| ID | Category | Name | Severity | Result | Recommended | TestResult | SeverityFinding |
|---|
| 1000 | Features | SMBv1 Support | Passed | Disabled | Disabled | Passed | High |
| 1103 | Account Policies | Store passwords using reversible encryption | Passed | 0 | 0 | Passed | High |
| 1101 | Account Policies | Account lockout duration | Passed | 30 | 15 | Passed | Low |
| 1100 | Account Policies | Account lockout threshold | Low | Never | 10 | Failed | Low |
| 1104 | Account Policies | Allow Administrator account lockout | Medium | | 1 | Failed | Medium |
| 1102 | Account Policies | Reset account lockout counter | Passed | 30 | 15 | Passed | Low |
| 1200 | User Rights Assignment | Access this computer from the network | Medium | Everyone;BUILTIN\Administrators;BUILTIN\Users;BUILTIN\Backup Operators | BUILTIN\Administrators | Failed | Medium |
| 1201 | User Rights Assignment | Allow log on locally | Medium | Guest;BUILTIN\Administrators;BUILTIN\Users;BUILTIN\Backup Operators | BUILTIN\Users;BUILTIN\Administrators | Failed | Medium |
| 1202 | User Rights Assignment | Debug programs | Medium | BUILTIN\Administrators | | Failed | Medium |
| 1203 | User Rights Assignment | Deny access to this computer from the network | Medium | Guest | BUILTIN\Guests;NT AUTHORITY\Local account | Failed | Medium |
| 1204 | User Rights Assignment | Deny log on as a batch job | Medium | | BUILTIN\Guests | Failed | Medium |
| 1205 | User Rights Assignment | Deny log on as a service | Medium | | BUILTIN\Guests | Failed | Medium |
| 1206 | User Rights Assignment | Deny log on through Remote Desktop Services | Medium | | BUILTIN\Guests;NT AUTHORITY\Local account | Failed | Medium |
| 1300 | Security Options | Accounts: Block Microsoft accounts | Low | 0 | 3 | Failed | Low |
| 1301 | Security Options | Audit: Force audit policy subcategory settings to override audit policy category settings | Passed | 1 | 1 | Passed | Low |
| 1302 | Security Options | Interactive logon: Do not require CTRL+ALT+DEL | Low | 1 | 0 | Failed | Low |
| 1303 | Security Options | Interactive logon: Don't display last signed-in | Low | 0 | 1 | Failed | Low |
| 1304 | Security Options | Interactive logon: Don't display username at sign-in | Low | 0 | 1 | Failed | Low |
| 1305 | Security Options | Microsoft network client: Digitally sign communications (always) | Medium | 0 | 1 | Failed | Medium |
| 1306 | Security Options | Microsoft network client: Digitally sign communications (if server agrees) | Passed | 1 | 1 | Passed | Medium |
| 1307 | Security Options | Microsoft network server: Digitally sign communications (always) | Medium | 0 | 1 | Failed | Medium |
| 1308 | Security Options | Microsoft network server: Digitally sign communications (if client agrees) | Medium | 0 | 1 | Failed | Medium |
| 1309 | Security Options | Network access: Do not allow anonymous enumeration of SAM accounts | Passed | 1 | 1 | Passed | Medium |
| 1310 | Security Options | Network access: Do not allow anonymous enumeration of SAM accounts and shares | Medium | 0 | 1 | Failed | Medium |
| 1311 | Security Options | Network access: Do not allow storage of passwords and credentials for network authentication | Medium | 0 | 1 | Failed | Medium |
| 1324 | Security Options | Network access: Restrict anonymous access to Named Pipes and Shares | Passed | 1 | 1 | Passed | Medium |
| 1325 | Security Options | Network access: Restrict clients allowed to make remote calls to SAM | Medium | | O:BAG:BAD:(A;;RC;;;BA) | Failed | Medium |
| 1312 | Security Options | Network security: Allow LocalSystem NULL session fallback | Passed | 0 | 0 | Passed | Medium |
| 1326 | Security Options | Network security: Do not store LAN Manager hash value on next password change | Passed | 1 | 1 | Passed | High |
| 1313 | Security Options | Network security: LAN Manager authentication level | Medium | 3 | 5 | Failed | Medium |
| 1314 | Security Options | Network security: LDAP client signing requirements | Passed | 1 | 1 | Passed | Medium |
| 1315 | Security Options | Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Medium | 536870912 | 537395200 | Failed | Medium |
| 1316 | Security Options | Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Medium | 536870912 | 537395200 | Failed | Medium |
| 1317 | Security Options | Network security: Restrict NTLM: Audit Incoming NTLM Traffic | Medium | 0 | 2 | Failed | Medium |
| 1318 | Security Options | Network security: Restrict NTLM: Audit NTLM authentication in this domain | Medium | 0 | 7 | Failed | Medium |
| 1319 | Security Options | Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers | Medium | 0 | 1 | Failed | Medium |
| 1320 | Security Options | Shutdown: Allow system to be shut down without having to log on | Medium | 1 | 0 | Failed | Medium |
| 1321 | Security Options | User Account Control: Admin Approval Mode for the Built-in Administrator account | Medium | 0 | 1 | Failed | Medium |
| 1322 | Security Options | User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Medium | 0 | 2 | Failed | Medium |
| 1323 | Security Options | User Account Control: Behavior of the elevation prompt for standard users | Medium | 3 | 1 | Failed | Medium |
| 1400 | Windows Firewall | EnableFirewall (Domain Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1418 | Windows Firewall | EnableFirewall (Domain Profile) | Passed | 1 | 1 | Passed | Medium |
| 1401 | Windows Firewall | Inbound Connections (Domain Profile, Policy) | Passed | 1 | 1 | Passed | Medium |
| 1419 | Windows Firewall | Inbound Connections (Domain Profile) | Passed | 1 | 1 | Passed | Medium |
| 1402 | Windows Firewall | Outbound Connections (Domain Profile, Policy) | Passed | 0 | 0 | Passed | Medium |
| 1420 | Windows Firewall | Outbound Connections (Domain Profile) | Passed | 0 | 0 | Passed | Medium |
| 1403 | Windows Firewall | Log size limit (Domain Profile, Policy) | Medium | 4096 | 16384 | Failed | Medium |
| 1421 | Windows Firewall | Log size limit (Domain Profile) | Medium | 4096 | 16384 | Failed | Medium |
| 1404 | Windows Firewall | Log dropped packets (Domain Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1422 | Windows Firewall | Log dropped packets (Domain Profile) | Medium | 0 | 1 | Failed | Medium |
| 1405 | Windows Firewall | Log successful connections (Domain Profile, Policy) | Low | 0 | 1 | Failed | Low |
