy (in WORKGROUP)
Profile Date:	Sunday, August 11, 2024 6:36:41 PM
Advisor Version:	11.1
Windows Logon:	armyd

Try BelManage, the Enterprise version of the Belarc Advisor

Personal Home Use Only

Score:	3.61 of 10 (what's this?)
Benchmark:	DISA - Windows 10, Version 1.18

= Pass

= Partial

= Fail

Expand all sections

Operating System Settings		Section Result: 8 of 15 settings pass
1.	Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.
2.	Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
3.	Windows 10 systems must be maintained at a supported servicing level.
4.	Local volumes must be formatted using NTFS.
5.	Accounts must be configured to require password expiration.
6.	Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
7.	Simple Network Management Protocol (SNMP) must not be installed on the system.
8.	Simple TCP/IP Services must not be installed on the system.
9.	The Telnet Client must not be installed on the system.
10.	The TFTP Client must not be installed on the system.
11.	The Windows PowerShell 2.0 feature must be disabled on the system.
12.	The Server Message Block (SMB) v1 protocol must be disabled on the system.
13.	The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
14.	The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
15.	The Secondary Logon service must be disabled on Windows 10.

Account Lockout and Password Policy Settings		Section Result: 5 of 9 settings pass
1.	Windows 10 account lockout duration must be configured to 15 minutes or greater.
2.	The number of allowed bad logon attempts must be configured to 3 or less.
3.	The period of time before the bad logon counter is reset must be configured to 15 minutes.
4.	The password history must be configured to 24 passwords remembered.
5.	The maximum password age must be configured to 60 days or less.
6.	The minimum password age must be configured to at least 1 day.
7.	Passwords must, at a minimum, be 14 characters.
8.	The built-in Microsoft password complexity filter must be enabled.
9.	Reversible password encryption must be disabled.

User Rights Assignments		Section Result: 20 of 28 settings pass
1.	The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
2.	The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.
3.	The Act as part of the operating system user right must not be assigned to any groups or accounts.
4.	The Allow log on locally user right must only be assigned to the Administrators and Users groups.
5.	The Back up files and directories user right must only be assigned to the Administrators group.
6.	The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\autotimesvc.
7.	The Create a pagefile user right must only be assigned to the Administrators group.
8.	The Create a token object user right must not be assigned to any groups or accounts.
9.	The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
10.	The Create permanent shared objects user right must not be assigned to any groups or accounts.
11.	The Create symbolic links user right must only be assigned to the Administrators group.
12.	The Debug programs user right must only be assigned to the Administrators group.
13.	The Deny access to this computer from the network right must prevent unauthenticated access and access from highly privileged domain accounts and local accounts on domain systems.
14.	The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
15.	The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.
16.	The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.
17.	The Deny log on through Remote Desktop Services user right must be configured to prevent unauthenticated access and access from highly privileged domain and local accounts on domain systems.
18.	The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.
19.	The Force shutdown from a remote system user right must only be assigned to the Administrators group.
20.	The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
21.	The Load and unload device drivers user right must only be assigned to the Administrators group.
22.	The Lock pages in memory user right must not be assigned to any groups or accounts.
23.	The Manage auditing and security log user right must only be assigned to the Administrators group.
24.	The Modify firmware environment values user right must only be assigned to the Administrators group.
25.	The Perform volume maintenance tasks user right must only be assigned to the Administrators group.
26.	The Profile single process user right must only be assigned to the Administrators group.
27.	The Restore files and directories user right must only be assigned to the Administrators group.
28.	The Take ownership of files or other objects user right must only be assigned to the Administrators group.

