Product:
BigFix Compliance
Title:
Updated Universal Checklist for Windows Workstation (Beta) to support more recent versions of CIS and DISA benchmarks.
Note: The Universal Checklist for Windows Workstation remains in Beta. This release updates the Beta content with the latest benchmark coverage.
New to the Universal Checklist for Windows Workstation? See the original Beta announcement here: Announcing the Beta Release: Universal Checklist for Windows Workstation
Published Sites:
Universal Checklist for Windows Workstation, site version 3
(The site version is provided for air-gap customers.)
Details: Universal Checklist for Windows Workstation (Beta)
Total Fixlets: 657
Total New Fixlets: 2
Total Updated Fixlets: 14
Total Deleted Fixlets: 1
Fixlets with Remediation: 632
Parameterized Fixlets: 532
Benchmark Sources: CIS and DISA STIGs
Applies To: Windows Workstation 10 & 11
ADDED
All Wi-Fi Direct adapters must be disabled on the system.
Bluetooth must be turned off unless approved by the organization.
REMOVED
Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + special characters' (extra fixlet)
UPDATED
Ensure 'Password Settings: Password Complexity' is set to 'Enabled: Large letters + small letters + numbers + specials' or higher
Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)'
Ensure 'Enable OneSettings Auditing' is set to 'Enabled'
The US DoW CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
The DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.
The DoW Root CA certificates must be installed in the Trusted Root Store.
The use of a hardware security device with Windows Hello for Business must be enabled.
Configure 'Interactive logon: Message text for users attempting to log on'
Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute'
Windows Workstation must be configured to audit file system failures.
Windows Workstation must be configured to audit file system successes.
Windows Workstation must be configured to audit handle manipulation successes.
Windows Workstation must be configured to require a minimum pin length of six characters or greater.
The Windows PowerShell 2.0 feature must be disabled on the system.
Actions to take:
To subscribe to the above site, you can use the License Overview Dashboard to enable and gather the site. Note that you must be entitled to the BigFix Compliance product, and you must be using BigFix version 10 and later.
If you use custom sites, update your custom sites accordingly to use the latest content. You can synchronize your content by using the Synchronize Custom Checks wizard. For more information, see Using the Synchronize Custom Checks wizard.
More information:
To know more about the BigFix Compliance SCM checklists, please see the following resources:
BigFix Forum: https://forum.bigfix.com/c/release-announcements/compliance
BigFix Compliance SCM Checklists: Universal Compliance Checklist
We hope you find this latest release of SCM content useful and effective. Thank you.
– The BigFix Compliance team