| 1423 | Windows Firewall | Log successful connections (Domain Profile) | Low | 0 | 1 | Failed | Low |
| 1406 | Windows Firewall | EnableFirewall (Private Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1424 | Windows Firewall | EnableFirewall (Private Profile) | Passed | 1 | 1 | Passed | Medium |
| 1407 | Windows Firewall | Inbound Connections (Private Profile, Policy) | Passed | 1 | 1 | Passed | Medium |
| 1425 | Windows Firewall | Inbound Connections (Private Profile) | Passed | 1 | 1 | Passed | Medium |
| 1408 | Windows Firewall | Outbound Connections (Private Profile, Policy) | Passed | 0 | 0 | Passed | Medium |
| 1426 | Windows Firewall | Outbound Connections (Private Profile) | Passed | 0 | 0 | Passed | Medium |
| 1409 | Windows Firewall | Log size limit (Private Profile, Policy) | Medium | 4096 | 16384 | Failed | Medium |
| 1427 | Windows Firewall | Log size limit (Private Profile) | Medium | 4096 | 16384 | Failed | Medium |
| 1410 | Windows Firewall | Log dropped packets (Private Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1428 | Windows Firewall | Log dropped packets (Private Profile) | Medium | 0 | 1 | Failed | Medium |
| 1411 | Windows Firewall | Log successful connections (Private Profile, Policy) | Low | 0 | 1 | Failed | Low |
| 1429 | Windows Firewall | Log successful connections (Private Profile) | Low | 0 | 1 | Failed | Low |
| 1412 | Windows Firewall | EnableFirewall (Public Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1430 | Windows Firewall | EnableFirewall (Public Profile) | Passed | 1 | 1 | Passed | Medium |
| 1413 | Windows Firewall | Inbound Connections (Public Profile, Policy) | Passed | 1 | 1 | Passed | Medium |
| 1431 | Windows Firewall | Inbound Connections (Public Profile) | Passed | 1 | 1 | Passed | Medium |
| 1414 | Windows Firewall | Outbound Connections (Public Profile, Policy) | Passed | 0 | 0 | Passed | Medium |
| 1432 | Windows Firewall | Outbound Connections (Public Profile) | Passed | 0 | 0 | Passed | Medium |
| 1415 | Windows Firewall | Log size limit (Public Profile, Policy) | Medium | 4096 | 16384 | Failed | Medium |
| 1433 | Windows Firewall | Log size limit (Public Profile) | Medium | 4096 | 16384 | Failed | Medium |
| 1416 | Windows Firewall | Log dropped packets (Public Profile, Policy) | Medium | 0 | 1 | Failed | Medium |
| 1434 | Windows Firewall | Log dropped packets (Public Profile) | Medium | 0 | 1 | Failed | Medium |
| 1417 | Windows Firewall | Log successful connections (Public Profile, Policy) | Low | 0 | 1 | Failed | Low |
| 1435 | Windows Firewall | Log successful connections (Public Profile) | Low | 0 | 1 | Failed | Low |
| 1500 | Advanced Audit Policy Configuration | Credential Validation | Low | No Auditing | Success and Failure | Failed | Low |
| 1501 | Advanced Audit Policy Configuration | Security Group Management | Passed | Success | Success | Passed | Low |
| 1502 | Advanced Audit Policy Configuration | User Account Management | Low | Success | Success and Failure | Failed | Low |
| 1503 | Advanced Audit Policy Configuration | DPAPI Activity | Low | No Auditing | Success and Failure | Failed | Low |
| 1504 | Advanced Audit Policy Configuration | Plug and Play Events | Low | No Auditing | Success | Failed | Low |
| 1505 | Advanced Audit Policy Configuration | Process Creation | Low | No Auditing | Success | Failed | Low |
| 1506 | Advanced Audit Policy Configuration | Account Lockout | Low | Success | Failure | Failed | Low |
| 1507 | Advanced Audit Policy Configuration | Group Membership | Low | No Auditing | Success | Failed | Low |
| 1508 | Advanced Audit Policy Configuration | Logon | Passed | Success and Failure | Success and Failure | Passed | Low |
| 1509 | Advanced Audit Policy Configuration | Other Logon/Logoff Events | Low | No Auditing | Success and Failure | Failed | Low |
| 1510 | Advanced Audit Policy Configuration | Special Logon | Passed | Success | Success | Passed | Low |
| 1511 | Advanced Audit Policy Configuration | Detailed File Share | Low | No Auditing | Failure | Failed | Low |
| 1512 | Advanced Audit Policy Configuration | File Share | Low | No Auditing | Success and Failure | Failed | Low |
| 1513 | Advanced Audit Policy Configuration | Kernel Object | Low | No Auditing | Success and Failure | Failed | Low |
| 1514 | Advanced Audit Policy Configuration | Other Object Access Events | Low | No Auditing | Success and Failure | Failed | Low |
| 1515 | Advanced Audit Policy Configuration | Removable Storage | Low | No Auditing | Success and Failure | Failed | Low |
| 1516 | Advanced Audit Policy Configuration | SAM | Low | No Auditing | Success and Failure | Failed | Low |
| 1517 | Advanced Audit Policy Configuration | Audit Policy Change | Passed | Success | Success | Passed | Low |
| 1518 | Advanced Audit Policy Configuration | Authentication Policy Change | Passed | Success | Success | Passed | Low |
| 1519 | Advanced Audit Policy Configuration | MPSSVC Rule-Level Policy Change | Low | No Auditing | Success and Failure | Failed | Low |
| 1520 | Advanced Audit Policy Configuration | Other Policy Change Events | Low | No Auditing | Failure | Failed | Low |
| 1521 | Advanced Audit Policy Configuration | Sensitive Privilege Use | Low | No Auditing | Success and Failure | Failed | Low |
| 1522 | Advanced Audit Policy Configuration | Other System Events | Passed | Success and Failure | Success and Failure | Passed | Low |
| 1523 | Advanced Audit Policy Configuration | Security State Change | Passed | Success | Success | Passed | Low |
| 1524 | Advanced Audit Policy Configuration | Security System Extension | Low | No Auditing | Success | Failed | Low |
| 1525 | Advanced Audit Policy Configuration | System Integrity | Passed | Success and Failure | Success and Failure | Passed | Low |
| 1600 | Administrative Templates: Control Panel | Personalization: Prevent enabling lock screen camera | Low | 0 | 1 | Failed | Low |
| 1601 | Administrative Templates: Network | DNS Client: Turn off multicast name resolution (LLMNR) | Medium | 1 | 0 | Failed | Medium |
| 1602 | Administrative Templates: Network | Lanman Workstation: Enable insecure guest logons | Medium | 1 | 0 | Failed | Medium |
| 1603 | Administrative Templates: Network | Turn off Microsoft Peer-to-Peer Networking Services | Medium | 0 | 1 | Failed | Medium |