Security Options Settings		Section Result: 19 of 40 settings pass
1.	The built-in administrator account must be disabled.
2.	The built-in guest account must be disabled.
3.	Local accounts with blank passwords must be restricted to prevent access from the network.
4.	The built-in administrator account must be renamed.
5.	The built-in guest account must be renamed.
6.	Audit policy using subcategories must be enabled.
7.	Outgoing secure channel traffic must be encrypted or signed.
8.	Outgoing secure channel traffic must be encrypted when possible.
9.	Outgoing secure channel traffic must be signed when possible.
10.	The computer account password must not be prevented from being reset.
11.	The maximum age for machine account passwords must be configured to 30 days or less.
12.	The system must be configured to require a strong session key.
13.	The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
14.	Caching of logon credentials must be limited.
15.	The Smart Card removal option must be configured to Force Logoff or Lock Workstation.
16.	The Windows SMB client must be configured to always perform SMB packet signing.
17.	Unencrypted passwords must not be sent to third-party SMB Servers.
18.	The Windows SMB server must be configured to always perform SMB packet signing.
19.	Anonymous enumeration of SAM accounts must not be allowed.
20.	Anonymous enumeration of shares must be restricted.
21.	The system must be configured to prevent anonymous users from having the same rights as the Everyone group.
22.	Anonymous access to Named Pipes and Shares must be restricted.
23.	Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
24.	NTLM must be prevented from falling back to a Null session.
25.	PKU2U authentication using online identities must be prevented.
26.	Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
27.	The system must be configured to prevent the storage of the LAN Manager hash of passwords.
28.	The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
29.	The system must be configured to the required LDAP client signing level.
30.	The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.
31.	The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.
32.	The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.
33.	The default permissions of global system objects must be increased.
34.	User Account Control approval mode for the built-in Administrator must be enabled.
35.	User Account Control must, at minimum, prompt administrators for consent on the secure desktop.
36.	User Account Control must automatically deny elevation requests for standard users.
37.	User Account Control must be configured to detect application installations and prompt for elevation.
38.	User Account Control must only elevate UIAccess applications that are installed in secure locations.
39.	User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
40.	User Account Control must virtualize file and registry write failures to per-user locations.

Audit Policy Settings		Section Result: 18 of 36 settings pass
1.	The system must be configured to audit Account Logon - Credential Validation failures.
2.	The system must be configured to audit Account Logon - Credential Validation successes.
3.	The system must be configured to audit Account Management - Security Group Management successes.
4.	The system must be configured to audit Account Management - User Account Management failures.
5.	The system must be configured to audit Account Management - User Account Management successes.
6.	The system must be configured to audit Detailed Tracking - Process Creation successes.
7.	The system must be configured to audit Logon/Logoff - Account Lockout failures.
8.	The system must be configured to audit Logon/Logoff - Logoff successes.
9.	The system must be configured to audit Logon/Logoff - Logon failures.
10.	The system must be configured to audit Logon/Logoff - Logon successes.
11.	The system must be configured to audit Logon/Logoff - Special Logon successes.
12.	Windows 10 must be configured to audit Object Access - File Share successes.
13.	Windows 10 must be configured to audit Object Access - Other Object Access Events successes.
14.	Windows 10 must be configured to audit Object Access - Other Object Access Events failures.
15.	The system must be configured to audit Policy Change - Audit Policy Change successes.
16.	The system must be configured to audit Policy Change - Authentication Policy Change successes.
17.	The system must be configured to audit Policy Change - Authorization Policy Change successes.
18.	The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
19.	The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
20.	The system must be configured to audit System - IPSec Driver failures.
21.	The system must be configured to audit System - Other System Events successes.
22.	The system must be configured to audit System - Other System Events failures.
23.	The system must be configured to audit System - Security State Change successes.
24.	The system must be configured to audit System - Security System Extension successes.
25.	The system must be configured to audit System - System Integrity failures.
26.	The system must be configured to audit System - System Integrity successes.
27.	Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.
28.	Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.
29.	Windows 10 permissions for the System event log must prevent access by non-privileged accounts.
30.	Windows 10 must be configured to audit Other Policy Change Events Successes.
31.	Windows 10 must be configured to audit Other Policy Change Events Failures.
32.	Windows 10 must be configured to audit other Logon/Logoff Events Successes.
33.	Windows 10 must be configured to audit other Logon/Logoff Events Failures.
34.	Windows 10 must be configured to audit Detailed File Share Failures.
35.	Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.
36.	Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.

Computer Configuration - Administrative Templates - System Settings		Section Result: 0 of 14 settings pass
1.	Command line data must be included in process creation events.
2.	Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.
3.	Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.
4.	Group Policy objects must be reprocessed even if they have not changed.
5.	Downloading print driver packages over HTTP must be prevented.
6.	Web publishing and online ordering wizards must be prevented from downloading a list of providers.
7.	Printing over HTTP must be prevented.
8.	Systems must at least attempt device authentication using certificates.
9.	The network selection user interface (UI) must not be displayed on the logon screen.
10.	Local users on domain-joined computers must not be enumerated.
11.	Users must be prompted for a password on resume from sleep (on battery).
12.	Solicited Remote Assistance must not be allowed.
13.	Users must be prevented from changing installation options.
14.	The convenience PIN for Windows 10 must be disabled.