| 1604 | Administrative Templates: Network | WLAN Settings: Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services | Medium | 1 | 0 | Failed | Medium |
| 2108 | Administrative Templates: PowerShellCore | Turn on PowerShell Module Logging | Low | 0 | 1 | Failed | Low |
| 2109 | Administrative Templates: PowerShellCore | Turn on PowerShell Module Logging (PowerShell Policy) | Low | 0 | 1 | Failed | Low |
| 2110 | Administrative Templates: PowerShellCore | Turn on PowerShell Module Logging - Module Names | Low | | * | Failed | Low |
| 2111 | Administrative Templates: PowerShellCore | Turn on PowerShell Script Block Logging | Medium | 0 | 1 | Failed | Medium |
| 2112 | Administrative Templates: PowerShellCore | Turn on PowerShell Script Block Logging (Invocation) | Low | 0 | 1 | Failed | Low |
| 2113 | Administrative Templates: PowerShellCore | Turn on PowerShell Script Block Logging (PowerShell Policy) | Low | 0 | 1 | Failed | Low |
| 2116 | Administrative Templates: PowerShellCore | Turn on PowerShell Transcription | Low | 0 | 1 | Failed | Low |
| 2114 | Administrative Templates: PowerShellCore | Turn on PowerShell Transcription (Invocation) | Low | 0 | 1 | Failed | Low |
| 2115 | Administrative Templates: PowerShellCore | Turn on PowerShell Transcription (PowerShell Policy) | Medium | 0 | 1 | Failed | Medium |
| 1772 | Administrative Templates: Printers | Configure Redirection Guard | Medium | | 1 | Failed | Medium |
| 1768 | Administrative Templates: Printers | Only use Package Point and Print (CVE-2021-36958) | Medium | | 1 | Failed | Medium |
| 1769 | Administrative Templates: Printers | Package Point and Print - Approved servers (CVE-2021-36958) | Medium | | 1 | Failed | Medium |
| 1764 | Administrative Templates: Printers | Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527) | Passed | 0 | 0 | Passed | High |
| 1765 | Administrative Templates: Printers | Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527) | Passed | 0 | 0 | Passed | High |
| 1771 | Administrative Templates: Start Menu and Taskbar | Notifications: Turn off notifications network usage | Medium | 0 | 1 | Failed | Medium |
| 1605 | Administrative Templates: System | Credentials Delegation: Allow delegation default credentials | Medium | 1 | 0 | Failed | Medium |
| 1606 | Administrative Templates: System | Credentials Delegation: Encryption Oracle Remediation | Passed | 0 | 0 | Passed | Medium |
| 1699 | Administrative Templates: System | Credentials Delegation: Remote host allows delegation of non-exportable credentials | Medium | 0 | 1 | Failed | Medium |
| 1607 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID | Medium | 0 | 1 | Failed | Medium |
| 1608 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices that match an ID (Retroactive) | Medium | 0 | 1 | Failed | Medium |
| 1609 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0010 (Firewire) | Medium | 0 | PCI\CC_0C0010 | Failed | Medium |
| 1610 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices that match ID PCI\CC_0C0A (Thunderbolt) | Medium | 0 | PCI\CC_0C0A | Failed | Medium |
| 1611 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class | Medium | 0 | 1 | Failed | Medium |
| 1612 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match an device setup class (Retroactive) | Medium | 0 | 1 | Failed | Medium |
| 1613 | Administrative Templates: System | Device Installation: Device Installation Restrictions: Prevent installation of devices using drivers that match d48179be-ec20-11d1-b6b8-00c04fa372a7 (SBP-2 drive) | Medium | 0 | d48179be-ec20-11d1-b6b8-00c04fa372a7 | Failed | Medium |
| 1614 | Administrative Templates: System | Device Guard: Virtualization Based Security Status | Medium | Not available | 2 | Failed | Medium |
| 1615 | Administrative Templates: System | Device Guard: Available Security Properties: Secure Boot | Medium | Not available | 2 | Failed | Medium |
| 1616 | Administrative Templates: System | Device Guard: Available Security Properties: DMA protection | Medium | Not available | 3 | Failed | Medium |
| 1617 | Administrative Templates: System | Device Guard: Security Services Configured: Credential Guard | Medium | Not available | 1 | Failed | Medium |
| 1619 | Administrative Templates: System | Device Guard: Security Services Running: Credential Guard | Medium | Not available | 1 | Failed | Medium |
| 1618 | Administrative Templates: System | Device Guard: Security Services Configured: HVCI | Medium | Not available | 2 | Failed | Medium |
| 1620 | Administrative Templates: System | Device Guard: Security Services Running: HVCI | Medium | Not available | 2 | Failed | Medium |
| 1623 | Administrative Templates: System | Device Guard: Require UEFI Memory Attributes Table (Policy) | Medium | | 1 | Failed | Medium |
| 1621 | Administrative Templates: System | Device Guard: Secure Launch Configuration (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1622 | Administrative Templates: System | Device Guard: Windows Defender Application Control deployed (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1630 | Administrative Templates: System | Early Launch Antimalware: Boot-Start Driver Initialization Policy | Medium | 0 | 3 | Failed | Medium |
| 1631 | Administrative Templates: System | Group Policy: Process even if the Group Policy objects have not changed | Low | 1 | 0 | Failed | Low |
| 1632 | Administrative Templates: System | Group Policy: Do not apply during periodic background processing | Passed | 0 | 0 | Passed | Low |
| 1640 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program | Medium | 0 | 2 | Failed | Medium |
| 1641 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off downloading of print drivers over HTTP | Medium | 0 | 1 | Failed | Medium |
| 1642 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 1 | Medium | 1 | 0 | Failed | Medium |
| 1643 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off Windows Error Reporting 2 | Passed | 1 | 1 | Passed | Medium |
| 1644 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards | Medium | 0 | 1 | Failed | Medium |
| 1645 | Administrative Templates: System | Internet Communication Management: Internet Communication settings: Turn off Windows Customer Experience Improvement Program | Passed | 0 | 0 | Passed | Medium |
| 1650 | Administrative Templates: System | Kernel DMA Protection: Enumeration policy for external devices incompatible with Kernel DMA Protection | Medium | 2 | 0 | Failed | Medium |
| 1660 | Administrative Templates: System | Logon: Turn on convenience PIN sign-in | Medium | 1 | 0 | Failed | Medium |
| 1661 | Administrative Templates: System | Logon: Turn off app notifications on the lock screen | Medium | 0 | 1 | Failed | Medium |
| 1662 | Administrative Templates: System | Logon: Do not display network selection UI | Medium | 0 | 1 | Failed | Medium |
| 1670 | Administrative Templates: System | Mitigation Options: Untrusted Font Blocking | Medium | 0 | 1000000000000 | Failed | Medium |
| 1680 | Administrative Templates: System | OS Policies: Allow Clipboard synchronization across devices | Medium | 1 | 0 | Failed | Medium |
| 1685 | Administrative Templates: System | Sleep Settings: Require a password when a computer wakes (plugged in) | Medium | 0 | 1 | Failed | Medium |
| 1686 | Administrative Templates: System | Sleep Settings: Require a password when a computer wakes (on battery) | Medium | 0 | 1 | Failed | Medium |
| 1687 | Administrative Templates: System | Sleep Settings: Allow standby states (S1-S3) when sleeping (plugged in) | Medium | 1 | 0 | Failed | Medium |
| 1688 | Administrative Templates: System | Sleep Settings: Allow standby states (S1-S3) when sleeping (on battery) | Medium | 1 | 0 | Failed | Medium |
| 1690 | Administrative Templates: System | Remote Assistance: Configure Offer Remote Assistance | Medium | 1 | 0 | Failed | Medium |
| 1691 | Administrative Templates: System | Remote Assistance: Configure Solicited Remote Assistance | Medium | 1 | 0 | Failed | Medium |
| 1692 | Administrative Templates: System | Remote Procedure Call: Enable RPC Endpoint Mapper Client Authentication | Medium | 0 | 1 | Failed | Medium |
| 1693 | Administrative Templates: System | Remote Procedure Call: Restrict Unauthenticated RPC clients | Medium | 0 | 2 | Failed | Medium |
| 1694 | Administrative Templates: System | Security Settings: Enable svchost.exe mitigation options | Medium | 0 | 1 | Failed | Medium |
| 1695 | Administrative Templates: System | Windows Performance PerfTrack: Enable/Disable PerfTrack | Medium | 1 | 0 | Failed | Medium |
| 1696 | Administrative Templates: System | User Profiles: Turn off the advertising ID | Medium | 0 | 1 | Failed | Medium |
| 1697 | Administrative Templates: System | Time Providers: Enable Windows NTP Client | Medium | 0 | 1 | Failed | Medium |
| 1698 | Administrative Templates: System | Time Providers: Enable Windows NTP Server | Passed | 0 | 0 | Passed | Medium |
| 1700 | Administrative Templates: Windows Components | App Package Deployment: Allow a Windows app to share application data between users | Medium | 1 | 0 | Failed | Medium |
| 1701 | Administrative Templates: Windows Components | App Privacy: Let Windows apps activate with voice while the system is locked | Medium | 0 | 2 | Failed | Medium |
| 1702 | Administrative Templates: Windows Components | App runtime: Block launching Universal Windows apps with Windows Runtime API access from hosted content | Medium | 0 | 1 | Failed | Medium |
| 1703 | Administrative Templates: Windows Components | Application Compatibility: Turn off Application Telemetry | Medium | 1 | 0 | Failed | Medium |
| 1704 | Administrative Templates: Windows Components | AutoPlay Policies: Turn off Autoplay | Medium | 0 | 255 | Failed | Medium |
| 1705 | Administrative Templates: Windows Components | AutoPlay Policies: Disallow Autoplay for non-volume devices | Medium | 0 | 1 | Failed | Medium |
| 1706 | Administrative Templates: Windows Components | AutoPlay Policies: Set the default behavior for AutoRun | Medium | 0 | 1 | Failed | Medium |
| 1707 | Administrative Templates: Windows Components | Biometrics: Allow the use of biometrics | Medium | 1 | 0 | Failed | Medium |
| 1773 | Administrative Templates: Windows Components | Biometrics: Facial Features: Configure enhanced anti-spoofing | Medium | | 1 | Failed | Medium |
| 1708 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Volume status | High | FullyDecrypted | FullyEncrypted | Failed | High |
| 1761 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Choose drive encryption method and cipher strength (for operating system drives) | Passed | 6 | 6 | Passed | Medium |
| 1762 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Drive encryption method (for operating system drives) | Medium | None | XtsAes128 | Failed | Medium |
| 1709 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Disable new DMA devices when this computer is locked | Medium | 0 | 1 | Failed | Medium |
| 1710 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Allow Secure Boot for integrity validation | Medium | 0 | 1 | Failed | Medium |
| 1711 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup | Medium | 0 | 1 | Failed | Medium |
| 1715 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Allow BitLocker without a compatible TPM | Medium | 1 | 0 | Failed | Medium |
| 1716 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup | Passed | 0 | 0 | Passed | Medium |
| 1717 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup PIN | Medium | 0 | 1 | Failed | Medium |
| 1718 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key | Passed | 0 | 0 | Passed | Medium |
| 1719 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup: Configure TPM startup key and PIN | Passed | 0 | 0 | Passed | Medium |
| 1712 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Allow enhanced PINs for startup | Medium | 0 | 1 | Failed | Medium |
| 1713 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Configure use of hardware-based encryption for operating system drives | Passed | 0 | 0 | Passed | Medium |
| 1763 | Administrative Templates: Windows Components | BitLocker Drive Encryption: Operating System Drives: Configure minimum PIN length for startup | Medium | | 8 | Failed | Medium |
| 1720 | Administrative Templates: Windows Components | Cloud Content: Do not show Windows tips | Medium | 0 | 1 | Failed | Medium |
| 1721 | Administrative Templates: Windows Components | Cloud Content: Turn off Microsoft consumer experiences | Passed | 1 | 1 | Passed | Medium |
| 1722 | Administrative Templates: Windows Components | Credential User Interface: Do not display the password reveal button | Medium | 0 | 1 | Failed | Medium |