Computer Configuration - Administrative Templates - Network Settings		Section Result: 2 of 5 settings pass
1.	Internet connection sharing must be disabled.
2.	Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\SYSVOL and \\\NETLOGON shares.
3.	Simultaneous connections to the Internet or a Windows domain must be limited.
4.	Connections to non-domain networks when connected to a domain authenticated network must be blocked.
5.	Wi-Fi Sense must be disabled.

Computer Configuration - Administrative Templates - Windows Components Settings		Section Result: 0 of 43 settings pass
1.	The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
2.	Autoplay must be turned off for non-volume devices.
3.	The default autorun behavior must be configured to prevent autorun commands.
4.	Autoplay must be disabled for all drives.
5.	Enhanced anti-spoofing for facial recognition must be enabled on Window 10.
6.	Microsoft consumer experiences must be turned off.
7.	Administrator accounts must not be enumerated during elevation.
8.	If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.
9.	Windows Telemetry must not be configured to Full.
10.	Windows Update must not obtain updates from other PCs on the Internet.
11.	The Windows Defender SmartScreen for Explorer must be enabled.
12.	Explorer Data Execution Prevention must be enabled.
13.	Turning off File Explorer heap termination on corruption must be disabled.
14.	File Explorer shell protocol must run in protected mode.
15.	Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.
16.	Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.
17.	Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.
18.	The password manager function in the Edge browser must be disabled.
19.	The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.
20.	Windows 10 must be configured to disable Windows Game Recording and Broadcasting.
21.	Windows 10 must be configured to require a minimum pin length of six characters or greater.
22.	Passwords must not be saved in the Remote Desktop Client.
23.	Local drives must be prevented from sharing with Remote Desktop Session Hosts.
24.	Remote Desktop Services must always prompt a client for passwords upon connection.
25.	The Remote Desktop Session Host must require secure RPC communications.
26.	Remote Desktop Services must be configured with the client connection encryption set to the required level.
27.	Attachments must be prevented from being downloaded from RSS feeds.
28.	Basic authentication for RSS feeds over HTTP must not be used.
29.	Indexing of encrypted files must be turned off.
30.	Users must be prevented from changing installation options.
31.	The Windows Installer Always install with elevated privileges must be disabled.
32.	Automatically signing in the last interactive user after a system-initiated restart must be disabled.
33.	PowerShell script block logging must be enabled on Windows 10.
34.	The Windows Remote Management (WinRM) client must not use Basic authentication.
35.	The Windows Remote Management (WinRM) client must not allow unencrypted traffic.
36.	The Windows Remote Management (WinRM) service must not use Basic authentication.
37.	The Windows Remote Management (WinRM) service must not allow unencrypted traffic.
38.	The Windows Remote Management (WinRM) service must not store RunAs credentials.
39.	The Windows Remote Management (WinRM) client must not use Digest authentication.
40.	Windows Ink Workspace configured but disallow access above the lock.
41.	The Application event log size must be configured to 32768 KB or greater.
42.	The Security event log size must be configured to 1024000 KB or greater.
43.	The System event log size must be configured to 32768 KB or greater.

Computer Configuration - Administrative Templates - Other Settings		Section Result: 1 of 11 settings pass
1.	The display of slide shows on the lock screen must be disabled.
2.	IPv6 source routing must be configured to highest protection.
3.	The system must be configured to prevent IP source routing.
4.	The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.
5.	The system must be configured to ignore NetBIOS name release requests except from WINS servers.
6.	Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.
7.	WDigest Authentication must be disabled.
8.	The user must be prompted for a password on resume from sleep (plugged in).
9.	Solicited Remote Assistance must not be allowed.
10.	Unauthenticated RPC clients must be restricted from connecting to the RPC server.
11.	The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.

		Security Patches		Section Result: 0 of 1 settings pass
		1.	Security Patches Up-To-Date