| 1724 | Administrative Templates: Windows Components | Credential User Interface: Enumerate administrator accounts on elevation | Medium | 1 | 0 | Failed | Medium |
| 1725 | Administrative Templates: Windows Components | Data Collection and Preview Builds: Allow Diagnostic Data | Passed | 0 | 1 | Passed | Medium |
| 1726 | Administrative Templates: Windows Components | Data Collection and Preview Builds: Allow device name to be sent in Windows diagnostic data | Medium | 1 | 0 | Failed | Medium |
| 1727 | Administrative Templates: Windows Components | Delivery Optimization: Download Mode | Medium | 1 | 99 | Failed | Medium |
| 1728 | Administrative Templates: Windows Components | Event Log Service: Application: Specify the maximum log file size (KB) | Medium | 4096 | 32768 | Failed | Medium |
| 1729 | Administrative Templates: Windows Components | Event Log Service: Security: Specify the maximum log file size (KB) | Medium | 4096 | 196608 | Failed | Medium |
| 1730 | Administrative Templates: Windows Components | Event Log Service: System: Specify the maximum log file size (KB) | Medium | 4096 | 32768 | Failed | Medium |
| 1774 | Administrative Templates: Windows Components | Event Log Service: Microsoft-Windows-PowerShell/Operational: Specify the maximum log file size (KB) | Medium | 15728640 | 268435456 | Failed | Medium |
| 1775 | Administrative Templates: Windows Components | Event Log Service: PowerShellCore/Operational: Specify the maximum log file size (KB) | Medium | 15728640 | 268435456 | Failed | Medium |
| 1731 | Administrative Templates: Windows Components | File Explorer: Allow the use of remote paths in file shortcut icons | Passed | 0 | 0 | Passed | Medium |
| 1732 | Administrative Templates: Windows Components | HomeGroup: Prevent the computer from joining a homegroup | Medium | 0 | 1 | Failed | Medium |
| 1800 | Microsoft Defender Antivirus | Turn off Microsoft Defender Antivirus | Passed | 0 | 0 | Passed | Medium |
| 1826 | Microsoft Defender Antivirus | Enable Tamper Protection (Status) | Medium | | True | Failed | Medium |
| 1801 | Microsoft Defender Antivirus | Configure detection for potentially unwanted applications | Medium | 0 | 1 | Failed | Medium |
| 1806 | Microsoft Defender Antivirus | Exclusions: Extension Exclusions (Policy) | Passed | | | Passed | Medium |
| 1813 | Microsoft Defender Antivirus | Exclusions: Extension Exclusions (Intune) | Passed | | | Passed | Medium |
| 1807 | Microsoft Defender Antivirus | Exclusions: Extension Exclusions | Passed | | | Passed | Medium |
| 1808 | Microsoft Defender Antivirus | Exclusions: Path Exclusions (Policy) | Passed | | | Passed | Medium |
| 1814 | Microsoft Defender Antivirus | Exclusions: Path Exclusions (Intune) | Passed | | | Passed | Medium |
| 1809 | Microsoft Defender Antivirus | Exclusions: Path Exclusions | Passed | | | Passed | Medium |
| 1810 | Microsoft Defender Antivirus | Exclusions: Process Exclusions (Policy) | Passed | | | Passed | Medium |
| 1815 | Microsoft Defender Antivirus | Exclusions: Process Exclusions (Intune) | Passed | | | Passed | Medium |
| 1811 | Microsoft Defender Antivirus | Exclusions: Process Exclusions | Passed | | | Passed | Medium |
| 1816 | Microsoft Defender Antivirus | MAPS: Join Microsoft MAPS | Medium | 0 | 2 | Failed | Medium |
| 1817 | Microsoft Defender Antivirus | MAPS: Configure the 'Block at First Sight' feature | Medium | | 0 | Failed | Medium |
| 1818 | Microsoft Defender Antivirus | MAPS: Send file samples when further analysis is required | Medium | | 0 | Failed | Medium |
| 1819 | Microsoft Defender Antivirus | MpEngine: Enable file hash computation feature | Medium | | 1 | Failed | Medium |
| 1820 | Microsoft Defender Antivirus | MpEngine: Select cloud protection level | Medium | 0 | 2 | Failed | Medium |
| 1821 | Microsoft Defender Antivirus | Real-time Protection: Scan all downloaded files and attachments | Passed | 0 | 0 | Passed | Medium |
| 1822 | Microsoft Defender Antivirus | Real-time Protection: Turn off real-time protection | Passed | 0 | 0 | Passed | Medium |
| 1823 | Microsoft Defender Antivirus | Real-time Protection: Turn on behavior monitoring (Policy) | Passed | 0 | 0 | Passed | Medium |
| 1824 | Microsoft Defender Antivirus | Real-time Protection: Turn on script scanning | Passed | 0 | 0 | Passed | Medium |
| 1825 | Microsoft Defender Antivirus | Scan: Scan removable drives | Medium | 1 | 0 | Failed | Medium |
| 1812 | Microsoft Defender Antivirus | Enable sandboxing for Microsoft Defender Antivirus | Medium | 0 | 1 | Failed | Medium |
| 1900 | Microsoft Defender Exploit Guard | Attack Surface Reduction rules | Medium | 0 | 1 | Failed | Medium |
| 1901 | Microsoft Defender Exploit Guard | ASR: Block executable content from email client and webmail (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1916 | Microsoft Defender Exploit Guard | ASR: Block executable content from email client and webmail | Medium | 0 | 1 | Failed | Medium |
| 1933 | Microsoft Defender Exploit Guard | ASR: Block executable content from email client and webmail (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1902 | Microsoft Defender Exploit Guard | ASR: Block all Office applications from creating child processes (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1917 | Microsoft Defender Exploit Guard | ASR: Block all Office applications from creating child processes | Medium | 0 | 1 | Failed | Medium |
| 1934 | Microsoft Defender Exploit Guard | ASR: Block all Office applications from creating child processes (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1903 | Microsoft Defender Exploit Guard | ASR: Block Office applications from creating executable content (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1918 | Microsoft Defender Exploit Guard | ASR: Block Office applications from creating executable content | Medium | 0 | 1 | Failed | Medium |
| 1935 | Microsoft Defender Exploit Guard | ASR: Block Office applications from creating executable content (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1904 | Microsoft Defender Exploit Guard | ASR: Block Office applications from injecting code into other processes (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1919 | Microsoft Defender Exploit Guard | ASR: Block Office applications from injecting code into other processes | Medium | 0 | 1 | Failed | Medium |
| 1936 | Microsoft Defender Exploit Guard | ASR: Block Office applications from injecting code into other processes (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1905 | Microsoft Defender Exploit Guard | ASR: Block JavaScript or VBScript from launching downloaded executable content (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1920 | Microsoft Defender Exploit Guard | ASR: Block JavaScript or VBScript from launching downloaded executable content | Medium | 0 | 1 | Failed | Medium |
| 1937 | Microsoft Defender Exploit Guard | ASR: Block JavaScript or VBScript from launching downloaded executable content (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1906 | Microsoft Defender Exploit Guard | ASR: Block execution of potentially obfuscated scripts (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1921 | Microsoft Defender Exploit Guard | ASR: Block execution of potentially obfuscated scripts | Medium | 0 | 1 | Failed | Medium |
| 1938 | Microsoft Defender Exploit Guard | ASR: Block execution of potentially obfuscated scripts (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1907 | Microsoft Defender Exploit Guard | ASR: Block Win32 API calls from Office macros (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1922 | Microsoft Defender Exploit Guard | ASR: Block Win32 API calls from Office macros | Medium | 0 | 1 | Failed | Medium |
| 1939 | Microsoft Defender Exploit Guard | ASR: Block Win32 API calls from Office macros (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1908 | Microsoft Defender Exploit Guard | ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1923 | Microsoft Defender Exploit Guard | ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion | Medium | 0 | 1 | Failed | Medium |
| 1940 | Microsoft Defender Exploit Guard | ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1909 | Microsoft Defender Exploit Guard | ASR: Use advanced protection against ransomware (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1924 | Microsoft Defender Exploit Guard | ASR: Use advanced protection against ransomware | Medium | 0 | 1 | Failed | Medium |
| 1941 | Microsoft Defender Exploit Guard | ASR: Use advanced protection against ransomware (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1910 | Microsoft Defender Exploit Guard | ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1925 | Microsoft Defender Exploit Guard | ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) | Medium | 0 | 1 | Failed | Medium |
| 1942 | Microsoft Defender Exploit Guard | ASR: Block credential stealing from the Windows local security authority subsystem (lsass.exe) (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1911 | Microsoft Defender Exploit Guard | ASR: Block process creations originating from PSExec and WMI commands (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1926 | Microsoft Defender Exploit Guard | ASR: Block process creations originating from PSExec and WMI commands | Medium | 0 | 1 | Failed | Medium |
| 1943 | Microsoft Defender Exploit Guard | ASR: Block process creations originating from PSExec and WMI commands (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1912 | Microsoft Defender Exploit Guard | ASR: Block untrusted and unsigned processes that run from USB (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1927 | Microsoft Defender Exploit Guard | ASR: Block untrusted and unsigned processes that run from USB | Medium | 0 | 1 | Failed | Medium |
| 1944 | Microsoft Defender Exploit Guard | ASR: Block untrusted and unsigned processes that run from USB (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1913 | Microsoft Defender Exploit Guard | ASR: Block Office communication application from creating child processes (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1928 | Microsoft Defender Exploit Guard | ASR: Block Office communication application from creating child processes | Medium | 0 | 1 | Failed | Medium |
| 1945 | Microsoft Defender Exploit Guard | ASR: Block Office communication application from creating child processes (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1914 | Microsoft Defender Exploit Guard | ASR: Block Adobe Reader from creating child processes (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1929 | Microsoft Defender Exploit Guard | ASR: Block Adobe Reader from creating child processes | Medium | 0 | 1 | Failed | Medium |
| 1946 | Microsoft Defender Exploit Guard | ASR: Block Adobe Reader from creating child processes (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1915 | Microsoft Defender Exploit Guard | ASR: Block persistence through WMI event subscription (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1930 | Microsoft Defender Exploit Guard | ASR: Block persistence through WMI event subscription | Medium | 0 | 1 | Failed | Medium |
| 1947 | Microsoft Defender Exploit Guard | ASR: Block persistence through WMI event subscription (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1931 | Microsoft Defender Exploit Guard | ASR: Block abuse of exploited vulnerable signed drivers (Policy) | Medium | 0 | 1 | Failed | Medium |
| 1932 | Microsoft Defender Exploit Guard | ASR: Block abuse of exploited vulnerable signed drivers | Medium | 0 | 1 | Failed | Medium |
| 1948 | Microsoft Defender Exploit Guard | ASR: Block abuse of exploited vulnerable signed drivers (Intune) | Medium | 0 | 1 | Failed | Medium |
| 1966 | Microsoft Defender Exploit Guard | ASR: Exclude files and paths from Attack Surface Reduction Rules (Policy) | Passed | | | Passed | Medium |
| 1967 | Microsoft Defender Exploit Guard | ASR: Exclude files and paths from Attack Surface Reduction Rules | Passed | | | Passed | Medium |
| 1968 | Microsoft Defender Exploit Guard | ASR: Exclude files and paths from Attack Surface Reduction Rules (Intune) | Passed | | | Passed | Medium |
| 1965 | Microsoft Defender Exploit Guard | Network Protection: Prevent users and apps from accessing dangerous websites | Medium | | 1 | Failed | Medium |
| 1767 | Administrative Templates: Windows Components | News and interests: Enable news and interests on the taskbar | Medium | | 0 | Failed | Medium |
| 1733 | Administrative Templates: Windows Components | OneDrive: Prevent the usage of OneDrive for file storage | Medium | 0 | 1 | Failed | Medium |
| 1734 | Administrative Templates: Windows Components | Remote Desktop Connection Client: Do not allow passwords to be saved | Medium | 0 | 1 | Failed | Medium |
| 1735 | Administrative Templates: Windows Components | Remote Desktop Session Host: Allow users to connect remotely by using Remote Desktop Services | Medium | 0 | 1 | Failed | Medium |
| 1736 | Administrative Templates: Windows Components | Remote Desktop Session Host: Device and Resource Redirection: Do not allow drive redirection | Medium | 0 | 1 | Failed | Medium |
| 1737 | Administrative Templates: Windows Components | Remote Desktop Session Host: Security: Always prompt for password upon connection | Medium | 0 | 1 | Failed | Medium |
| 1738 | Administrative Templates: Windows Components | Remote Desktop Session Host: Security: Require secure RPC communication | Medium | 0 | 1 | Failed | Medium |
| 1739 | Administrative Templates: Windows Components | Remote Desktop Session Host: Security: Set client connection encryption level | Medium | 0 | 3 | Failed | Medium |
| 1740 | Administrative Templates: Windows Components | Search: Allow Cloud Search | Medium | 1 | 0 | Failed | Medium |
| 1741 | Administrative Templates: Windows Components | Search: Allow Cortana | Passed | 0 | 0 | Passed | Medium |
| 1742 | Administrative Templates: Windows Components | Search: Allow Cortana above lock screen | Medium | 1 | 0 | Failed | Medium |
| 1743 | Administrative Templates: Windows Components | Search: Allow indexing of encrypted files | Medium | 1 | 0 | Failed | Medium |
| 1744 | Administrative Templates: Windows Components | Search: Allow search and Cortana to use location | Medium | 1 | 0 | Failed | Medium |
| 1745 | Administrative Templates: Windows Components | Search: Set what information is shared in Search | Medium | 1 | 3 | Failed | Medium |
| 1746 | Administrative Templates: Windows Components | Windows Error Reporting: Disable Windows Error Reporting | Passed | 1 | 1 | Passed | Medium |
| 1747 | Administrative Templates: Windows Components | Windows Game Recording and Broadcasting: Enables or disables Windows Game Recording and Broadcasting | Low | 1 | 0 | Failed | Low |
| 1748 | Administrative Templates: Windows Components | Windows Ink Workspace: Allow Windows Ink Workspace | Passed | 0 | 0 | Passed | Medium |
| 1749 | Administrative Templates: Windows Components | Windows Installer: Always install with elevated privileges | Passed | 0 | 0 | Passed | Medium |
| 1750 | Administrative Templates: Windows Components | Windows Installer: Allow user control over installs | Medium | 1 | 0 | Failed | Medium |
| 1751 | Administrative Templates: Windows Components | Windows Installer: Prevent Internet Explorer security prompt for Windows Installer scripts | Medium | 1 | 0 | Failed | Medium |
| 1752 | Administrative Templates: Windows Components | Windows Logon Options: Sign-in and lock last interactive user automatically after a restart | Medium | 0 | 1 | Failed | Medium |
| 1770 | Administrative Templates: Windows Components | Windows Installer: Disable Co-Installer (USB AutoInstall) | Medium | | 1 | Failed | Medium |
| 1753 | Administrative Templates: Windows Components | WinRM Client: Allow Basic authentication | Medium | 1 | 0 | Failed | Medium |
| 1754 | Administrative Templates: Windows Components | WinRM Client: Allow unencrypted traffic | Medium | 1 | 0 | Failed | Medium |
| 1755 | Administrative Templates: Windows Components | WinRM Client: Disallow Digest authentication | Medium | 1 | 0 | Failed | Medium |
| 1756 | Administrative Templates: Windows Components | WinRM Service: Allow remote server management through WinRM | Medium | 1 | 0 | Failed | Medium |
| 1757 | Administrative Templates: Windows Components | WinRM Service: Allow Basic authentication | Medium | 1 | 0 | Failed | Medium |
| 1758 | Administrative Templates: Windows Components | WinRM Service: Allow unencrypted traffic | Medium | 1 | 0 | Failed | Medium |
| 1759 | Administrative Templates: Windows Components | WinRM Service: Disallow WinRM from storing RunAs credentials | Medium | 0 | 1 | Failed | Medium |
| 1760 | Administrative Templates: Windows Components | Windows Remote Shell: Allow Remote Shell Access | Medium | 1 | 0 | Failed | Medium |
| 2000 | Administrative Templates: Windows Components | File Explorer: Configure Windows Defender SmartScreen | Medium | 0 | 1 | Failed | Medium |
| 2001 | Administrative Templates: Windows Components | File Explorer: Configure Windows Defender SmartScreen to warn and prevent bypass | Medium | Warn | Block | Failed | Medium |
| 2105 | PowerShell | Turn on PowerShell Module Logging | Low | 0 | 1 | Failed | Low |
| 2106 | PowerShell | Turn on PowerShell Module Logging - Module Names | Low | | * | Failed | Low |
| 2100 | PowerShell | Turn on PowerShell Script Block Logging | Medium | 0 | 1 | Failed | Medium |
| 2101 | PowerShell | Turn on PowerShell Script Block Logging (Invocation) | Low | 0 | 1 | Failed | Low |
| 2102 | PowerShell | Turn on PowerShell Transcription | Low | 0 | 1 | Failed | Low |
| 2107 | PowerShell | Turn on PowerShell Transcription (Invocation) | Low | 0 | 1 | Failed | Low |
| 2103 | PowerShell | Disable PowerShell version 2 | Medium | Enabled | Disabled | Failed | Medium |
| 2104 | PowerShell | Disable PowerShell version 2 (root) | Medium | Enabled | Disabled | Failed | Medium |
| 2200 | MS Security Guide | LSA Protection | Medium | | 1 | Failed | Medium |
| 2201 | MS Security Guide | Lsass.exe audit mode | Low | | 8 | Failed | Low |
| 2202 | MS Security Guide | NetBT NodeType configuration | Medium | 0 | 2 | Failed | Medium |
| 2203 | MS Security Guide | WDigest Authentication | Passed | 0 | 0 | Passed | High |
| 2209 | MS Security Guide | Enable Structured Exception Handling Overwrite Protection (SEHOP) | Passed | 0 | 0 | Passed | Medium |
| 2210 | MS Security Guide | Limits print driver installation to Administrators | Medium | | 1 | Failed | Medium |
| 2211 | MS Security Guide | Configure RPC packet level privacy setting for incoming connections | Medium | | 1 | Failed | Medium |
| 2212 | MS Security Guide | Manage processing of Queue-specific files | Medium | | 1 | Failed | Medium |
| 2204 | MSS (Legacy) | MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) | Medium | 0 | 1 | Failed | Medium |
| 2205 | MSS (Legacy) | MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) | Medium | 0 | 2 | Failed | Medium |
| 2206 | MSS (Legacy) | MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) | Medium | 1 | 2 | Failed | Medium |
| 2207 | MSS (Legacy) | MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Medium | 1 | 0 | Failed | Medium |
| 2208 | MSS (Legacy) | MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Medium | 0 | 1 | Failed | Medium |
| 2400 | Scheduled Task | XblGameSave Standby Task | Medium | Ready | Disabled | Failed | Medium |
| 2411 | System Services | Disable mDNS in Dnscache service | Medium | | 0 | Failed | Medium |
| 2401 | System Services | Print Spooler (Spooler) | Medium | 3 | 4 | Failed | Medium |
| 2402 | System Services | Print Spooler (Spooler) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 2412 | System Services | WebClient (WebClient) | Medium | 3 | 4 | Failed | Medium |
| 2413 | System Services | WebClient (WebClient) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 2403 | System Services | Xbox Accessory Management Service (XboxGipSvc) | Medium | 3 | 4 | Failed | Medium |
| 2404 | System Services | Xbox Accessory Management Service (XboxGipSvc) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 2405 | System Services | Xbox Live Auth Manager (XblAuthManager) | Medium | 3 | 4 | Failed | Medium |
| 2406 | System Services | Xbox Live Auth Manager (XblAuthManager) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 2407 | System Services | Xbox Live Game Save (XblGameSave) | Medium | 3 | 4 | Failed | Medium |
| 2408 | System Services | Xbox Live Game Save (XblGameSave) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 2409 | System Services | Xbox Live Networking Service (XboxNetApiSvc) | Medium | 3 | 4 | Failed | Medium |
| 2410 | System Services | Xbox Live Networking Service (XboxNetApiSvc) (Service Startup type) | Medium | Manual | Disabled | Failed | Medium |
| 1950 | Microsoft Defender Exploit Guard | Exploit protection: Control flow guard (CFG) | Medium | NOTSET | ON | Failed | Medium |
| 1951 | Microsoft Defender Exploit Guard | Exploit protection: Data Execution Prevention (DEP) | Medium | NOTSET | ON | Failed | Medium |
| 1952 | Microsoft Defender Exploit Guard | Exploit protection: Override Data Execution Prevention (DEP) | Passed | False | False | Passed | Medium |
| 1954 | Microsoft Defender Exploit Guard | Exploit protection: Force randomization for images (Mandatory ASLR) | Medium | NOTSET | ON | Failed | Medium |
| 1955 | Microsoft Defender Exploit Guard | Exploit protection: Override force randomization for images (Mandatory ASLR) | Passed | False | False | Passed | Medium |
| 1956 | Microsoft Defender Exploit Guard | Exploit protection: Randomize memory allocations (Bottom-up ASLR) | Medium | NOTSET | ON | Failed | Medium |
| 1957 | Microsoft Defender Exploit Guard | Exploit protection: Override randomize memory allocations (Bottom-up ASLR) | Passed | False | False | Passed | Medium |
| 1958 | Microsoft Defender Exploit Guard | Exploit protection: High-entropy ASLR | Medium | NOTSET | ON | Failed | Medium |
| 1959 | Microsoft Defender Exploit Guard | Exploit protection: Override high-entropy ASLR | Passed | False | False | Passed | Medium |
| 1960 | Microsoft Defender Exploit Guard | Exploit protection: Validate exception chains (SEHOP) | Medium | NOTSET | ON | Failed | Medium |
| 1961 | Microsoft Defender Exploit Guard | Exploit protection: Validate exception chains (SEHOP (Telemetry only) | Medium | NOTSET | OFF | Failed | Medium |
| 1962 | Microsoft Defender Exploit Guard | Exploit protection: Override validate exception chains (SEHOP) | Passed | False | False | Passed | Medium |
| 1963 | Microsoft Defender Exploit Guard | Exploit protection: Validate heap integrity | Medium | NOTSET | ON | Failed | Medium |
| 1964 | Microsoft Defender Exploit Guard | Exploit protection: Override validate heap integrity | Passed | False | False | Passed | Medium |
| 1953 | Microsoft Defender Exploit Guard | Force use of Data Execution Prevention (DEP) | Medium | OptIn | AlwaysOn | Failed | Medium |
| 2300 | Windows Firewall | HardeningKitty-Block-TCP-NetBIOS | Low | | True | Failed | Low |
| 2301 | Windows Firewall | HardeningKitty-Block-TCP-RDP | Low | | True | Failed | Low |
| 2302 | Windows Firewall | HardeningKitty-Block-TCP-RPC | Low | | True | Failed | Low |
| 2303 | Windows Firewall | HardeningKitty-Block-TCP-SMB | Low | | True | Failed | Low |
| 2304 | Windows Firewall | HardeningKitty-Block-TCP-WinRM | Low | | True | Failed | Low |
| 2305 | Windows Firewall | HardeningKitty-Block-UDP-NetBIOS | Low | | True | Failed | Low |
| 2306 | Windows Firewall | HardeningKitty-Block-UDP-RPC | Low | | True | Failed | Low |
| 2307 | Windows Firewall | HardeningKitty-Block-calc-x64 | Low | | True | Failed | Low |
| 2308 | Windows Firewall | HardeningKitty-Block-calc-x86 | Low | | True | Failed | Low |
| 2309 | Windows Firewall | HardeningKitty-Block-certutil-x64 | Low | | True | Failed | Low |
| 2310 | Windows Firewall | HardeningKitty-Block-certutil-x86 | Low | | True | Failed | Low |
| 2311 | Windows Firewall | HardeningKitty-Block-conhost-x64 | Low | | True | Failed | Low |
| 2312 | Windows Firewall | HardeningKitty-Block-conhost-x86 | Low | | True | Failed | Low |
| 2313 | Windows Firewall | HardeningKitty-Block-cscript-x64 | Low | | True | Failed | Low |
| 2314 | Windows Firewall | HardeningKitty-Block-cscript-x86 | Low | | True | Failed | Low |
| 2315 | Windows Firewall | HardeningKitty-Block-mshta-x64 | Low | | True | Failed | Low |
| 2316 | Windows Firewall | HardeningKitty-Block-mshta-x86 | Low | | True | Failed | Low |
| 2317 | Windows Firewall | HardeningKitty-Block-notepad-x64 | Low | | True | Failed | Low |
| 2318 | Windows Firewall | HardeningKitty-Block-notepad-x86 | Low | | True | Failed | Low |
| 2319 | Windows Firewall | HardeningKitty-Block-RunScriptHelper-x64 | Low | | True | Failed | Low |
| 2320 | Windows Firewall | HardeningKitty-Block-RunScriptHelper-x86 | Low | | True | Failed | Low |
| 2321 | Windows Firewall | HardeningKitty-Block-wscript-x64 | Low | | True | Failed | Low |
| 2322 | Windows Firewall | HardeningKitty-Block-wscript-x86 | Low | | True | Failed | Low |